Visualization tools may cut through the security logjam

Whether they're performing an analysis of an attack or observing the network traffic for large corporations, security professionals deal with a lot of data. Security professionals -- charged with protecting the electronic crown jewels -- deal with a lot of data. The task of sorting through the mountains of recorded information can seem daunting at times, but help appears to be on the horizon.

New technologies, demonstrated at the Black Hat Briefings conference in Las Vegas, can parse large and complex logs or data files and generate visual information based on those logs or data that may be able to help security professionals find the proverbial needle in the haystack.

[ For more on the events and revelations at the 2008 Black Hat and Defcon security conferences, check out InfoWorld's special report. ]

Network traffic can be notoriously difficult to parse, and as the size of the network increases, the sheer volume of data that needs to be evaluated can be simply too much for a human mind to handle. To that end, a wide range of products -- from intrusion detection and intrusion prevention systems to firewalls that respond in real time to denial-of-service attacks -- serve the needs of IT workers responsible for maintaining the security of companies, governments, or other organizations.

However, there has never been a good way for the people who operate these technologies to step back and see the problem from 30,000 feet. That may be changing.

A "galactic" view of Internet traffic
One example of emerging security visualization tools at Black Hat was Lookingglass' ScoutVision, which offers a view of virtually the entire Internet. The Flash-based program's widest-angle view looks like a galaxy, with each of the 65,000 "stars" orbiting a galactic center representing chunks of IP address space called "autonomous systems" -- essentially the IP ranges of entire ISPs, as reported by the ISPs themselves using the BGP protocol.

Given a pair of nodes, the system can show all the possible routing paths for data that moves from one node to another, giving network administrators a quick visual representation of, for example, critical infrastructure choke points, which might need additional protection.

Users of ScoutVision set up watch lists of autonomous systems they want to monitor, and the program can alert them if it detects anomalous traffic, such as the massive amounts of SMTP traffic generated by a spambot. If the system detects an IP range on which there might be botnet machines, it highlights that autonomous system and provides additional data about the alert, including information about the precise IP address that triggered the alert.

Peering inside your binary files
Also at Black Hat, two security experts from West Point -- research programmer Erik Dean and assistant professor Greg Conti -- demonstrated two tools they've created that rapidly render the contents of binary data files into pixels in a resizable field. The tools, called VisBin and DanglyBytes, take the binary data from any file, manipulate the data mathematically, and render that data as a graphical image.

On a small scale, you can look at these kinds of files in a hex editor, Conti says, but "by creating graphical displays, you can show 900 times more information in the same amount of screen space."