Data Visualization for Intrusion Detection System

Replies

• 

  Manish Goyal

  Basically if your purpose is to capture and analyze packets then you can go for java
  
  Here you can use third party tool jpcap which provides a lot of inbuilt classes as well as functions for capturing packets and analyze it
• 

  mayjune

  Ok. Thats a Good Start. What about the Data Visualization part? Do you think Java would be helpful in that?
  I'll give you an idea of how it can be helpful. Lets say Host A has IDS installed. I have an XY plotted graph, in which X represents Time. And Y represent Port No. of that Host. Each time a Host is accessed, A Dot is represnted on the graph. Different Source IP represent Diff color.
  
  Now lets say Host B wants to hack Host A. It first starts with Port Scanning. In port scanning as you may know, it will try pinging each port to get a reply back.
  Now if on the graph, I'll see a line going on lets say from 12000 - 13000 port nos from time 5:30:00 - 5:32:00. If i see the source IP add, i can make out its from the same IP add. Hence i can conclude that Host B is trying to hack my computer.