title: ENTVis: A Visual Analytic Tool for Entropy-Based Network Traffic Anomaly Detection.
abstract: Entropy-based traffic metrics have received substantial attention in network traffic anomaly detection because entropy can provide fine-grained metrics of traffic distribution characteristics. However, some practical issues--such as ambiguity, lack of detailed distribution information, and a large number of false positives--affect the application of entropy-based traffic anomaly detection. In this work, we introduce a visual analytic tool called ENTVis to help users understand entropy-based traffic metrics and achieve accurate traffic anomaly detection. ENTVis provides three coordinated views and rich interactions to support a coherent visual analysis on multiple perspectives: the timeline group view for perceiving situations and finding hints of anomalies, the Radviz view for clustering similar anomalies in a period, and the matrix view for understanding traffic distributions and diagnosing anomalies in detail. Several case studies have been performed to verify the usability and effectiveness of our method. A further evaluation was conducted via expert review.
authors.forename: Fangfang
authors.initials: F
authors.lastname: Zhou
authors.forename: Wei
authors.initials: W
authors.lastname: Huang
authors.forename: Ying
authors.initials: Y
authors.lastname: Zhao
authors.forename: Yang
authors.initials: Y
authors.lastname: Shi
authors.forename: Xing
authors.initials: X
authors.lastname: Liang
authors.forename: Xiaoping
authors.initials: X
authors.lastname: Fan