VizSec 2013 Visualization for Cyber Security

Visualization for Cyber Security

October 14, 2013
  /   Atlanta GA, USA

In conjunction with IEEE VIS

VizSec was held in Atlanta GA, USA on October 14, 2013. VizSec brings together researchers and practitioners in information visualization and security to address the specific needs of the cyber security community through new and insightful visualization techniques.

VizSec was held as a workshop at IEEE VIS.

The proceedings are available in the ACM Digital Library: http://dl.acm.org/citation.cfm?id=2517957.

Program Schedule

8:50 - 9:00
John Goodall, VizSec Chair : Welcome
9:00 - 10:00
Keynote: David S. Ebert - Visual Analytics for Security, Safety, and Privacy: Approaches, Lessons Learned, Opportunities, and Challenges
10:00 – 10:10
Poster Fast Forward
10:10 – 10:45
Break
10:45 – 12:00
Paper Session: Logging and Forensics
  • Visualizing PHPIDS Log Files for Better Understanding of Web Server Attacks
    Mansour Alsaleh, Abdullah Alqahtani, Abdulrahman Alarifi, Abdulmalik Al-Salman
  • ELVIS: Extensible Log VISualization
    Christopher Humphries, Nicolas Prigent, Frédéric Majorczyk, Christophe Bidan
  • Change-Link 2.0: A Digital Forensic Tool for Visualizing Changes to Shadow Volume Data
    Timothy Leschke, Charles Nicholas
12:00 – 2:00
Lunch
2:00 – 3:15
Paper Session: Network Security
  • CyberSAVe - Situational Awareness Visualization for Cyber Security of Smart Grid Systems
    Lisa Dipippo, William Matuszak, Yan Lindsay Sun
  • Flexible Web Visualization for Alert Based Network Security Analytics
    Lihua Hao, Christopher Healey, Steve Hutchinson
  • NAVSEC: A Recommender System for 3D Network Security Visualizations
    Troy Nunnally, Kulsoom Abdullah, A. Selcuk Uluagac, John A. Copeland, Raheem Beyah
3:15 - 3:40
Paper Session: Anomaly Detection
  • SRNET: A Real-time, Cross-based Anomaly Detection and Visualization System for Wireless Sensor Networks
    Eirini Karapistoli, Panagiotis Sarigiannidis, Anastasios A. Economides
3:40 – 4:15
Break
4:15 - 5:05
Paper Session: Anomaly Detection
  • BGPfuse: Using Visual Feature Fusion for the Detection and Attribution of BGP Anomalies
    Stavros Papadopoulos, Georgios Theodoridis, Dimitrios Tzovaras
  • Finding Anomalies in Time-Series using Visual Correlation for Interactive Root Cause Analysis
    Florian Stoffel, Fabian Fischer, Daniel Keim
5:10 - 5:55
Invited Speaker: Clay Moody - A Holistic Operational Framework for Establishing Situational Awareness in Cyberspace

Keynote

David S. Ebert

Visual Analytics for Security, Safety, and Privacy: Approaches, Lessons Learned, Opportunities, and Challenges

presentation

Designing and deploying effective software environments to increase analysis and decision making efficiency and effectiveness can be problematic, as there is often a chasm between research idea and integrated operational solution. This chasm can become even more insurmountable because of the different backgrounds of those involved and different criteria and expectations for success. However, bridging this divide has great benefits to not only improve security, safety, and effectiveness, but also to accelerate the state-of-the art of visualization and visual analytics research. In this talk, I will discuss approaches and lessons learned from designing and deploying fielded solutions for public safety applications; some interesting approaches and activities related to security visual analytics; and some challenges and opportunities for visual analytics in privacy, security, and safety applications.

David Ebert is the Silicon Valley Professor of Electrical and Computer Engineering at Purdue University, a University Faculty Scholar, a Fellow of the IEEE, and Director of the Visual Analytics for Command Control and Interoperability Center (VACCINE), the Visualization Science team of the Department of Homeland Security's Command Control and Interoperability Center of Excellence. Dr. Ebert performs research in novel visualization techniques, visual analytics, volume rendering, information visualization, perceptually-based visualization, illustrative visualization, mobile graphics and visualization, and procedural abstraction of complex, massive data. Ebert has been very active in the visualization community, teaching courses, presenting papers, co-chairing many conference program committees, serving on the ACM SIGGRAPH Executive Committee, serving as Editor in Chief of IEEE Transactions on Visualization and Computer Graphics, serving as a member of the IEEE Computer Society's Publications Board, serving on the IEEE Computer Society Board of Governors, and successfully managing a large program of external funding to develop more effective methods for visually communicating information.

