ИСТИНА

This paper deals with the visualization of complex attacks. “Complex attacks” is used here to denote the type of attack which consists of a sequence of related events, namely a multi- step, DDoS attack and alike. While there are numerous systems to visualize events that occur in the network, most of them are too complex to perceive, and require several visualization modes. This work presents a technique whereby the operator, using visualization alone, is able to display the full picture of events occurring in the network. The main feature of this method is the high recognition ratio of complex attacks as the sequence of constituent common events.