Towards Designing Effective Visualizations for DNS-based Network Threat Analysis
1 like2,745 views
The document discusses the challenges of network threat analysis, particularly focusing on the use of the Domain Name System (DNS) by both legitimate applications and cyber attacks. It presents an approach called the Open Source Threat Analysis Console (THACO) that utilizes various data sources and user-centered visualization techniques to aid analysts. The evaluation of THACO revealed positive usability ratings among experienced analysts, though improvements are needed for tracking information over time.
![Analyst
Alerts Threat Intelligence
The Domain Name System (DNS) is an essential protocol used by
both legitimate Internet applications and cyber attacks
[Building a Dynamic Reputation System for DNS, Antonakakis et al. 2010]
3](https://image.slidesharecdn.com/thacoslidesvizsec2017-171010034354/85/Towards-Designing-Effective-Visualizations-for-DNS-based-Network-Threat-Analysis-3-320.jpg)
![Threat Intelligence Acquisition
โSecurity analysts are still collecting threat intelligence via
email, spreadsheets, and cutting/pasting information from
web-based sources. Obviously, these manual processes
donโt scaleโ
[Enterprise Strategy Group (ESG) Research Report: Threat Intelligence and Its Role Within Enterprise
Cybersecurity Practices,
June 2015]
5](https://image.slidesharecdn.com/thacoslidesvizsec2017-171010034354/85/Towards-Designing-Effective-Visualizations-for-DNS-based-Network-Threat-Analysis-5-320.jpg)
![Analytics
โThreat intelligence may offer clues but human beings are
left to do the heavy lifting by investigating and analyzing
the data on their ownโ
[ESG Research Report: Threat Intelligence and Its Role Within Enterprise Cybersecurity Practices,
June 2015]
6](https://image.slidesharecdn.com/thacoslidesvizsec2017-171010034354/85/Towards-Designing-Effective-Visualizations-for-DNS-based-Network-Threat-Analysis-6-320.jpg)
Towards Designing Effective Visualizations for DNS-based Network Threat Analysis
- 1. Towards Designing Effective Visualizations for DNS-based Network Threat Analysis Rosa Romero-Gรณmez, Yacin Nadji, and Manos Antonakakis {rgomez30,yacin,manos}@gatech.edu
- 2. What is Network Threat Analysis? 2
- 3. Analyst Alerts Threat Intelligence The Domain Name System (DNS) is an essential protocol used by both legitimate Internet applications and cyber attacks [Building a Dynamic Reputation System for DNS, Antonakakis et al. 2010] 3
- 4. Challenges 4
- 5. Threat Intelligence Acquisition โSecurity analysts are still collecting threat intelligence via email, spreadsheets, and cutting/pasting information from web-based sources. Obviously, these manual processes donโt scaleโ [Enterprise Strategy Group (ESG) Research Report: Threat Intelligence and Its Role Within Enterprise Cybersecurity Practices, June 2015] 5
- 6. Analytics โThreat intelligence may offer clues but human beings are left to do the heavy lifting by investigating and analyzing the data on their ownโ [ESG Research Report: Threat Intelligence and Its Role Within Enterprise Cybersecurity Practices, June 2015] 6
- 7. Our Approach: Open Source THreat Analysis COnsole (THACO) Open Datasets Visualization Techniques 7
- 8. 8 Classless Inter-Domain Routing (CIDR) Notation 192.0.0.0/8 192.1.0.0/16 192.2.0.0/16 192.168.16.0/24 192.3.0.0/16 192.2.3.0/24 192.2.3.1/32 192.2.3.12/32 /8 /16 /24 /32
- 9. Access to THACO live demo: https://ipviz.gtisc.gatech.edu/ 9
- 10. User-centered Visualization Design Domain Problem / Data Characterization Design Prototype Evaluation 10
- 11. Domain Problem & Data Characterization โข Procedure: informal interviews with two domain experts in network threat analysis during two months โข Output: two main high-level categories of tasks and data requirements: Top-down network threat analysis or Threat Hunting Bottom-up network threat analysis or Incident Response 11
- 12. Domain Problem & Data Characterization โข Effective threat intelligence involves the combination of multiple data sources: โข Active DNS datasets (https://www.activednsproject.org/) โข Public Domain Blacklists such as abuse.ch โข Malware Traces (https://www.virustotal.com) โข Domain WHOIS records (https://www.threatminer.org/) 12
- 13. Design โข Design Goals 1. Multiple views 2. Different levels of detail 3. Scalability Multi-grouping, zoomable treemap 13
- 14. Evaluation โข Participants: โข Network threat analysts are hard to find โข Seven in-situ and thirty-one online network threat analysts from both academia and industry โข Years of experience ranging < 1 year to > 10 years โข Procedure: โข In-situ evaluation: tasks scenarios and semi-structured interviews โข Online evaluation: web-based survey (SUS, System Usability Scale) 14
- 15. Evaluation โข Main Results: โข Threat analysis experience of participants affects neither task completion rates nor task completion times using THACO โข Experience analysts satisfaction garnered THACO an โAโ grade in usability โข Limitations: โข THACO could be improved for tasks involving keeping track of different pieces of information over time 15
- 16. Want data? Active DNS datasets: https:// www.activednsproject.org/ 16
- 17. Want a demo? THACO live demo: https:// ipviz.gtisc.gatech.edu/ 17
- 18. Want code? Source code on GitHub: https:// github.com/Astrolavos/THACO 18
- 19. Questions? 19
- 20. Towards Designing Effective Visualizations for DNS-based Network Threat Analysis Rosa Romero-Gรณmez, Yacin Nadji, and Manos Antonakakis {rgomez30,yacin,manos}@gatech.edu