Leveraging 3D Game Engines (L3DGE): Novel techniques for anomalous traffic detection and collaborative network control.

Introduction

Our inspiration comes from previous work on network activity visualisation, virtual-world metaphors for interacting with computer process space and virtual world collaboration systems. We propose creating a virtual world where network events are rendered in real-time as visually orthogonal "activities" and network elements are controlled using metaphors for interaction that seem "natural" and familiar to the human operators. Recently darknets and greynets have been proposed to passively monitor for the tell-tale signs of network scans in progress. We will use greynets to collect network activity for rendering in our virtual world.

For example, monitored IP addresses may be represented by avatars that jump and spin in response to network events such as port scans. Interacting with a spinning or jumping avatar would be translated into an appropriate network reconfiguration (for example, temporarily updating an internal firewall's access control list). With appropriate translation of network events into the virtual world, and translation of virtual-world "interactions" back into network reconfiguration events, we can reduce the network specific training required for staff charged with identifying and suppressing anomalous traffic across an enterprise network.

Key to practical implementation is our use of off-the-shelf multiplayer 3D game-engine technology. With modification, modern game-engines enable the creation of computer-controlled avatars ("bots") whose behaviours are tied to monitored network events, and whose reactions to being "shot" or "healed" (common in-game metaphors for interaction) can be translated back into network reconfiguration events behind the scenes.