Seeflow: A Visualization System Using 2T Hybrid Graph for Characteristics Analysis of Abnormal Netflow

With the network expansion, the development of information highway, and the numerous data generated by applications, Netflow log size has been rapidly expanding. This paper proposes the use of visualization techniques to quickly and effectively identify network attacks and abnormal events, as well as perceive network security situation. A 2T (combination with Time-series and Treemap) graph visualization system, named Seeflow, is developed, which uses information entropy of Netflow’s features to draw a Time-series graph and use cross-entropies to distinguish between the normal and abnormal flow stream. Time-series graph can overview the network state from macro level. And Treemap graph is used to drill down into details from micro level. In addition, the exponential function is used to conduct quantitative analysis for the performance of Treemap. The Seeflow system also creates graphical features to visually analyze attacks and find interesting patterns. In experiment, VAST Challenge2013 competition dataset is analyzed by Seeflow system. Comparing with the prize-winning works shows that Seeflow can intuitively display network security situation from both of macro and micro level and effectively identify network attacks as well as support decision-making.