Static in the Ether

The Proceedings of the 2007 Workshop on Visualization for Computer Security (VizSec 2007) are finally available. Springer Has the book available for order at a princely 60 Euros. Amazon has the book listed but not yet available for shipping , but one can pre-order. For those interested, Springer has a flyer and table of contents available. PDF versions of the presentations given are available form the VizSec 2007 website.

My copy should hopefully be arriving in the next few weeks, but I’m looking forward to the Work done by John R Goodall, Gregory Conti and Kwan-Liu Ma as editors. I’m just sorry I’m not going to make VizSec 2008 this year.

The two papers that I presented are (links to the PDF slides):

• High level Internet Scale traffic visualization using Hilbert curve mapping - Barry Irwin and Nick Pilkington. This details the initial work we did using the Hilbert Curve Analysis tool for IP networks
• Using InetVis to evaluate Snort and Bro scan detection on a network telescope - Barry Irwin and Jean-Pierre van Riel. InetVis is the result of three years of JP’s work to build a scalable 3-D vizualisation tool for network traffic — primarily that collected by network telescopes.

With Nick now in Grahamstown, development on the Hilbert Curve application has progressed well. Version 4.05 has been released around a month after the 2.05 edition previously mentioned, which is heading much closer towards completion. The unix build scripts still need to be integrated, but there has been much improvement. The most noticeable improvements are in the processing speed new around 90 seconds for a datafile of 53 million Addresses, and its ability to put out some very high res images (4096×4096) when working with higher order curves. At this resolution we are able to present a single pixel as representing a class C network or in effect 256 individual IP addresses. The updated release also allows for the application of image overlays when in interactive mode, which can make navigation significantly easier.

A sample of the kind of output is seen below (full resolution image is 990K) which shows destination IP addresses harvested from the Albany Schools Cache server during January through May 2008:


A plot of 53 million packets from the CAIDA telescope project - 27 Feb 2007 midnight to 6am:





With these higher resolution images available, analysis can be performed at a much finer grained level.

The Hilbert Curve Rework project is progressing well with version 2.05 having been released, by Nick earlier this week. Ive now taken the opportunity to port the current Windows code across to unix and particularly FreeBSD. Around 10 lines worth of changes later the app built and ran on my FreeBSD 7.0 system. For once the mantra of the C/C++ work actually proved try - write once, run anywhere. I really wish Java was that simple.

A couple of issues still need to be addressed:

• Rework the source to we can maintain a single source three for Windows and Unix targets- this is mostly slog rather than thinking work.
• There is a bug in that some images are coming out a little wrong, but I think this may have to do with line termination issues the good old \r\n vs. \n issue again.
• Write some decent docs!

With a bit of luck Nick should be returning to Grahamstown for a month or so thanks to some funding from the Center of Excellence in the department. Working on the Hilbert project will be one of his main priorities.

Taking some data gathered form various filters I’m investigating for the local schools network,a nd combining with some custom scraping tools which Blake has been assisting with Ive drawn a map of the location of some 15 000 IP addresses representing the seedy side of the Internet.

The image is rendered using the Hilbert Curve Program developed in conjunction with Nick Pilkington, as a project for VizSec 2007 last year.