Monitoring a computer network's security state is a dicult task as network components rarely share their information. The IF-MAP specication denes a client/server-based protocol that enables network components to share security information among each other, which is represented in a graph structure. Visualization of this data is challenging due to the highly dynamic topology and the mapping of logical nodes onto physical devices. Furthermore, data in a MAP server is volatile and there is no standardized way to preserve and review changes or previous states of a MAP graph. The evolution of such a graph, however, embodies valuable information for the analysis of past incidents and attacks on the network infrastructure. In this paper we introduce a software framework to visualize MAP data and propose a solution for the ecient long-term storage and replication of MAP graphs. We demonstrate how changes in the graph structure between given points in time can be computed and visualized.
Within enterprise networks, many components like Intrusion Detection Systems
(IDSs) or Flow Controllers monitor dierent aspects of the trac or the behavior
of the participants and are responsible for enforcing security-related decisions.
In most cases, however, these components work independently, not sharing
information with each other. For most of these separate components, dierent
visualization approaches have been proposed, many of which employ graph drawing
methods [
An aspect to consider in the visualization is that most computer networks are
not static, e.g., with users logging in and out or devices being connected to and
disconnected from the network. In recent years, the analysis and visualization of
dynamic networks has attracted much interest, e.g., [
The Interface for Metadata Access Points (IF-MAP) protocol allows to collect information from dierent services, infrastructure components and endpoints on a central Metadata Access Point (MAP) server in a time-variant graph data structure. IF-MAP therefore has the potential to provide a foundation for an integrated and comprehensive view on a network’s overall state and security for both automated and human monitoring. As of now, data on the MAP server is volatile, i.e., only the present state of the graph is made available via IF-MAP.
The evolution of such a graph, however, clearly embodies valuable information, e.g., for data mining purposes since changes in the graph directly relate to changes in the network and the state of its security. In fact, changes in the graph themselves might be security-related incidents. An intuitive graphical representation of the changes of the MAP graph would greatly support a security ocer in (a) assessing how the overall security of the network has developed over time or due to changes to the network infrastructure or services, (b) analyzing past incidents and therefore greatly improving the process of human network security monitoring.
In this paper, we introduce a system for the visualization of network security metadata driven by the following requirements:
Data dynamics: Due to frequent changes within a computer network, a continuous recalculation of the graph layout is necessary with the constraint that dramatic changes in the general visual representation should be avoided. Changes should furthermore be easily recognizable by the user.
Data semantics: As the data itself can have dierent semantics, this information can be used to improve the layout. Sub-graphs that feature a strong hierarchical structure should use dierent layout algorithms than sub-graphs with a seemingly random structure. Semantically cohesive sub-graphs should also be detected and displayed in generalized form to reduce the amount of graph elements to be presented to the user, as in a level of detail mechanism.
Data history: Both the present state as well as past states of the MAP server’s data must be accessible through the Graphical User Interface (GUI). The user should also be able to obtain a graphical representation of the changes that occurred between two supplied points in time. Since data within a MAP server (MAPS) only represents the current state of the network, a proper storage mechanism has to be established.
The main focus of this paper thus is on the data history aspect. We propose a timestamp-based and storage-ecient model to persist MAP graphs and suggest algorithms to restore past graphs’ states and calculate cumulative changes between two points in time. To do so, we use a combination of currently popular edge-centric and vertex-centric models. We show how the graph changes are visualized and how the user can interact with the graph history database.
The remainder of this paper is organized as follows: After reviewing related work in section 2, the technical background of these topics is outlined in section 3. Our concept for an ecient long-term storage of graph data and the corresponding algorithms are described in section 4. Visualization and GUI aspects of handling time-variant MAP graphs are discussed in section 5. Section 6 concludes this work with a summary of the ndings and an outlook on future lines of research. 2
IF-MAP, specically applied to the security domain, has been a topic of recent
and ongoing research. The secure integration of smartphones into corporate
networks has been addressed by our approach called TCADS, which uses IF-MAP as
the base protocol to share security-related information between various network
entities [
For the visualization of integrated network security data, a commercial solution called IPSonar exists. It supports IF-MAP by being able to publish certain pieces of information to a MAP server 1. IPSonar, however, does not rely on an openly specied protocol such as IF-MAP for data acquisition. Furthermore, IPSonar does not oer the visualization of graph changes.
To the best of our knowledge there is no solution providing the visualization of MAP data, especially regarding dynamic changes and historical development of data. A rst eort to visualize the current state of a MAP graph has been made with the irongui 2 project, which can be understood as an initial exploration of the problem domain for our current work.
The analysis of time-variant systems is part of a vast amount of dierent areas of science. Dierent solutions have been proposed to address the complex task of modeling these time-variant systems as graph data structures.
Casteigts et al. introduced the concept of time-varying graphs [
Ren et al. [
Holme and Saramki [
Dutot et al. [
With respect to our problem domain, the three dierent views proposed in
[
IF-MAP The term IF-MAP refers to a set of specications published by the Trusted Computing Group (TCG) as part of the Trusted Network Connect (TNC) framework. IF-MAP denes an XML-based network protocol for exchanging so-called metadata among an arbitrary number of MAP clients via a central MAP server. The main motivating use case for IF-MAP is the distribution of security information within a network in a standardized and interoperable way. Since the specications include a exible extension mechanism, IF-MAP can be customized to virtually any use case even beyond the classical network security domain.
