Using relational graphs for exploratory analysis of network traffic data

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14610%2F23%3A00130589" target="_blank" >RIV/00216224:14610/23:00130589 - isvavai.cz</a>

Výsledek na webu

<a href="https://doi.org/10.1016/j.fsidi.2023.301563" target="_blank" >https://doi.org/10.1016/j.fsidi.2023.301563</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1016/j.fsidi.2023.301563" target="_blank" >10.1016/j.fsidi.2023.301563</a>

Jazyk výsledku

angličtina

Název v původním jazyce

Using relational graphs for exploratory analysis of network traffic data

Popis výsledku v původním jazyce

The human brain is designed to perceive the surrounding world as associations. These associations between the individual pieces of information allow us to analyze and categorize new inputs and thus understand them. However, the support for association-based analysis in traditional network analysis tools is only limited or not present at all. These tools are mostly based on manual browsing, filtering, and aggregation, with only basic support for statistical analyses and visualizations for communicating the general characteristics. Yet, it is the relationship diagram that could allow the analysts to get a broader context and reveal the associations hidden in the data. In this paper, we explore the possibilities of relational analysis as a novel paradigm for network forensics. We provide a set of user requirements based on the discussion with domain experts and introduce a novel visual analysis tool utilizing multimodal graphs for modeling relationships between entities from captured packet traces. Finally, we demonstrate the relational analysis process on two use cases and discuss feedback from domain experts.

Název v anglickém jazyce

Using relational graphs for exploratory analysis of network traffic data

Popis výsledku anglicky

The human brain is designed to perceive the surrounding world as associations. These associations between the individual pieces of information allow us to analyze and categorize new inputs and thus understand them. However, the support for association-based analysis in traditional network analysis tools is only limited or not present at all. These tools are mostly based on manual browsing, filtering, and aggregation, with only basic support for statistical analyses and visualizations for communicating the general characteristics. Yet, it is the relationship diagram that could allow the analysts to get a broader context and reveal the associations hidden in the data. In this paper, we explore the possibilities of relational analysis as a novel paradigm for network forensics. We provide a set of user requirements based on the discussion with domain experts and introduce a novel visual analysis tool utilizing multimodal graphs for modeling relationships between entities from captured packet traces. Finally, we demonstrate the relational analysis process on two use cases and discuss feedback from domain experts.

Druh

J_imp - Článek v periodiku v databázi Web of Science

CEP obor

—

OECD FORD obor

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Projekt

<a href="/cs/project/EF16_019%2F0000822" target="_blank" >EF16_019/0000822: Centrum excelence pro kyberkriminalitu, kyberbezpečnost a ochranu kritických informačních infrastruktur</a><br>

Návaznosti

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Rok uplatnění

2023

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název periodika

Forensic Science International: Digital Investigation

ISSN

2666-2825

e-ISSN

2666-2817

Svazek periodika

45

Číslo periodika v rámci svazku

S

Stát vydavatele periodika

US - Spojené státy americké

Počet stran výsledku

10

Strana od-do

1-10

Kód UT WoS článku

001049948800008

EID výsledku v databázi Scopus

2-s2.0-85169837809