SyCaT-Vis: Visualization-Based Support of Analyzing System Behavior based on System Call Traces

TitleSyCaT-Vis: Visualization-Based Support of Analyzing System Behavior based on System Call Traces
Publication TypeConference Proceedings
Year of Conference2019
AuthorsHausdorf, Alrik, Hinzmann Nicole, and Zeckzer Dirk
Conference Name27. International Conference in Central Europe on Computer Graphics, Visualization and Computer Vision 2019 WSCG 2019
Conference LocationPilsen, Czech Republic
Keywordsbehavior analysis, security analysis, Security visualization, system call traces
AbstractDetecting anomalies in the behavior of a computer system is crucial for determining its security. One way of detecting these anomalies is based on the assessment of the amount and sequence of system calls issued by processes. While the number of processes on a computer can become very large, the number of system calls issued during the lifespan of such a process and its subprocesses can be humongous. In order to decide whether these anomalies are due to the intended system usage or if they are caused by malicious actions, this humongous amount of data needs being analyzed. Thus, a careful analysis of the system calls’ types, their amount, and their temporal sequence requires sophisticated support. Visualization is frequently used for this type of tasks. Starting with a carefully aggregation of the data presented in an overview representation, the quest for information is supported by carefully crafted interactions. These allow filtering the tremendous amount of data, thus removing the standard behavior data and leaving the potentially suspicious one. The latter can then be investigated on increasingly finer levels. Supporting this goal-oriented analysis, we propose novel interactive visualizations implemented in the tool SyCaT-Vis. SyCaT-Vis fosters obtaining important insights into the behavior of computer systems, the processes executed, and the system call sequences issued.