NVisionIP: an interactive network flow visualization tool for security

Kiran Lakkaraju, William Yurcik, Ratna Bearavolu, Adam J. Lee

Abstract: Security engineers are being overwhelmed with data from the network monitoring tools. A tool is needed that would allow security engineers to view information about the entire network. In addition, the tool must allow the security engineers to use their background knowledge and intuition. NVisionIP, a tool developed at the National Center for Supercomputing Applications at the University of Illinois, Urbana-Champaign, provides a visualization of a class B network. Following the visual information seeking mantra ("overview first, zoom and alter then details-on-demand"), NVisionIP provides a visualization of an entire class B network, then allows users to drill down and gather more details about the hosts on the network. Combining the visualization and data processing capabilities of computers and the intuition and reasoning capabilities of humans, NVisionIP is a tool that allows security engineers to detect and stop attacks on networks.