Our aim is to obtain a rst glance idea of the table data; we have developed a graphic interface. We use an UNIX system representation of the time. In the UNIX systems the time is counted in milliseconds beginning from a determined instant of the history. This instant is what is called zero epoch and it corresponds to the January 1, 1970.
In the interface a Cartesian coordinate system is visualized with the IP addresses on the axis y and the time on the axis x, gure 4.4. On the axis x we represent the seconds therefore, any date is in relationship 1 to 1 with a number that represents the seconds beginning from the epoch. We consider
Figure 4.4: Graphic visualization of dictionary result
as viewport of our interface the space of plan among the axises. There is a line for each IP address present in the dictionary attack result and the graph changes dynamically in comparison to it. The temporal window considered is given by the user in the preceding step with the parameters begin and end of the form, as shown in gure 4.2 . We can interact with the graph making some zooms forward or backward and moving the scrollbar.
In the rst visualization the scrollbar cannot be moved and begin/end of the graph exactly coincides with the parameters begin/end speci ed by the user. We can notice the 5 IP addresses instead of a lot of rows visualized on the table. In fact the attacks visualized on the table are reassumed by the graphic but the rst time we have a small granularity. We can increase the granularity through the zoom.
The various attacks from the IP address 60.208.105.190 are drawn, in this rst image, as single long attack; taking a great granularity the attacks can be visualized in their real form so it will be separated. Making a positive zoom we change the parameters, begin/end of the graph will coincide with some new parameters calculated according to a formula.
To produce the graphical representation we make a relation between the seconds and the pixels of the screen, we need to consider the size of the screen. The number of the pixels is got in a dynamic way so we will not
have problems of visualization in the case the size of the screen changes in future installations of the software on devices of dierent dimensions. At any instant of the time pointSec is mapped on a pixel x of the screen if this temporal instant reenters in the window of time considered. We call totalSec the total number of seconds, from the parameters begin and end speci ed by the user, we get x according to the proportion:
totalSec : pointSec = totalP ixels : x from which we obtain:
x = totalP ixels · pointSec totalSec
Our temporal window is relative to the parameters begin/end. The param- eter pointSec will be therefore an instant related to the parameter begin, pointSec = instantSec − begin, where instantSec is an instant of the history in seconds. Also the number x of pixels to be drawn is related to the axis y that has coordinates x = 0, so we have to set the pixel x beginning from the pixel of the axis y.
If we make a positive zoom, the gure is magni ed only on the axis x and the bars are lengthened according to the new parameters. The parameter totalSec is changed according to the formula:
totalSec = (end − begin) zoom
At the rst instance, zoom is equal to one and when we perform same zoom it will be multiplied for a xed value, for example two. Making a positive zoom there is a loss of information, there are some points that remain out of the viewport. These information can be all visualized through the scrollbar. A parameter move tells us that we are moved by the absolute center2 of our time. Every time that the scrollbar is moved the parameter move is modi ed in function of the movement of the scrollbar. Accordingly we make the refresh of the paint including and/or excluding some attacks from the viewport. Once calculated the x through the proportion, that is function of the parameter already modi ed totalSec, a check is made in order to see if the point should be drawn or not. If the calculated pixel is out of our range of values, it is not drawn. Our range of values is from 0 to totalPixels. The result of the zoom that we get continuing the precedent example is the gure 4.5. You notice the change of the temporal references begin/end and the size of the bars that represent the attacks. Also the scrollbar has changed, now we can interact with it. One attack, on the last IP address, is lost by the viewport but it can be visualized moving the picture with the scrollbar. Performing same zooms and moving the scrollbar we can see that the large bar splits in more dierent bars showing that it is composed of multiple attacks, see gure 4.6.
2The absolute center is given by (end−begin)
Figure 4.5: Zoom visualization