Analysis and visualization of large complex attack graphs for networks security

In this paper, we have proposed a comprehensive and innovative approach for analysis and visualization of large complex multi-step cyber attack graphs. As an automated tool for cyber attack detection, prediction, and visualization, the newly proposed method transforms large quantities of network security data into real-time actionable intelligence, which can be used to (1) provide guidance on network hardening to prevent attacks, (2) perform real-time attack event correlation during active attacks, and (3) formulate post-attack responses. We show that it is possible to visualize the complex graphs, including all possible network attack paths while still keeping complexity manageable. The proposed analysis and visualization tool provides an efficient and effective solution for predicting potential attacks upon observed intrusion evidence, as well as interactive multi-resolution views such that an analyst can first obtain high-level overviews quickly, and then drill down to specific details.