Situ: Identifying and Explaining Suspicious Behavior in Networks.

Area of Science:

• Cybersecurity
• Network Security
• Data Visualization

Background:

• Networked computing assets face constant threats, leading to significant data and financial losses.
• Existing anomaly detection algorithms for cybersecurity are often complex and lack user trust.
• Cyber analysts require tools that augment their expertise and provide contextual understanding of suspicious activities.

Purpose of the Study:

• To introduce Situ, a visual analytics system designed for real-time suspicious behavior discovery in network data.
• To address the need for scalable and trustworthy tools in cybersecurity operations.
• To enhance the decision-making capabilities of network operators and cyber analysts.

Main Methods:

• Developed Situ, a system integrating anomaly detection with information visualization for streaming network data.
• Designed visualizations to highlight anomalous events and IP addresses.
• Focused on providing contextual information to explain the reasons behind detected anomalies.

Main Results:

• Situ enables operators to identify and investigate anomalous network events and IP addresses.
• The system provides context, aiding analysts in understanding the nature of suspicious activities.
• The platform has been deployed in an operational network setting within a large organization.

Conclusions:

• Situ offers a scalable solution for detecting suspicious behavior in network traffic.
• The visual analytics approach enhances trust and understanding for cybersecurity professionals.
• The system effectively integrates into existing security operations center workflows.