A Survay on Alert Visualization Tools in Intrusion Detection Systems

System attacks are growing in Networks. Intrusion detection systems are used to generate security warnings and network traffic analysis. The amounts of log message texts are high and the required time for analysis of them may have negative affect on system. Log messages are text-form and to understand them, managers should read each one separately. Because of this, detecting abnormal behaviour in files is difficult. For this reason it is better to combine log file with visualization techniques. This paper will explain more about alert visualization tools. They have different bandwidth and memory Depending on the type of system tools and applications. However, each has their advantages and disadvantages. Additionally log file problems and different types of intrusion detection system output will be presented. Also various visualization systems are introduced and the requirements for using these tools reviewed. These tools were compared based on the extracted parameters for the evaluation of these systems. And at the end, a novel solution is proposed to facilitate choosing perfect visualization alert system for companies and enterprises.

کلیدواژه ها:

Alert ، Visualization ، Log file ، Mapping ، Merits ، evaluation