@inproceedings{gates2004netflow, author = {Carrie Gates and Michael Collins and Michael Duggan and Andrew Kompanek and Mark Thomas}, title = {More Netflow Tools: For Performance and Security}, booktitle = {18th Large Installation System Administration Conference (LISA '04)}, pages = {121-132}, year = {2004}, address = {Atlanta, Georgia, USA}, month = {November}, organization = {USENIX} }

@inproceedings{mccanne93bsd, author = {Steven McCanne and Van Jacobson}, title = {The {BSD} Packet Filter: A New Architecture for User-level Packet Capture}, booktitle = {{USENIX} Winter}, pages = {259-270}, year = {1993}, url = {citeseer.ist.psu.edu/mccanne92bsd.html} }

@inproceedings{parish2003distributions, title = {Using packet size distributions to identify real-time networked applications}, author = {D.J. Parish and K. Bharadia and A. Larkum and I.W. Phillips and M.A. Oliver}, booktitle = {Communications, IEE Proceedings}, year = {2003}, pages = {221-227} }

@inproceedings{yin2004visflowconnect, author = {Xiaoxin Yin and William Yurcik and Michael Treaster and Yifan Li and Kiran Lakkaraju}, title = {VisFlowConnect: netflow visualizations of link relationships for security situational awareness}, booktitle = {VizSEC/DMSEC '04: Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security}, year = {2004}, isbn = {1-58113-974-8}, pages = {26--34}, location = {Washington DC, USA}, doi = {http://doi.acm.org/10.1145/1029208.1029214}, publisher = {ACM Press}, address = {New York, NY, USA} }

@inproceedings{lakkaraju2004nvisionip, author = {Kiran Lakkaraju and William Yurcik and Adam J. Lee}, title = {NVisionIP: netflow visualizations of system state for security situational awareness}, booktitle = {VizSEC/DMSEC '04: Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security}, year = {2004}, isbn = {1-58113-974-8}, pages = {65--72}, location = {Washington DC, USA}, doi = {http://doi.acm.org/10.1145/1029208.1029219}, publisher = {ACM Press}, address = {New York, NY, USA} }

@inproceedings{ball2004home, author = {Robert Ball and Glenn A. Fink and Chris North}, title = {Home-centric visualization of network traffic for security administration}, booktitle = {VizSEC/DMSEC '04: Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security}, year = {2004}, isbn = {1-58113-974-8}, pages = {55--64}, location = {Washington DC, USA}, doi = {http://doi.acm.org/10.1145/1029208.1029217}, publisher = {ACM Press}, address = {New York, NY, USA} }

@inproceedings{mcpherson2004portvis, author = {Jonathan McPherson and Kwan-Liu Ma and Paul Krystosk and Tony Bartoletti and Marvin Christensen}, title = {PortVis: a tool for port-based detection of security events}, booktitle = {VizSEC/DMSEC '04: Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security}, year = {2004}, isbn = {1-58113-974-8}, pages = {73--81}, location = {Washington DC, USA}, doi = {http://doi.acm.org/10.1145/1029208.1029220}, publisher = {ACM Press}, address = {New York, NY, USA} }

@inproceedings{1029227, author = {Tom Goldring}, title = {Scatter (and other) plots for visualizing user profiling data and network traffic}, booktitle = {VizSEC/DMSEC '04: Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security}, year = {2004}, isbn = {1-58113-974-8}, pages = {119--123}, location = {Washington DC, USA}, doi = {http://doi.acm.org/10.1145/1029208.1029227}, publisher = {ACM Press}, address = {New York, NY, USA} }

@inproceedings{erbacher2002glyphbased, author = {Robert F. Erbacher}, title = {Glyph-Based Generic Network Visualization}, booktitle = {Proceedings of the SPIE '2002 Conference on Visualization and Data Analysis}, pages = {228-237}, year = {2002}, month = {January} }

@inproceedings{erbacher2001characterization, author = {Robert F. Erbacher}, title = {Visual Behavior Characterization for Intrusion Detection in Large Scale Systems}, booktitle = {Proceedings of the IASTED International Conference On Visualization, Imaging, and Image Processing}, pages = {54-59}, year = {2001} }

@inproceedings{erbacher2001large, author = {Robert F. Erbacher and Deborah Frincke}, title = {Visual Behavior Characterization for Intrusion and Misuse Detection}, booktitle = {Proceedings of the SPIE '2001 Conference on Visual Data Exploration and Analysis VIII}, pages = {210-218}, year = {2001}, month = {January} }

@inproceedings{shneiderman96eyes, author = {Ben Shneiderman}, title = {The Eyes Have It: {A} Task by Data Type Taxonomy for Information Visualizations}, booktitle = {IEEE Visual Languages}, number = {UMCP-CSD CS-TR-3665}, address = {College Park, Maryland 20742, U.S.A.}, year = {1996}, pages = {336-343} }

@inproceedings{roberts2000multiview, author = {Jonathan C. Roberts}, title = {{Multiple-View and Multiform Visualization}}, month = {January}, year = {2000}, pages = {176-185}, keywords = {Visualization, Multiple views, Multiform, Abstraction}, note = {}, url = {http://www.cs.ukc.ac.uk/pubs/2000/963}, booktitle = {Visual Data Exploration and Analysis VII, Proceedings of SPIE}, editor = {Robert Erbacher and Alex Pang and Craig Wittenbrink and Jonathan Roberts}, organization = {IS\&T and SPIE}, publication_type = {inproceedings}, submission_id = {26938_949431288}, volume = {3960} }