Our graph visualization use cases blog post was the first of three exploring real-world applications for graph visualization.
Looking for the rest of the series?
Use cases for graph visualization: Cyber Security
Last time we reviewed two of the older commercial uses for graph visualization: law enforcement and fraud detection.
We saw how, as data volumes grew, the connection-led approach evolved from police investigation room walls to the ‘link analysis’ process. The financial services sector adopted this process as an effective way to detect and manage fraud.
In both scenarios, technology has led to bigger datasets. The police now routinely capture and analyze massive volumes of open-source intelligence (OSINT), and modern banking involves vast global networks of instant transactions and fast decisions.
You’ll know that cyber security is about understanding network vulnerabilities and protecting them from malicious attacks.
Data is measured in terabytes, and it’s not unusual for enterprises to handle billions of alerts each day. Analysts cannot hope to review every alert, but without the visualization tools to understand the big picture, they cannot perform effective triage either. The result: alerts get missed, vulnerabilities are exploited and post-attack forensics are inefficiently managed.
FREE: Visualizing cyber security threats
The ultimate guide to keeping networks, systems and IT infrastructure safe using data visualization
It’s no surprise that cyber security is the fastest-growing use case for graph visualization, which is becoming the go-to tool for cyber analysts. Enhancing their existing SIEM dashboards with a KeyLines-powered component gives them access to the joined-up intelligence they need, in the right place at the right time.
Let’s look at three key aspects of cyber security to see how our toolkit technology can help.
1. Spotting anomalies
To uncover threats, analysts almost always look for anomalies.
The human brain is good at recognizing patterns. Combined with a machine’s data processing capability, and it’s possible to find anomalies that machines alone would miss. This anomaly detection approach helps prevent data breaches, find malware entry points, predict externals attacks and find vulnerabilities in an organization’s perimeter.
In this cyber security webinar with KeyLines customer CyberFlow Analytics (now part of Webroot), their team combined graph visualization and advanced machine learning. The result was an anomaly detection tool capable of scaling to the largest IT networks.
2. Performing forensics
Even if an analyst cannot prevent an attack, graph visualization can still help them understand it and prevent a reoccurrence. Tracking the propagation of malware through a network reveals susceptible and potentially compromised machines.
This graph demonstrates how the malware attack on one machine infected four others.
In another example, we explored the VERIS database of data breaches, looking for patterns in how the breaches happen and who is responsible. That chart used the time bar to offer a dynamic view of what happened when:
Complex malware data can be visualized as a graph. The combos and time bar features in our toolkits can reveal network structures that can pinpoint trends and entry points.
3. Sharing intelligence
Graph visualization doesn’t just analyze past events and identify possible future problems: it’s also key to sharing cyber intelligence. Our graph visualization applications are interactive and intuitive, making them an ideal tool for communicating complex data quickly and simply.
In our interview with EclecticIQ’s co-founder Raymon van der Velde, we learned how their award-winning cyber threat intelligence platform harnesses graph visualization. Using KeyLines, the EclecticIQ team empower cyber threat analysts with a clear view of STIX/TAXII intelligence, and an easy way to analyze and communicate its insight.
Powering graphs at scale
In all three of these scenarios, performance is crucial.
Analysts rely on graph visualization to provide both a global (overview) and local (zoomed-in) view of their connected data. Performant layouts, filtering and social network analysis is key, but it must be combined with a powerful rendering engine. For a reliable and robust graph visualization at scale, only KeyLines and ReGraph’s WebGL component is up to the job.
Try it for yourself
If you have a connected data challenge that you think could be solved by visualization, we’re here to help. Start a trial or get in touch to learn more.
FREE: Start your trial today
Visualize your data! Request full access to our SDKs, demos and live-coding playgrounds.
