Visual Correlation of Network Traffic and Host Processes for Computer Security

Simple item page
dc.contributor.authorFink, Glenn Allenen
dc.contributor.committeechairNorth, Christopher L.en
dc.contributor.committeememberMidkiff, Scott F.en
dc.contributor.committeememberArthur, James D.en
dc.contributor.committeememberTatar, Deborah Gailen
dc.contributor.committeememberMarchany, Randolph C.en
dc.contributor.departmentComputer Scienceen
dc.date.accessioned2014-03-14T20:15:35Zen
dc.date.adate2006-10-05en
dc.date.available2014-03-14T20:15:35Zen
dc.date.issued2006-08-15en
dc.date.rdate2007-10-05en
dc.date.sdate2006-08-23en
dc.description.abstractMuch computer communications activity is invisible to the user, happening without explicit permission. When system administrators investigate network communications activities, they have difficulty tracing them back to the processes that cause them. The strictly layered TCP/IP networking model that underlies all widely used, general-purpose operating systems makes it impossible to trace a packet seen on the network back to the processes that are responsible for generating and receiving it. The TCP/IP model separates the concerns of network routing and process ownership so that the layers cannot share the information needed to correlate packets to processes. But knowing what processes are responsible for communications activities can be a great help in determining whether that activity is benign or malicious. My solution combines a visualization tool, a kernel-level correlation engine, and middleware that ties the two together. My research enables security personnel to visually correlate packets to the processes they belong to helping users determine whether communications are benign or malicious. I present my discoveries about the system administrator community and relate how I created a new correlation technology. I conducted a series of initial interviews with system administrators to clarify the problem, researched available solutions in the literature, identified what was missing, and worked with users to build it. The users were my co-designers as I built a series of prototypes of increasing fidelity and conducted usability evaluations on them. I hope that my work will demonstrate how well the participatory design approach works. My work has implications for the kernel structure of all operating system kernels with a TCP/IP protocol stack and network model. In light of my research, I hope security personnel will more clearly see sets of communicating processes on a network as basic computational units rather than the individual host computers. If kernel designers incorporate my findings into their work, it will enable much better security monitoring than is possible today making the Internet safer for all.en
dc.description.degreePh. D.en
dc.identifier.otheretd-08232006-203521en
dc.identifier.sourceurlhttp://scholar.lib.vt.edu/theses/available/etd-08232006-203521/en
dc.identifier.urihttp://hdl.handle.net/10919/28770en
dc.publisherVirginia Techen
dc.relation.haspartFinal.pdfen
dc.rightsIn Copyrighten
dc.rights.urihttp://rightsstatements.org/vocab/InC/1.0/en
dc.subjectInsight-Based Methoden
dc.subjectComputer Securityen
dc.subjectSoftware Architectureen
dc.subjectSoftware Designen
dc.subjectInformation Visualizationen
dc.subjectHuman-Computer Interactionen
dc.titleVisual Correlation of Network Traffic and Host Processes for Computer Securityen
dc.typeDissertationen
thesis.degree.disciplineComputer Scienceen
thesis.degree.grantorVirginia Polytechnic Institute and State Universityen
thesis.degree.leveldoctoralen
thesis.degree.namePh. D.en

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
Final.pdf
Size:
14.47 MB
Format:
Adobe Portable Document Format
Download

Collections

Doctoral Dissertations