Název:	SyCaT-Vis: Visualization-Based Support of Analyzing System Behavior based on System Call Traces
Autoři:	Hausdorf, Alrik Hinzmann, Nicole Zeckzer, Dirk
Citace zdrojového dokumentu:	WSCG 2019: full papers proceedings: 27. International Conference in Central Europe on Computer Graphics, Visualization and Computer Vision, p. 45-54.
Datum vydání:	2019
Nakladatel:	Václav Skala - UNION Agency
Typ dokumentu:	konferenční příspěvek conferenceObject
URI:	http://hdl.handle.net/11025/35608
ISBN:	978-80-86943-37-4 (CD/-ROM)
ISSN:	2464–4617 (print) 2464-4625 (CD/DVD)
Klíčová slova:	vizualizace zabezpečení;stopy systémového volání;bezpečnostní analýza;analýza chování
Klíčová slova v dalším jazyce:	security visualization;system call traces;security analysis;behavior analysis
Abstrakt v dalším jazyce:	Detecting anomalies in the behavior of a computer system is crucial for determining its security. One way of detecting these anomalies is based on the assessment of the amount and sequence of system calls issued by processes. While the number of processes on a computer can become very large, the number of system calls issued during the lifespan of such a process and its subprocesses can be humongous. In order to decide whether these anomalies are due to the intended system usage or if they are caused by malicious actions, this humongous amount of data needs being analyzed. Thus, a careful analysis of the system calls’ types, their amount, and their temporal sequence requires sophisticated support. Visualization is frequently used for this type of tasks. Starting with a carefully aggregation of the data presented in an overview representation, the quest for information is supported by carefully crafted interactions. These allow filtering the tremendous amount of data, thus removing the standard behavior data and leaving the potentially suspicious one. The latter can then be investigated on increasingly finer levels. Supporting this goal-oriented analysis, we propose novel interactive visualizations implemented in the tool SyCaT-Vis. SyCaT-Vis fosters obtaining important insights into the behavior of computer systems, the processes executed, and the system call sequences issued.
Práva:	© Václav Skala - UNION Agency
Vyskytuje se v kolekcích:	WSCG 2019: Full Papers Proceedings

Všechny záznamy v DSpace jsou chráněny autorskými právy, všechna práva vyhrazena.