A Study on Labeling Network Hostile Behavior with Intelligent Interactive Tools

Jorge Guerra Torres, Eduardo Enrique Veas, Carlos Adrián Catania

Research output: Contribution to conferencePaperpeer-review

Abstract

Labeling a real network dataset is specially expensive in computer security, as an expert has to ponder several factors before assigning each label. This paper describes an interactive intelligent system to support the task of identifying hostile behavior in network logs. The RiskID application uses visualizations to graphically encode features of network connections and promote visual comparison. In the background, two algorithms are used to actively organize con- nections and predict potential labels: a recommendation algorithm and a semi-supervised learning strategy. These algorithms together with interactive adaptions to the user interface constitute a behavior recommendation. A study is carried out to analyze how the algo- rithms for recommendation and prediction influence the workflow of labeling a dataset. The results of a study with 16 participants indicate that the behaviour recommendation significantly improves the quality of labels. Analyzing interaction patterns, we identify a more intuitive workflow used when behaviour recommendation is available.
Original languageEnglish
Publication statusPublished - 2019
EventIEEE Symposium on Visualization for Cyber Security - Vancouver, Canada
Duration: 20 Oct 201925 Oct 2019
http://ieeevis.org/year/2019/welcome

Conference

ConferenceIEEE Symposium on Visualization for Cyber Security
Abbreviated titleVIZSEC
Country/TerritoryCanada
Period20/10/1925/10/19
Internet address

Fingerprint

Dive into the research topics of 'A Study on Labeling Network Hostile Behavior with Intelligent Interactive Tools'. Together they form a unique fingerprint.

Cite this