WIXLIB

ARL-TN-0765 JULY 2016US Army Research LaboratoryNetwork Visualization Project (NVP)by Terry Wen, Lisa M Marvel, and C Sean MorrisonApproved for public release; distribution is unlimited.

NOTICESDisclaimersThe findings in this report are not to be construed as an official Department of theArmy position unless so designated by other authorized documents.Citation of manufacturer’s or trade names does not constitute an officialendorsement or approval of the use thereof.Destroy this report when it is no longer needed. Do not return it to the originator.

ARL-TN-0765 JULY 2016US Army Research LaboratoryNetwork Visualization Project (NVP)by Terry WenAmerican Society of Engineering Education, Washington, DCLisa M MarvelComputational and Information Sciences Directorate, ARLC Sean MorrisonQuantum Research International, Inc., Bel Air, MDApproved for public release; distribution is unlimited.FOR OFFICIAL USE ONLY (delete if not FOUO)

Form ApprovedOMB No. 0704-0188REPORT DOCUMENTATION PAGEPublic reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining thedata needed, and completing and reviewing the collection information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing theburden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302.Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently validOMB control number.PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS.1. REPORT DATE (DD-MM-YYYY)2. REPORT TYPE3. DATES COVERED (From - To)July 2016Technical Note1 May–31 August 20154. TITLE AND SUBTITLE5a. CONTRACT NUMBERNetwork Visualization Project (NVP)5b. GRANT NUMBER5c. PROGRAM ELEMENT NUMBER6. AUTHOR(S)5d. PROJECT NUMBERTerry Wen, Lisa M Marvel, and C Sean Morrison5e. TASK NUMBER5f. WORK UNIT NUMBER7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES)8. PERFORMING ORGANIZATION REPORT NUMBERUS Army Research LaboratoryATTN: RDRL-CIN-DAberdeen Proving Ground, MD 21005-5067ARL-TN-07659. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES)10. SPONSOR/MONITOR'S ACRONYM(S)11. SPONSOR/MONITOR'S REPORT NUMBER(S)12. DISTRIBUTION/AVAILABILITY STATEMENTApproved for public release; distribution is unlimited.13. SUPPLEMENTARY NOTES14. ABSTRACTThe purpose of the Network Visualization Project is to construct an interactive application for real-time playback of networkactivity based upon packet capture data. As data networks continue to expand as an integral part of modern informationsystems, the importance of the organization and clarity of said networks grows as well. The goal of this project differs fromthose of similar existing tools in its attempt to optimize both content and clarity, as the product is meant to maintain aestheticappeal without sacrificing any details of the data meant to be portrayed. The project uses Dshell for back-end data retrievaland Processing for front-end presentation and construction of the application itself.15. SUBJECT TERMScomputer network traffic, computer network security, computer network visualization, network traffic analysis, networkforensics16. SECURITY CLASSIFICATION OF:a. REPORTUnclassifiedb. ABSTRACTUnclassified17. LIMITATIONOF ABSTRACT18. NUMBEROF PAGESUU18c. THIS PAGEUnclassified19a. NAME OF RESPONSIBLE PERSONLisa Marvel19b. TELEPHONE NUMBER (Include area code)410-278-6508Standard Form 298 (Rev. 8/98)Prescribed by ANSI Std. Z39.18ii

ContentsList of Figuresiv1.Introduction and Background12.Application Design12.1 Dshell: Back-End Data Handling22.2 Processing: Front-End Data Presentation32.3 Running a Network Visualization63.Conclusion and Future Work84.References9List of Symbols, Abbreviations, and Acronyms10Distribution List11Approved for public release; distribution is unlimited.iii

List of FiguresFig. 1Application data flow .2Fig. 2Sample JSON data .3Fig. 3Original visualization model .4Fig. 4New flow-based model .4Fig. 5Snip of connection time line .5Fig. 6Connection and packet information .5Fig. 7Application screenshot .7Approved for public release; distribution is unlimited.iv