Invited Speaker

Clay Moody

A Holistic Operational Framework for Establishing Situational Awareness in Cyberspace

presentation

William Clay Moody is a US Army Major and Army Fellow at Clemson University. He is a member of Clemson's Big Data Systems lab researching alternative optimizations methodologies for big data systems. He has an appointment to the faculty of the Department of Electrical Engineering and Computer Science at West Point, the United States Military Academy following his Ph.D. studies. Clay is a founding member and former Cyber Battle Captain for the US Cyber Command, Fort Meade, MD. Clay also served as the Cyber Defense Operations advisor to the Commander of US Forces in Iraq.

Our nation, including the Department of Defense, relies heavily on information systems and networking technologies to efficiently conduct a wide variety of missions across the globe. With the ever- increasing rate of cyber attacks, this dependency places the nation at risk of a loss of confidentiality, integrity, and availability of its critical information resources; degrading its ability to complete the mission. In this talk, we will present a Holistic Operational Framework for Establishing Situational Awareness in Cyberspace (HOFESAC), whose goal is to provide the nation’s leadership timely and accurate information to gain an understanding of the operational cyber environment to enable strategic, operational, and tactical decision making. In doing so, we present the key information components of cyber situational awareness and present a hypothetical case study demonstrating how they must be consolidated to provide a clear and relevant picture to a commander. In addition, current organizational and technical challenges are discussed, and areas for future research are addressed.

Papers

Mansour Alsaleh, Abdullah Alqahtani, Abdulrahman Alarifi, Abdulmalik Al-Salman
"Visualizing PHPIDS Log Files for Better Understanding of Web Server Attacks" paper link | presentation
Christopher Humphries, Nicolas Prigent, Frédéric Majorczyk, Christophe Bidan
"ELVIS: Extensible Log VISualization" paper link | presentation
Timothy Leschke, Charles Nicholas
"Change-Link 2.0: A Digital Forensic Tool for Visualizing Changes to Shadow Volume Data" paper link | presentation
Lisa Dipippo, William Matuszak, Yan Lindsay Sun
"CyberSAVe - Situational Awareness Visualization for Cyber Security of Smart Grid Systems" paper link | presentation
Lihua Hao, Christopher Healey, Steve Hutchinson
"Flexible Web Visualization for Alert Based Network Security Analytics" paper link | presentation
Troy Nunnally, Kulsoom Abdullah, A. Selcuk Uluagac, John A. Copeland, Raheem Beyah
"NAVSEC: A Recommender System for 3D Network Security Visualizations" paper link | presentation
Eirini Karapistoli, Panagiotis Sarigiannidis, Anastasios A. Economides
"SRNET: A Real-time, Cross-based Anomaly Detection and Visualization System for Wireless Sensor Networks" paper link | presentation
Stavros Papadopoulos, Georgios Theodoridis, Dimitrios Tzovaras
"BGPfuse: Using Visual Feature Fusion for the Detection and Attribution of BGP Anomalies" paper link | presentation
Florian Stoffel, Fabian Fischer, Daniel Keim
"Finding Anomalies in Time-Series using Visual Correlation for Interactive Root Cause Analysis" paper link | presentation

Posters

Baijian Yang and Yingjie Victor Chen
"Effective Visual Analysis on Information Security" abstract
Jong Hyun Kim, Young Soo Kim and Ik Kyun Kim
"Cooperative Security Monitoring System" abstract
Dustin Arendt
"Hot Topics: Information Retrieval for Network Security" poster | abstract
Larry Bunch, Jeffrey M. Bradshaw and Michael Vignati
"The Netflow Observatory: An Interactive 3-D Event Visualization" poster | abstract
Tom Cross and Andrea Fletcher
"Visual Investigations of Botnet Command and Control Behavior" poster | abstract
James Wernicke, Joshua Neil and Curtis Hash
"PathScanUI: A Web Application for Viewing and Analyzing Anomalous Network Activity (Or Any Graph Data Really)" poster | abstract
Celeste Lyn Paul, Randall Rohrer, Patrick Sponaugle, Jenna Huston and Bohdan Nebesh
"CyberSAVI: A Cyber Situation Awareness Visual Interface for Mission-Level Network Situation Awareness" poster | abstract

The 10th Visualization for Cyber Security (VizSec) is a forum that brings together researchers and practitioners from academia, government, and industry to address the needs of the cyber security community through new and insightful visualization and analysis techniques. VizSec will provide an excellent venue for fostering greater exchange and new collaborations on a broad range of security- and privacy-related topics. Accepted papers will appear in the ACM Digital Library as part of the ACM International Conference Proceedings Series.

