Geovisual analytics for cyber security: Adopting the GeoViz Toolkit

For the VAST 2011 Network Security Mini-Challenge, we adopted geovisual analytic methods and applied them in the field of network security. We used the GeoViz Toolkit [1] to represent cyber security events, by fabricating a simple “geography” of several sets of blocks (one for the workstations, one for the servers, and one for the Internet) using ArcGIS 10 (by ESRI - Environmental System Research Institute). Security data was tabulated using Perl scripts to parse the logs in order to create representations of event frequency and where they occurred on the network. The tabulated security data was then added as attributes of the geography. Exploration of the data and subsequent analysis of the meaning and impact of the cyber security events was made possible using the GeoViz Toolkit.