Analysis and application of node layout algorithms for intrusion detection

The need to monitor today’s networked computer systems for security purposes is a major concern. Our monitoring environment aids system administrators in keeping track of the activities on such systems with much lower time requirements than that of perusing typical log files. With many systems connected to the network the task becomes significantly more difficult. If an attack is identified on one system then all systems have likely been attacked. The ability to correlate activity among multiple machines is critical for complete analysis and monitoring of the environment. Developing an effective organization of the nodes (systems) on the display is a nontrivial task. The organization must clearly show activity on all systems simultaneously while not cluttering the display or unnecessarily distracting the user. This paper discusses the layout techniques we have experimented with and their effectiveness.