Research On Visualization Of Network Security Situation

Developing with network technologies, abnormal network activities become out of control. And they may influence economics and politics at some time. Because of bad efficiency and wrong alarms, present security products could not satisfy users' needs in security area.Visualization of network security situation, which combines technologies in network security situational awareness and that in visualizations, is a new technology used in network security area. With strong abilities in processing pictures of human brain, pictures that contain information of network situation are shown to users in the aim of detecting and analyzing abnormal activities. This way makes full use of advantages of computers and human in picture processing. For this reason, abilities of analyzing data are highly promoted and efficiency of detecting is bigger than that of before.Through mastering researches on visualizations in and abroad, the visualization system of network security situation is designed. This system aims at finding better ways to solve security problems that lies ahead of us. During the whole procedure of system designing, the ability of human is paid more attention than has been taken as an important role. Users are involved in the loop of visualization system. And it has been taken as a basic principle in all modules during the whole procedure. The visualization of network security situation system can generate situation map of network. Users can interact with visualization system in the form of multi-views, multi-angle and multi-scale form human-machine interface.One view of visualization system, which is in the form of three dimensions, is another problem should be solved in this essay. Designing details are shown and this software is programmed with developing platform of OpenGL. The software presents Netflow data in the model of spinning cube with forms of dots data to show real time situation. At last, it is proved that this 3D view can generate situation by making simulating experiments. The results show that this software can generate intuitionist views, especially for attacks like port scan and IP scan. This software has met its goal when it is designed.