The Internet has become a wild place: malicious code is spread on personal computers across the world, deploying botnets ready to attack the network infrastructure. The vast number of security incidents and other anomalies overwhelms attempts at manual analysis, especially when monitoring service provider backbone links. We present an approach to interactive visualization with a case study indicating that interactive visualization can be applied to gain more insight into these large data sets. We superimpose a hierarchy on IP address space, and study the suitability of Treemap variants for each hierarchy level. Because viewing the whole IP hierarchy at once is not practical for most tasks, we evaluate layout stability when eliding large parts of the hierarchy, while maintaining the visibility and ordering of the data of interest.

Two techniques for functional detection of local area incoming war dial are described. One technique employs a dedicated workstation looking for evidence of incoming war dial. We describe our experimental implementation of this technique, including alarm generation to a Cisco NetRanger(R) intrusion detection system. The second technique involves simple parsing of private branch exchange (PBX) call records for characteristic patterns of war dial. Baseline heuristics driving our algorithms are discussed. The non-terminated call detection limitations of this parsing technique for our Lucent Definity G3 PBX are discussed.