Few disciplines require the comprehension of as much information in so little time as computer security. With billions of data records piling up daily for large organizations, no technique holds as much promise as using computer-generated images to tell the story of what's in the dataa process known as visual analytics. Here, Knowledge Center contributor Justin Wolf explains how to use visual analytics to improve IT cyber-security.
Data
visualization has been around for decades, but modern desktop computers
finally possess the power to turn raw data into interactive displays
for analysis, enabling computer security analysts to use visual
analytics techniques to solve daily problems.
Although many other tools exist to assist
organizations with computer securityfrom intrusion detection and
prevention systems to firewalls and anti-virus applicationsnone of
these solve the data overload problem as effectively as visual analytic
software. This is because the problem central to data analysis is an
effective reduction of false positives and superfluous data, while
preserving important information (sometimes called "improving the
signal-to-noise ratio").
Visual analytics allows analysts to interactively
apply a wide variety of tools to make important data pop out of the
abyss and become instantly understandable. In essence, visual analytics
reduces the time taken to convert information to knowledge by an order
of magnitude or better. This is possible for a variety of reasons:
Reason No. 1: Visual analytics allows
computer security professionals to rethink how to recognize risks and
protect against cyber threats. In turn, this allows for more effective
attack prevention and faster isolation and mitigation of attacks that
do occur.
Reason No. 2: Visual analytics enables key
aspects of the digital forensic process, including data collection,
discovery, investigation, examination, analysis and reporting. Visual
analytics enables sense-making in cyber security and computer forensics
in the following three unique ways:
First, computer network intrusion detection system
(NIDS) log file data can be loaded and suspicious connections between
machines examined. This data can be combined with other log data to
develop a more complete understanding of security breach events.
Second, e-mails can be forensically examined to
model communications patterns and to summarize e-mail content. And
third, directory structures can be displayed and filtered on file
modification times to see what activity occurred on what dates.
Multiple file systems can be quickly compared to discover identical
files that may have been transferred from one machine to another.
Reason No. 3: Visual analytics offers
capabilities for information discovery, processing and
visualizationtactics which apply across many applications for computer
security and forensics, including:
1. Analyzing a computer system after an intrusion to determine how the attacker gained access and what the attacker did.
2. Analyzing the information on seized hardware, especially within the intelligence, military and law enforcement communities.
3. Using computer forensic techniques to analyze the computer systems belonging to defendants in legal cases.
Incorporating visual analytics into an
organization's best practices allows computer security professionals to
quickly identify threats to their own organizations. By doing so
earlier and more comprehensively than their competitors, this leads to
significant competitive advantage in the face of increasing threats and
daily attacks. As companies rely ever more heavily on computers and
digital information, the rapid response enabled through visual
analytics becomes even more appealing.
These reasons explain why the United States
government has aggressively funded visual analytics programs for
national defense, with a heavy emphasis on computer security. The National Visualization and Analytics Center (NVAC)
is one such example of this. Traditionally funded through grants from
the Department of Homeland Security, this effort has gained significant
traction in academic and now commercial circles. Many of the products
developed through this and other federal efforts are now reaching the
general public, making a huge impact on the ability of companies to
discover knowledge from visually analyzing myriad types and vast
quantities of data.
Clearly, visual analytics has plenty to offer
computer security professionals and the organizations for which they
work. Applying visual analytic tools to the computer security domain is
usually straightforward and, since working with interactive graphics is
engaging, learning the techniques and tactics for visually analyzing
computer security data is relatively simple (compared with the other
skills these professionals have already developed and cultivated).
As the field continues to mature, we should see
huge advances in productivity, reductions in response times, and
recognition of organizations embracing this new technology when
confronted with increasingly sophisticated malicious threats.
Justin Wolf is Product Manager, Government Solutions for Future Point Systems.
Justin has over 20 years of experience in software and network
engineering, as both an engineer and manager at companies such as Sega,
Sony and Cisco Systems. Justin has a B.S. in Computer Systems and a
M.S. in Engineering Management. He can be reached at jjwolf@futurepointsystems.com.
Network Security & Hardware 
/ 4 
