IDGraphs: Intrusion detection and analysis using histographs

Pin Ren*, Yan Gao, Zhichun Li, Yan Chen, Benjamin Watson

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contribution

32 Scopus citations


Traffic anomalies and attacks are commonplace in today's networks and identifying them rapidly and accurately is critical for large network operators. For a statistical intrusion detection system (IDS), it is crucial to detect at the flow-level for accurate detection and mitigation. However, existing IDS systems offer only limited support for 1) interactively examining detected intrusions and anomalies, 2) analyzing worm propagation patterns, 3) and discovering correlated attacks. These problems are becoming even more acute as the traffic on today's high-speed routers continues to grow. IDGraphs is an interactive visualization system for intrusion detection that addresses these challenges. The central visualization in the system is a flow-level trace plotted with time on the horizontal axis and aggregated number of unsuccessful connections on the vertical axis. We then summarize a stack of tens or hundreds of thousands of these traces using the Histographs[23] technique, which maps data frequency at each pixel to brightness. Users may then interactively query the summary view, performing analysis by highlighting subsets of the traces. For example, brushing a linked correlation matrix view highlights traces with similar patterns, revealing distributed attacks that are difficult to detect using standard statistical analysis. We apply IDGraphs system to a real network router data-set with 179M flow-level records representing a total traffic of 1.16TB. The system successfully detects and analyzes a variety of attacks and anomalies, including port scanning, worm outbreaks, stealthy TCP SYN floodings, and some distributed attacks.

Original languageEnglish (US)
Title of host publicationIEEE Workshop on Visualization for Computer Security 2005, VizSEC 05, Proceedings
Number of pages8
StatePublished - 2005
EventIEEE Workshop on Visualization for Computer Security 2005, VizSEC 05 - Minneapolis, MN, United States
Duration: Oct 26 2005Oct 26 2005

Publication series

NameIEEE Workshop on Visualization for Computer Security 2005, VizSEC 05, Proceedings


OtherIEEE Workshop on Visualization for Computer Security 2005, VizSEC 05
Country/TerritoryUnited States
CityMinneapolis, MN


  • Brushing and Linking
  • Correlation Matrix
  • Dynamic Query
  • Interactive System
  • Intrusion Detection
  • Visualization

ASJC Scopus subject areas

  • Engineering(all)


Dive into the research topics of 'IDGraphs: Intrusion detection and analysis using histographs'. Together they form a unique fingerprint.

Cite this