Towards Effective Collaborative Analysis for Distributed Intrusion Detection

This paper addresses the problem of collaborative analysis in a distributed setting via a network security application. Network security analysis often requires accurate and timely results, which is very challenging to achieve in large dynamic networks with a single user. To address this issue, we design and develop a collaborative detection mechanism for complex intrusion detection applications. We also establish a set of collaboration guidelines for team coordination with distributed visualization tools. These collaboration guidelines cover the designs of coordination roles, workflow, collaborative environments and human computer interactions. We apply them to generate a prototype system with interactions that facilitates collaborative visual analysis. According to the expert feedback acquired for assessing our approach, we propose directions for improving the efficiency of collaborative analysis.