The main specication document denes the core data model, the basic
operations MAP clients and MAP servers must support and their encapsulation
within SOAP [
There are dierent types of identiers and metadata such as identity or location, each with potentially dierent attributes, e.g., name or value. Metadata types also have a certain cardinality expressing whether exactly one metadatum (singleValue) or an arbitrary number of metadata ( multiValue) of the given type can be attached to a single identier or link. An example graph using some of the standard identiers and metadata is depicted in Fig. 1.
capability name = access-intranet-allowed access-request name = 11:333
role name = admin
location location-information (GPS) value = -37.815789, 144.96491
identity type = username name = Jane Doe Communication Model The communication model of IF-MAP is a contentbased publish-subscribe model. Both publisher and subscriber are MAP clients connected to a single MAP server. A publisher can insert new and update existing information (publish update ) or delete data from the graph ( publish delete ). Subscriptions are handled asynchronously. The subscriber is notied whenever changes to the subscribed information occur. Metadata can also be propagated using the notify mechanism. Notify data is only sent to current subscribers and never added to the graph structure in the MAP server itself.
Furthermore, IF-MAP species a search functionality, that allows the MAP client to query and search for information with an immediate result. Searches follow the same pattern as subscriptions. They can range from simple queries for a specic metadatum, towards more complex patterns within the graph, e.g., only following specic links. 4
Concept for Change Tracking of IF-MAP Graphs The following section describes our concept for change tracking of MAP graphs. This includes the extensions needed to store changes as well as the algorithm for restoring past graphs’ states and the calculation of changes between two points in time.
Change Tracking Extension In the IF-MAP data model, only metadata is
volatile, i.e., has a certain lifetime of its own. Identiers are never created nor
deleted, but (at least conceptually) always exist as globally unique entities. Links
exist as relationships between two identiers indicated by metadata [
Metadata instances are provided with two pieces of additional administrative information in order to examine their validity for a given point in time: (1) the IF-MAP publish timestamp to mark the start of their validity (2) a delete timestamp that marks the end of the metadata’s validity.
A metadatum m is considered valid for time t if tpublish(m) <= t < tdelete(m). The validity of links and identiers is derived from the validity of metadata as follows: A link l with an arbitrary set of metadata Ml connected to it, is considered valid at time t if 9m : m 2 Ml ^ isV alid(m; t). An identier i with an arbitrary set of metadata Mi and an arbitrary set of links Li connected to it, is valid at time t if (9m : m 2 Mi^isV alid(m; t))_(9l : l 2 Li^isV alid(l; t)). Using this understanding of validity, algorithm 1 can be used to restore a graph’s past state using the corresponding timestamp and a (random) identier as a starting point.
Algorithm: BuildGraph(Identier currentId, List<Identier> seenIds, timestamp t) if !seenIds.contains(currentId) and isIdentierValid(currentId, t) then result.add(currentId); /* Add identifier and connected metadata */ seenIds.add(currentId); for Identier nextId in all linked identiers of currentId do if seenIds.contains(nextId) and isLinkValid(currentId, nextId, t) then result.addLink(currentId, nextId); /* Add Link and connected
Metadata */ else end end end
BuildGraph(nextId, seenIds, t);
Algorithm 1: Graph construction for valid identiers at time t. Calculation of Graph Deltas The query for a graph delta takes two input parameters: ts is the rst point in time the starting point of the query and te is the second point in time the ending point of the query. The query returns a graph tuple (U[s;e]; D[s;e]) where the graph U[s;e] contains all identiers and links which happen to have new or updated metadata attached to them. In this context new or updated means that the metadata attached to an identier or link was not present (or had dierent attributes) at ts but is valid at te. If some metadatum was valid at ts but is no longer valid at te, the identier or link attached to this metadatum will be included in the D[s;e] graph.
To calculate U[s;e] we take the current graph Ge which represents the state of the graph at time te and the graph Gs which is the graph state at time ts. We now check for each metadatum in Ge whether it is present in Gs, if we nd such metadata we remove it from Ge. If this leaves an identier or link without any metadata attached to it, we remove the identier or link as well. We are left with the graph U[s;e] that only contains identiers or links that have not been present at the start time of the query, but were present at the end time of the query. In order to calculate the graph D[s;e], we apply the same operation, but swap Gs and Ge: for each metadatum in Gs we check whether it is also present in Ge. If we nd such a metadatum, we remove it from Gs. Identiers and links without any metadata are dropped as described above.
