A unified approach to network traffic and network security visualisation

Abstract

In this paper we present an architecture which enables data-sharing between computer security and network traffic visualisation tools. At its core is a middleware which manages all interactions. This enables one application to determine the acceptable input for another, and send compatible data. The middleware sits atop a unified database which provides data in a generic form to the applications. Interesting traffic patterns or attack trends seen in one tool can be sent directly to another for further examination and analysis. All communication in the middleware is performed using XML as a data transport mechanism.