PCAPFunnel: A Tool for Rapid Exploration of Packet Capture Files

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14610%2F21%3A00121642" target="_blank" >RIV/00216224:14610/21:00121642 - isvavai.cz</a>

Nalezeny alternativní kódy

RIV/00216305:26230/21:PU142933

Výsledek na webu

<a href="http://dx.doi.org/10.1109/IV53921.2021.00021" target="_blank" >http://dx.doi.org/10.1109/IV53921.2021.00021</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1109/IV53921.2021.00021" target="_blank" >10.1109/IV53921.2021.00021</a>

Jazyk výsledku

angličtina

Název v původním jazyce

PCAPFunnel: A Tool for Rapid Exploration of Packet Capture Files

Popis výsledku v původním jazyce

Analyzing network traffic is one of the fundamental tasks in both network operations and security incident analysis. Despite the immense efforts in workflow automation, an ample portion of the work still relies on manual data exploration and analytical insights by domain specialists. Current state-of-the-art network analysis tools provide high flexibility at the expense of usability and have a steep learning curve. Recent---often web-based---analytical tools emphasize interactive visualizations and provide simple user interfaces but only limited analytical support. This paper describes the tool that supports the analytical work of network and security operators. We introduce typical user tasks and requirements. We also present the filtering funnel metaphor for exploring packet capture (PCAP) files through visualizations of linked filter steps. We have created PCAPFunnel, a novel tool that improves the user experience and speeds up packet capture data analysis. The tool provides an overview of the communication, intuitive data filtering, and details of individual network nodes and connections between them. The qualitative usability study with nine domain experts confirmed the usability and usefulness of our approach for the initial data exploration in a wide range of tasks and usage scenarios, from educational purposes to exploratory network data analysis.

Název v anglickém jazyce

PCAPFunnel: A Tool for Rapid Exploration of Packet Capture Files

Popis výsledku anglicky

Analyzing network traffic is one of the fundamental tasks in both network operations and security incident analysis. Despite the immense efforts in workflow automation, an ample portion of the work still relies on manual data exploration and analytical insights by domain specialists. Current state-of-the-art network analysis tools provide high flexibility at the expense of usability and have a steep learning curve. Recent---often web-based---analytical tools emphasize interactive visualizations and provide simple user interfaces but only limited analytical support. This paper describes the tool that supports the analytical work of network and security operators. We introduce typical user tasks and requirements. We also present the filtering funnel metaphor for exploring packet capture (PCAP) files through visualizations of linked filter steps. We have created PCAPFunnel, a novel tool that improves the user experience and speeds up packet capture data analysis. The tool provides an overview of the communication, intuitive data filtering, and details of individual network nodes and connections between them. The qualitative usability study with nine domain experts confirmed the usability and usefulness of our approach for the initial data exploration in a wide range of tasks and usage scenarios, from educational purposes to exploratory network data analysis.

Druh

D - Stať ve sborníku

CEP obor

—

OECD FORD obor

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Projekt

<a href="/cs/project/EF16_019%2F0000822" target="_blank" >EF16_019/0000822: Centrum excelence pro kyberkriminalitu, kyberbezpečnost a ochranu kritických informačních infrastruktur</a><br>

Návaznosti

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Rok uplatnění

2021

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název statě ve sborníku

2021 25th International Conference Information Visualisation (IV)

ISBN

9781665438278

ISSN

1093-9547

e-ISSN

—

Počet stran výsledku

8

Strana od-do

69-76

Název nakladatele

The Institute of Electrical and Electronics Engineers, Inc.

Místo vydání

United States of America

Místo konání akce

Sydney, Australia

Datum konání akce

5. 7. 2021

Typ akce podle státní příslušnosti

WRD - Celosvětová akce

Kód UT WoS článku

—