CyberVTI: Cyber Visualization Tool for Intrusion Detection

This paper presents the Cyber Visualization Tool for Intrusion detection (CYBERVTI), a tool that provides intrusion detection algorithms with an effective graphical interface. The goals of the tool are twofold. First, it aims to aid the human analyst on observing ongoing threats as a step towards responding to these attacks. Second, it aims to help the analyst study the performance of the algorithms with different parameters, in order to decide which combination best suits his goals. The tool integrates a set of recently-proposed intrusion detection algorithms based on unsupervised machine learning, which it aims to help configuring. Cybervti follows a client-server system architecture and implements a REST API that mediates the communication between the server and the GUI on the client-side. A significant challenge is to define data structures that allow storing and accessing data efficiently in an interactive manner. A clear and minimalist visual aspect was chosen for the GUI, containing functionalities that enable the user to analyze the network data in a simple and clear way. For system evaluation, we used the ISOIIEC 25010:2011 requirements. For validation, we compared the results obtained by our tool with the results described in the original papers that present the algorithms.