1.Introduction and BackgroundAs part of the ever-expanding age of information, data networking continuouslygrows in importance. With the quantity of data transferred across networksincreasing daily, the monitoring of such networks becomes increasingly difficult.The Network Visualization Project (NVP) tackles issues regarding the display,monitoring, and inspection of network traffic and allows such data to be presentedin an easily explored and understandable fashion.NVP is useful for troubleshooting, application development, protocol analysis, anda myriad of other network analysis purposes. With other commonly availablenetwork visualization tools, such as WireShark,1 users lack direct control of andinteraction with the network data. They are simply presented with an itemizeddisplay of packet capture information. Other visualizers, such as Commetrix, tendto prioritize aesthetics with visually interesting illustrations that make it difficult orimpossible to access technical detail. Tools that lack interactivity or limit access totechnical detail are generally unusable for in-depth network analysis work. NVPaims to address these issues with the construction of an interface that moreoptimally balances content, interactivity, and clarity.Because of the need for attention to detail, NVP is intended to monitor small-scalenetworks, watch for specific issues, and trace events in traffic. A primary goal ofthe project is to create an interface that can help locate potential issues, identifyweaknesses in a network, and provide an understandable illustration of networkcommunication that is adequate for a generally untrained eye. In accomplishingthis, the project will provide a new tool interface supporting improved networkanalysis and network communication visualization.2.Application DesignNVP consists of 2 parts: back-end data handling and front-end presentation. Dataare first processed through Dshell, an open source packet-decoding tool developedby the US Army Research Laboratory.2 These data, either streamed or input througha packet capture file (commonly called a “pcap” file), are output in JavaScriptobject notation (JSON) format. This JSON is provided as input to the front-endapplication of the project. This interaction of the user with the back-end interfaceallows for full manipulation of the data and the ability to directly filter data to theuser’s needs.Approved for public release; distribution is unlimited.1

The data are then processed by the front-end application, which is coded using theProcessing programming language.3 Here, the user is able to visually interact witha time line that encloses the duration of imported packet data. This playbackpresents the data visually through nodes and connections that can be interactivelymanipulated fully by the user or automatically arranged by the application. Theprimary attributes of the data shown are as follows: Source and Destination IP addresses Ports Protocols Time Packet length Other details in packet header (transmission control protocol (TCP) flags,etc.)The visualization is meant to illustrate macro activity through a network as well asthe individual details of individual packets. The interface will also include otherutilities, such as playback tools and data filters.The NVP process is shown in Fig. 1. Where network data is collected in a .pcapfile. It is then transformed using Dshell into a JASON format. This is the input intothe NVP processing module to construct the visualization.Fig. 1Application data flow2.1 Dshell: Back-End Data HandlingDshell, or Decoder shell, is a command-line framework used for network forensicanalysis. Dshell processes existing pcap files and filters output information basedon both prebuilt and user-constructed modules. The Dshell portion of NVP involvesthe construction of an output module that will parse the necessary data from a pcapfile into a JSON format file. Dshell allows the user to directly choose the modulesto use for full control of the data portrayed in the visualization. Dshell provides avariety of tools and filters necessary to extract the desired information from pcapdata and is flexible enough to adapt to a variety of network analysis goals. A sampleof the JSON data file is shown in Fig. 2.Approved for public release; distribution is unlimited.2

Fig. 2Sample JSON data2.2 Processing: Front-End Data PresentationThe Processing application is a graphic user interface (GUI) that first loads andprocesses the input JSON data into a visual representation. Loaded into memory,the JSON array contains network packet objects with packet information asattributes. It is loaded into memory via Processing’s Java-based JSON inputmethods. The packets are then added into individual topological data arrays,representing the nodes and connections that they travel between and through duringdata transmission. A time line is also generated based on the timestamps of theimported packet data, and the packet data are accessed through the individual statesof the time line.The initial design of the GUI visualization used a direct animated visual for theindividual packets of an exchange, allowing for a full illustration of the amount oftraffic on a connection between nodes. However, multiple issues arose from this,including the inaccurate portrayal of travel time for the data packets, whichgenerally travel faster than can be interactively visualized clearly. This initialversion used a time line of visual states where the visualization directly reflectedthe time-line state, but packet transmission was visualized as an animation. Theillustration ended up with inconsistencies, such as response packets being drawnwhile the initial packets were still portrayed as “travelling” and packets being“frozen” while the time line is paused when they were likely already at theirdestination (Fig. 3). While the idea of viewing individual packet movements isappealing, the design was ultimately impractical and was readapted to a new model.Approved for public release; distribution is unlimited.3

Fig. 3Original visualization modelThe new model uses flow visualization rather than individual packet visualization.A screenshot of the complete interface is found in Section 2.3. Instead of animatingindividual packet movements, the visualization portrays general activity along aconnection, which can then be selected to show more details about a given flow ofpackets, including information on individual packets. This model allows the visualto base itself on the data instead of the time line directly, and the time line insteadinfluences the state of the data. By doing this, independent animations of nodes andconnections can be manipulated far more easily as the model adapts itself to thedata rather than the timestamp on the time line. This allows for a simpler layout thatdoes not sacrifice clarity or detail. In the following screenshot (Fig. 4), active datatransfer is denoted by a solid connection, and the currently selected connection isdenoted by the highlighted connection.Fig. 4New flow-based modelApproved for public release; distribution is unlimited.4