Smarter Enterprise Network Security Management Through Intelligent and Interactive Visual Analytics

Doctoral Dissertation


With the prevalence of multi-user environments and distributed applications, the traditional identity of hosts (e.g., IP addresses and port numbers) becomes less precise in describing what is going on in the networks. Instead, users, applications and data have received increasing attention from the perspective of enterprise network security and management. Precisely identifying who is doing what on an enterprise network has become an extremely challenging task. This dissertation presents a visualization tool called ENAVis (Enterprise Network Activities Visualization). Through collection of the context in terms of the actual users and applications associated with network connections and smarter visual analytics, ENAVis aids a real-world administrator in allowing them to more efficiently manage and gain insight about the connectivity between hosts, users, applications and data access, offering significant streamlining of the management process.

Challenges posed by the above context-based analysis include increased information dimensions, lack of clean training data, and highly dynamic nature of host-user-application (HUA). Besides the ability to visualize various combinations of HUA, the contribution of this study lies on its exploration and evaluation of the viability and efficacy of a unified approach by incorporating algorithmic data mining methods with interactive visual exploration process. The proposed data analysis algorithms can provide intelligence to start and guide an investigation process while the proposed visual transformations brings in experts’ domain knowledge to the security and management problems that are infeasible by existing machine learning approaches.

In particular, a hierarchical similarity and differential visualization framework is developed, which starts with the evolution of inter-graph states, adapts to the dynamics of individual nodes and edges of HUA context graphs, and concludes with the analysis of community evolutions. Through novel graph construction and transformation as well as modeling, quantification and visual investigation of the key similarities or differences among the important components of HUA graphs, spatio-temporal anomalies of user and application behaviors that are usually unknown or hard to define in advance can now be effectively detected. More importantly, the underlying causes for these abnormal activities can be found and analyzed in a time-efficient manner through intelligent and interactive visualization. Through examples and case studies, we demonstrate how similarity and dynamics can be effectively visualized and understood to provide insight with regards to network security and management.


Attribute NameValues
  • etd-05232011-160245

Author Qi Liao
Advisor Dr. Mike Villano
Contributor Dr. Aaron Striegel, Committee Co-Chair
Contributor Dr. Nitesh Chawla, Committee Member
Contributor Dr. Marina Blanton, Committee Member
Contributor Dr. Mike Villano, Committee Chair
Contributor Dr. Douglas Thain, Committee Member
Degree Level Doctoral Dissertation
Degree Discipline Computer Science and Engineering
Degree Name PhD
Defense Date
  • 2011-05-17

Submission Date 2011-05-23
  • United States of America

  • anomaly detection and analysis

  • network management

  • graph similarity

  • computer and network security

  • graph data mining

  • visualization

  • University of Notre Dame

  • English

Record Visibility and Access Public
Content License
  • All rights reserved

Departments and Units


Please Note: You may encounter a delay before a download begins. Large or infrequently accessed files can take several minutes to retrieve from our archival storage system.