elvis - vizsec · manual analysis is slow. ... nominal fields use distributions pie charts, bar...
TRANSCRIPT
![Page 1: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/1.jpg)
ELVisExtensible Log Visualization
christopher.humphries @ inria.fr
nicolas.prigent @ supelec.fr
christophe.bidan @ supelec.fr
frederic.majorczyk @ supelec.fr
![Page 2: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/2.jpg)
Hello.My name is Christopher Humphries.
I'm a PhD student from Rennes, France.
Working at INRIA/Supélec, in team CIDre.
On a research grant from DGA-MI.
![Page 3: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/3.jpg)
CIDreWe try to solve security problems.
INTRUSION DETECTION ADHOC NETWORKS PRIVACY
I work on security visualization.
![Page 4: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/4.jpg)
Why visualize ?
![Page 5: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/5.jpg)
GenerallyHelp ourselves.
Make more sense of data.
Understand the big picture.
Regain control.
![Page 6: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/6.jpg)
In securityBridge a gap.
Manual analysis is slow.
Automatic analysis is dumb.
![Page 7: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/7.jpg)
However…
Extra knowledge required!
statistics for the numbers
design for the colors
psychology for brain compatibility
![Page 8: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/8.jpg)
Solution
Move knowledge into software.
![Page 9: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/9.jpg)
“Pshaw! It's been done before!”
![Page 10: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/10.jpg)
AutovisStatistically automatic and unopinionated visualization.
TableauAssisted and facilitated creation of general visualizations.
![Page 11: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/11.jpg)
ELVisParses logs
Uses security semantics
Assists exploration by selecting and matching visualisations
![Page 12: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/12.jpg)
Log Organization
Each log has a specific format
APACHE STANDARD SNORT …
Log entries in one file have the same fields
TIME SOURCE IP DESTINATION PORT …
Every log field has types
ORDINAL CATEGORICAL TIME GEOGRAPHICAL …
![Page 13: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/13.jpg)
Log AugmentationLog datasets are augmented
Horizontally fields of certain types spawn extra fields
IP spawns GEOLOCATION(IP)
Vertically statistical summary for each field
MAX MIN DISTRIBUTION …
![Page 14: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/14.jpg)
Automated Selection of RepresentationsInformed decision based on stats and types.
NOMINAL fields use distributions Pie charts, bar charts
TIME requires trend visualizations Line charts, gantt charts
GEOGRAPHIC fields require spatial charts Maps, real world layout
![Page 15: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/15.jpg)
Log AcquisitionLogs are parsed using the right format
Files can be dragged in straight from the system
![Page 16: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/16.jpg)
Summary View
![Page 17: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/17.jpg)
Top Bar
Dataset name, brief info, tools.
![Page 18: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/18.jpg)
Key Field
Basic visualization, filtering is already available.
The key field is time so distribution of events is displayed.
![Page 19: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/19.jpg)
Other Fields
Displayed as small multiples according to type and stats.
Distribution histogram for NOMINAL fields.
Line chart for trends in CARDINAL fields.
![Page 20: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/20.jpg)
User InteractionFields are selected and dragged to construct visualizations
![Page 21: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/21.jpg)
![Page 22: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/22.jpg)
TestingExploring the HoneyViz dataset.
Patterns found! Ideas formed!
Promising…
Some logs were a strain to load…
![Page 23: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/23.jpg)
![Page 24: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/24.jpg)
Roadmap
![Page 25: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/25.jpg)
User ExperienceBetter exploration.
Brushing and Filtering.
Chained visualizations.
![Page 26: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/26.jpg)
ScalabilityLarger and multiple datasets.
Load more data.
Compare and reference datasets.
Server integration Splunk, Hive?
Sharing and collaboration.
![Page 27: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/27.jpg)
RecordingTake notes, save configurations.
Record datamining scenarios.
Save effective dashboard arrangements.
Inform the datasets.
Help generate reports.
![Page 28: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/28.jpg)
Technical StuffWeb based
D3.js • Miso Chart • Miso Dataset
Server prototypes in Node.js.
![Page 29: ELVis - VizSec · Manual analysis is slow. ... NOMINAL fields use distributions Pie charts, bar charts TIME requires trend visualizations Line charts, gantt charts ... Server integration](https://reader034.vdocuments.mx/reader034/viewer/2022042710/5f647b80b4234728eb01255d/html5/thumbnails/29.jpg)
Thank you.Questions?