device name = x240
device name = x240 mac-address value = aa:bb:cc:dd:ee:ff
mac-address value = aa:bb:cc:dd:ee:ff
mac-address value = aa:bb:cc:dd:ee:ff
device-ip publish timestamp = 1 delete timestamp = -1
device-ip publish timestamp = 1 delete timestamp = -1
ip-mac publish timestamp = 2 delete timestamp = -1
ip-mac publish timestamp = 2 delete timestamp = -1 ip-mac publish timestamp = 2 delete timestamp = -1 device name = x240
ip-address type = ipv4 value = 192.168.1.1
ip-address type = ipv4 value = 192.168.1.1
ip-address type = ipv4 value = 192.168.1.1
device-ip publish timestamp = 1 delete timestamp = 3
An example for the calculation of deltas is depicted in Fig. 2. At t = 1 a device-ip metadatum is published, the negative delete timestamp indicates that this metadatum is still valid. At t = 2 an ip-mac metadatum is published to the already known ip-address and at t = 3 the device-ip that had been published at t = 1 is deleted. The query for the delta from ts = 1 to te = 3 yields the tuple depicted at the bottom of Fig 2. U[e;s] is shown on the left, D[e;s] shown on the right hand side.
As gure 2 shows, this algorithm may yield a U[s;e] or D[s;e] that contains edges without identiers or half edges with only one identier present. In the implementation, one might choose to either use the algorithm as is and assign unique identities to links or to always return an identier-link-identier triple to identify links unambiguously, even if one or both of the identiers have not changed. 5
Visualization Concept and System Architecture In this section we show the concept and architecture of the VisITMeta software system that combines persistence of IF-MAP data and its visualization. The retrieval of and navigation within time variant data are also described. Software architecture and data retrieval The system architecture of VisITMeta consists of two strongly separated applications. All application layers are designed as independent from each other as possible, so that libraries and algorithms can easily be exchanged.
The dataservice collects metadata from a MAP server (MAPS) as a regular MAP client (MAPC), stores it inside a Neo4j 3 graph database and also provides access to the stored metadata via a REST-like interface.
The visualization application fetches metadata from the dataservice via the REST interface and converts the data into graph elements. Layouts are generated with the JUNG24 library and the results are rendered with Piccolo2D 5. A Java Swing GUI allows for navigating through the graph history and editing the underlying connections to one or multiple dataservices.
To retrieve data from the dataservice, the visualization application and any other possible application can use methods of the REST-like interface to request (a) a map of all timestamps at which changes occurred in the graph, (b) a delta by specifying a start and an end time, (c) the graph at a given timestamp which contains all valid identiers, links, and metadata, or (d) the graph at the latest timestamp, i.e., the current state of the graph. Graph and delta visualization Figure 3 shows a small example of a layouted MAP graph within VisITMeta’s GUI application. Identiers and metadata are both visualized as nodes, whereas links are only shown implicitly: a link exists between two identiers which are connected by one or more metadata, such as enforcement-report or device-attribute plus access-request-device .
The user controls the time-variant view on the MAP graph by using a slider mechanism with two knobs that can be moved independently. This allows to select (a) a single point in time to get the graph associated to that timestamp by only moving the right knob or (b) a time interval for viewing a graph delta by moving both knobs. Alternatively, the current state of the graph can be displayed (live view).
After selecting a time interval via the slider, the resulting delta is visualized as a graph that contains all updates and deletes. All updated and deleted metadata are highlighted in the corresponding user-dened colors. By selecting two succeeding timestamps, changes in the MAP data can directly be observed.
In this paper we have introduced a system for the visualization of highly dynamic network security metadata represented in a graph structure. An early prototype of this work is available via Github. 6 Our system is able to display both the current state and past states of the metadata graph as well as deltas between two given points in time. We have proposed a timestamp-based model to persist timevariant MAP graphs and developed algorithms to restore past graphs’ states and calculate deltas. In contrast to other approaches related to time-variant graphs, our work primarily targets long-term storage and reproduction of graphs using a combination of edge-centric and vertex-centric methods with minimal storage overhead.
At the time of this writing our work is subject to the following limitations: (a) only metadata made available via IF-MAP publish update operations is made persistent within the database, data published via notify is discarded, (b) reconstruction of a graph’s past state is only guaranteed to be idempotent, if the subscription used to receive data from the MAP server retrieves all data from the map server, i.e., each identier and each metadatum in the MAP server can be reached using the subscription traversal at all times.
Visualization of dynamic, time-variant and potentially very large graphs still needs research, even more so in the area of IF-MAP where both edges and vertices can be tightly packed with information. Future work will have strong focus on new concepts for IF-MAP graph visualization. The next tasks will be to develop and implement multi-layout algorithms and nd ways to detect and display semantically cohesive sub-graphs.
Apart from visualization, historic IF-MAP data is also useful for mining patterns that capture the network’s behavior. These patterns could be used to detect outliers that might indicate incidents. We plan to build a data model that captures the graph history for this use case. We assume that this model will be dierent from the presented model as it targets dierent types of access.
The fruitful collaboration with J. von Helden, T. Ehlers, J. Fuchs, B. Merieau, S. Misztal, and F. Sprengel is gratefully acknowledged. This work is nancially supported by the German Federal Ministry of Education and Research (BMBF), projects VisITMeta (grant no. 17PNT032) and SIMU (grant no. 16KIS0045).