Understanding Intrusion Detection through Visualization (Advances in Information Security) [Hardcover]

Stefan Axelsson (Author), David Sands (Author)

Book Description

ISBN-10: 0387276343 | ISBN-13: 978-0387276342 | Publication Date: November 21, 2005 | Edition: 1

Computer security - the protection of data and computer systems from intentional, malicious intervention - is attracting increasing attention. Much work has gone into development of tools to detect ongoing or already perpetrated attacks, but a key shortfall in current intrusion detection systems is the high number of false alarms they produce. This book analyzes the false alarm problem, then applies results from the field of information visualization to the problem of intrusion detection. Four different visualization approaches are presented, mainly applied to data from web server access logs.

Editorial Reviews

From the Back Cover

With the ever increasing use of computers for critical systems, computer security that protects data and computer systems from intentional, malicious intervention, continues to attract significant attention. Among the methods for defense, the application of a tool to help the operator identify ongoing or already perpetrated attacks (intrusion detection), has been the subject of considerable research in the past ten years. A key problem with current intrusion detection systems is the high number of false alarms they produce. Understanding Intrusion Detection through Visualization presents research on why false alarms are, and will remain a problem; then applies results from the field of information visualization to the problem of intrusion detection. This approach promises to enable the operator to identify false (and true) alarms, while aiding the operator to identify other operational characteristics of intrusion detection systems. This volume presents four different visualization approaches, mainly applied to data from web server access logs. Understanding Intrusion Detection through Visualization is structured for security professionals, researchers and practitioners. This book is also suitable for graduate students in computer science.

Product Details

• Hardcover: 165 pages
• Publisher: Springer; 1 edition (November 21, 2005)
• Language: English
• ISBN-10: 0387276343
• ISBN-13: 978-0387276342
• Product Dimensions: 9.6 x 6.4 x 0.6 inches
• Shipping Weight: 14.4 ounces (View shipping rates and policies)
• Average Customer Review: 1.0 out of 5 stars  See all reviews (1 customer review)
• Amazon Best Sellers Rank: #4,367,189 in Books (See Top 100 in Books)

More About the Author

Discover books, learn about writers, read author blogs, and more.

Customer Reviews

Most Helpful Customer Reviews

4 of 4 people found the following review helpful:

1.0 out of 5 stars Interesting Read, January 2, 2007

By 

Raffael Marty (San Francisco, CA USA) - See all my reviews
(REAL NAME)   

This review is from: Understanding Intrusion Detection through Visualization (Advances in Information Security) (Hardcover)

In the beginning I was a bit mislead by the title of this book, but I guess that was my mistake: The book is not about visualizing intrusion detection system logs, but it is about how to do intrusion detection on mainly Web server logs. The book is based on some older papers of the author. However, he added some new content and revised some of the papers contents.
For the most part, the book talks about how to visualize the output of various data processing algorithms. Bayesian analysis is used to analyze Web server logs and the author shows how the output can be visualized. It is not necessary visualization that is used to do intrusion detection, but the book shows a way to visualize the output of data analysis algorithms.
Overall I am a bit disappointed with the book. It is a collection of Axelsson's older papers. The book would benefit from integrating the chapters more tightely. Common terminology and concepts could be introduced once instead of multiple times in each of the chapters.
Reading the first chapters took quite some concentration. The definition of intrusion detection and intrusion detection systems in the beginning of the book are fairly complicated and it is not entirely clear why the complicated definitions are necessary for rest of the book. Also, for a visualization book, the graphs are of fairly poor quality.