NetTimeView: Applying Spatio-temporal Data Visualization Techniques to DDoS Attack Analysis

Distributed Denial-Of-Service (DDoS) is a common network attack where multiple computers attempt to disable a single system with overwhelming network traffic. Various data visualization methods have been developed to help explain, analyze, and deal with DDoS attacks. However, most of the existing visualization methods do not effectively present the temporal aspect of the DDoS attack data. In this paper, we present a novel DDoS visualization technique, NetTimeView, that applies spatio-temporal data visualization to DDoS data. This technique integrates network traffic data and temporal data in a single view. Its multi-layered visualization technique is able to handle very large data sets with efficient use of visualization space. This tool is particularly useful for system administrators and network security analysts to conduct network forensic analysis. We demonstrate our method with a case study of a large DDoS data set.