เทคนิคพาราเลลคอร์ดิเนตสำหรับตรวจสอบพฤติกรรมการกระทำผิดบนเครือข่าย
Article Sidebar
Main Article Content
บทคัดย่อ
- งานวิจัยนีทำการศึกษาพฤติกรรมการใช้งานเครือข่ายจากข้อมูลจราจรทางคอมพิวเตอร์ โดยตรวจจับพฤติกรรมที่มีการละเมิดนโยบายความปลอดภัยของเครือข่าย ซึ&งจะเป็นประโยชน์ในการสืบสวนหาตัวผู้กระทำความผิดมาลงโทษ ผู้วิจัย นำเสนอ User investigations with visualization time machine for network forensic (UIV) model ในการศึกษาพฤติกรรม การใช้งานเครือข่ายโดยใช้เทคนิค Parallel coordinates ซึ&งแสดงความสัมพันธ์ด้วยตัวแปร User, Source IP address, Time, Destination IP address, Destination service และ Domain name ในเบืองต้นผู้วิจัยทำการทดลองโดยจำลองสถานการณ์การโจมตีเพ&ือศึกษาว่าตัวแปรต่างๆ ท&ีนำเสนอจะสามารถบ่งชี้พฤติกรรมการใช้งานเครือข่ายได้หรือไม่ ซึ&งพบว่า (i) Attacksignatures ที่ได้จากการทดลองจะมีความแตกต่างกันไปตามสถานการณ์การโจมตี และ (ii) ผู้วิเคราะห์สามารถติดตามพฤติกรรมการใช้งานเครือข่ายในแต่ละรายได้
Article Details
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
I/we certify that I/we have participated sufficiently in the intellectual content, conception and design of this work or the analysis and interpretation of the data (when applicable), as well as the writing of the manuscript, to take public responsibility for it and have agreed to have my/our name listed as a contributor. I/we believe the manuscript represents valid work. Neither this manuscript nor one with substantially similar content under my/our authorship has been published or is being considered for publication elsewhere, except as described in the covering letter. I/we certify that all the data collected during the study is presented in this manuscript and no data from the study has been or will be published separately. I/we attest that, if requested by the editors, I/we will provide the data/information or will cooperate fully in obtaining and providing the data/information on which the manuscript is based, for examination by the editors or their assignees. Financial interests, direct or indirect, that exist or may be perceived to exist for individual contributors in connection with the content of this paper have been disclosed in the cover letter. Sources of outside support of the project are named in the cover letter.
I/We hereby transfer(s), assign(s), or otherwise convey(s) all copyright ownership, including any and all rights incidental thereto, exclusively to the Journal, in the event that such work is published by the Journal. The Journal shall own the work, including 1) copyright; 2) the right to grant permission to republish the article in whole or in part, with or without fee; 3) the right to produce preprints or reprints and translate into languages other than English for sale or free distribution; and 4) the right to republish the work in a collection of articles in any other mechanical or electronic format.
We give the rights to the corresponding author to make necessary changes as per the request of the journal, do the rest of the correspondence on our behalf and he/she will act as the guarantor for the manuscript on our behalf.
All persons who have made substantial contributions to the work reported in the manuscript, but who are not contributors, are named in the Acknowledgment and have given me/us their written permission to be named. If I/we do not include an Acknowledgment that means I/we have not received substantial contributions from non-contributors and no contributor has been omitted.
เอกสารอ้างอิง
2. M. I. Cohen, “Source attribution for network address translated forensic captures,” Digital Investigation, vol. 5, pp. 138-145, 2009.
3. R. Hadjidj, M. Debbabi, H. Lounis, F. Iqbal, A. Szporer, and D. Benredjem, “Towards an integrated e-mail forensic analysis framework,” Digital Investigation, vol. 5, pp.124-137, 2009.
4. H. Choi, H. Lee, and H. Kim, “Fast detection and visualization of network attacks on parallel coordinates,” Computers and Security, vol. 28, pp. 276-288, 2009.
5. R. Ball, G. A. Fink, and C. North, “Home-centric visualization of network traffic for security administration,” in VizSEC/DMSEC ’04: Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, October 2004, pp. 55-64.
6. D. Phan, A. Paepcke, , and T. Winograd, “Progressive multiples for communication-minded visualization,” in Graphics Interface Conference, May 2007, pp. 225-232.
7. X. Yin, W. Yurcik, M. Treaster, Y. Li, and K. Lakkaraju, “Visflowconnect: netflow visualizations of link relationships for security situational awareness,” in VizSEC/DMSEC ’04: Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, October 2004, pp. 26-34.
8. G. Conti and K. Abdullah, “Passive visual fingerprinting of network attack tools,” in VizSEC/DMSEC ’04: Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, October 2004, pp. 45-54.
9. S. Krasser, G. Conti, J. Grizzard, J. Gribschaw, and H. Owen, “Real-time and forensic network data analysis using animated and coordinated visualization,” in Information Assurance Workshop, 2005. IAW ’05. Proceedings from the Sixth Annual IEEE SMC, June 2005, pp. 42-49.
10. G. Conti, K. Abdullah, J. Grizzard, J. Stasko, J. A. Copeland, M. Ahamad, H. L. Owen, and C. Lee, “Countering security information overload through alert and packet visualization,” IEEE Comput. Graph., vol. 26, pp. 60-70, March/April 2006.
11. A. Inselberg, “Multidimensional detective,” in INFOVIS ’97: Proceedings of the 1997 IEEE Symposium on Information Visualization (InfoVis ’97), 1997, pp. 100– 107.
12. N. Promrit and A. Mingkhwan, “User investigations with visualization time machine for network forensic,” Information Technology Journal, vol. 11, pp. 31–36, 201
