Manual analysis of security-related events is still a necessity to investigate non-trivial cyber attacks. This task is particularly hard when the events involve slow, stealthy and large-scale activities typical of the modern cybercriminals' strategy. In this regard, visualization tools can effectively help analysts in their investigations. In this paper, we present BURN, an interactive visualization tool for displaying autonomous systems exhibiting rogue activity that helps at finding misbehaving networks through visual and interactive exploration. Up to seven values are displayed in a single visual element, while avoiding cumbersome and confusing maps. To this end, animations and alpha channels are leveraged to create simple views that highlight relevant activity patterns. In addition, BURN incorporates a simple algorithm to identify migrations of nefarious services across autonomous systems, which can support, for instance, root-cause analysis and law enforcement investigations.
@inproceedings{Roveta2011BURN_Baring,
title = {{BURN: Baring Unknown Rogue Networks}},
author = {Roveta, Francesco and Di Mario, Luca and Maggi, Federico and Caviglia, Giorgio and Zanero, Stefano and Ciuccarelli, Paolo},
booktitle = {Proceedings of the 8th International Symposium on Visualization for Cyber Security},
series = {VizSec},
month = {June},
year = {2011},
address = {New York, NY, USA},
isbn = {978-1-4503-0679-9},
pages = {6:1--6:10},
publisher = {ACM}
}