Important research problems often lie at the intersection of disparate domains. Our focus is to explore effective, scalable visual interfaces for security domains, where visualization may provide a distinct benefit, including computer forensics, reverse engineering, insider threat detection, cryptography, privacy, preventing 'user assisted' attacks, compliance management, wireless security, secure coding, and penetration testing in addition to traditional network security. Human time and attention are precious resources. We are particularly interested in visualization and interaction techniques that effectively capture human analyst insights so that further processing may be handled by machines, freeing the analyst for other tasks. For example, a malware analyst might use a visualization system to analyze a new piece of malicious software and then facilitate generating a signature for future machine processing. When appropriate, research that incorporates multiple data sources, such as network packet captures, firewall rule sets and logs, DNS logs, web server logs, and/or intrusion detection system logs, is particularly desirable.

Technical Papers

Full papers offering novel contributions in security visualization are solicited. Papers may present techniques, applications, practical experience, theory, analysis, or experiments and evaluations. We encourage papers on technologies and methods that promise to improve cyber security practices, including, but not limited to:

Posters

Poster submissions may showcase late-breaking results, work in progress, preliminary results, or visual representations relevant to the VizSec community. Accepted poster abstracts will be made available on this website.

Awards

There will be an award for the best paper from the accepted program. The best paper award will be given to the paper judged to have the highest overall quality. A key element of the best paper selection process will be whether the results are believed to be repeatable by other scientists based on the algorithms and data provided in the paper. This award will be chosen by the program committee.

Data

If you do not have real-world data to demonstrate your visualization, you may be interested in looking at the VAST 2012 Challenge data. VAST 2011 also had cyber security data if you are looking for additional data.

Papers

Papers should be at most 8 pages including the bibliography and appendices. Committee members are not required to read the appendices or any pages past the maximum. Submissions not meeting these guidelines will be rejected without consideration of their merits. Submitted papers must not substantially overlap papers that have been published or that are simultaneously submitted to a journal or a conference with proceedings. Authors of accepted papers must guarantee that their papers will be presented at the conference, preferably by themselves or by prior arrangement through a delegate.

Posters

Poster submissions consist of an extended abstract of at most 2 pages including figures and references. Authors must present a corresponding poster during the designated poster session. Poster authors have the opportunity to give a brief oral preview during a plenary "fast forward" session.

Paper Formatting

The VizSec proceedings will be published by ACM. The ACM SIG Proceedings Templates provides Word and LaTeX templates. (If you are using LaTeX, please use Option 2: LaTeX2e - Tighter Alternate style.)

Authors should apply ACM Computing Classification categories and terms. ACM invites authors to submit an image representation of their article. The image must be selected from the article body and can be any of the following: art, graphic, table, figures, etc. (Image files are to be as square as possible, 100x100 ppi and in jpg format.) Authors must supply a caption with the image. The caption length should be no more than 512 characters.

Submission

Submit papers and poster abstracts using EasyChair: http://www.easychair.org/conferences/?conf=vizsec2013

Submissions are now closed.

* All deadlines are 5:00 PM EDT. *

Papers

July 22, 2013
Submission for Papers
August 23, 2013
Author Notification for Papers
September 6, 2013
Camera Ready Submission and Copyright Forms for Papers
October 8, 2013
Papers Available in ACM Digital Library

Posters

August 23, 2013
Abstract Submission for Posters
September 1, 2013
Author Notification for Poster

VizSec is held with the IEEE VIS Conferece. To register, continue to the VIS Conference Registration page.

The conference will be located at the downtown Marriott Marquis Hotel. The Atlanta Marriott Marquis, 3rd largest Marriott in the world, rises 50 stories and contains 1,569 rooms and 94 suites. For more information see the IEEE VIS venue information page, hotel information page, and travel information page.

General Chair
John Goodall, Oak Ridge National Laboratory
Program Chair
Kwan-Liu Ma, University of California, Davis
Publications / Publicity Chair
Sophie Engle, University of San Francisco
Poster Chair
Fabian Fischer, University of Konstanz

Program Committee

Email questions to vizsec2013@easychair.org or post to the Google Group.