Clustering and Visualization of Network Security-Related Data using Elastic Stack

Security concerns and economic losses caused by network attacks have inspired extensive network security research with active study fields that include data collection, analysis, and visualization. Visualization can help analysts to efficiently detect unusual behavior patterns in a vast amount of data, which should result in a prompt response to a potential security threat. However, the majority of the research papers suggest custom visualization solutions for the proposed analysis techniques rather than using available and well-adopted data pipelines that can further support the analysis. In this paper, we propose a system architecture for clustering, visualization, and computer-assisted network security analysis based on an open-source Elastic Stack. We extended the data pipeline in order to enable data clustering prior to visualization and employed visual mapping techniques to filter data and successfully spot the network assaults. A case study that demonstrates the effectiveness of the proposed solution is given in the example of a port scan attack.