|SyCaT-Vis: Visualization-Based Support of Analyzing System Behavior based on System Call Traces
|WSCG 2019: full papers proceedings: 27. International Conference in Central Europe on Computer Graphics, Visualization and Computer Vision, p. 45-54.
|Václav Skala - UNION Agency
|vizualizace zabezpečení;stopy systémového volání;bezpečnostní analýza;analýza chování
|Keywords in different language:
|security visualization;system call traces;security analysis;behavior analysis
|Abstract in different language:
|Detecting anomalies in the behavior of a computer system is crucial for determining its security. One way of detecting these anomalies is based on the assessment of the amount and sequence of system calls issued by processes. While the number of processes on a computer can become very large, the number of system calls issued during the lifespan of such a process and its subprocesses can be humongous. In order to decide whether these anomalies are due to the intended system usage or if they are caused by malicious actions, this humongous amount of data needs being analyzed. Thus, a careful analysis of the system calls’ types, their amount, and their temporal sequence requires sophisticated support. Visualization is frequently used for this type of tasks. Starting with a carefully aggregation of the data presented in an overview representation, the quest for information is supported by carefully crafted interactions. These allow filtering the tremendous amount of data, thus removing the standard behavior data and leaving the potentially suspicious one. The latter can then be investigated on increasingly finer levels. Supporting this goal-oriented analysis, we propose novel interactive visualizations implemented in the tool SyCaT-Vis. SyCaT-Vis fosters obtaining important insights into the behavior of computer systems, the processes executed, and the system call sequences issued.
|© Václav Skala - UNION Agency
|Appears in Collections:
|WSCG 2019: Full Papers Proceedings
Please use this identifier to cite or link to this item:
Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.