HOME



Raffael Marty

Raffael Marty is the founder of PixlCloud and a co-founder of Loggly. His research interests span anything related to IT data visualization. He has held various positions in the log management space at companies like Splunk, ArcSight, and IBM research where he also earned his masters in computer science. His book, Applied Security Visualization, and the SecViz portal are the primary resources for information related to security visualization. The Data Analysis and Visualization Linux (DAVIX), as well as AfterGlow are two of his past projects that have helped form the security visualization space.

Books

Applied Security Visualization

This book is about visualizing computer security data. The book guides, Step-by step, through visually analyzing electronically generated security data. Insider Threat, Governance, Risk, and Compliance (GRC), and Perimeter Threat all require people to gather and analyze their IT data. Log files, configuration files, and other IT security data needs to be analyzed and monitored to address a variety of use-cases. Instead of handling textual data, visualization is offering a new, more effective, and simpler approach to analyze millions of log entries generated on a daily basis. Graphical representations help immediately identify outliers, detect malicious activity, uncover mis-configurations and anomalies, or spot general trends and relationships among individual data points. Visualization of data - the process of converting security data into a picture - is the single most effective tool to address these tasks.

 

Security Data Visualization

I wrote a chapter on firewall log analysis and IDS signature tuning using visual methods for Greg's book.

 

Snort IDS and IPS Toolkit

I wrote a chapter on security data analysis and reporting for the Snort book from Syngress.

Log Analysis and Security Visualization Workshops



Some of the things that people say about the presentations and workshops:

"Materials are generated from real-world experiences hence all things learnt are really practical and useful."
"The class was pretty intensive (with loads of stuff - theory and practical)."
"Certainly, it changed my perception on doing log analysis traditionally and paved new ways to work on log analysis."
"Cool stuff!"
"Very informative in understanding core concepts with SecVisualization."
"Probably the most useful speaker of the day. He provided very good information on how to visualize data. I would like to see him come back in a workshop type format where we could bring the logs that our applications actually create and he could help us filter them and put it in a useful format.
"This was one of the more interesting talks."

As networks become ever more complex, securing them becomes more and more difficult. The solution is visualization. Using today's state-of- the-art data visualization techniques, you can gain a far deeper understanding of what's happening on your network right now. You can uncover hidden patterns of data, identify emerging vulnerabilities and attacks, and respond decisively with countermeasures that are far more likely to succeed than conventional methods. The attendees will learn about log analysis, get an overview of visualization, data sources for IT security, and learn how to generate visual representations of IT data. The training is filled with hands-on exercises utilizing the DAVIX live CD.

List of past workshops:

Past Presentations

Press

Papers

  • DAVIX gegen Goliath, Jan P. Monsch/Raffael Marty/Christoph Puppe, iX special Herbst 2008 Sicher im Netz
  • Security Visualization - Learning From The New York Times, a video produced for Source Boston 2008.
  • My GCIA paper. This paper shows how I analyzed a dataset given by SANS. I used graphing techinques, GraphViz and other tools, to automatically generate visual images of the dataset. I was a bit too enthousiastic and wrote way too much. The additional chapters are therefore published here.
  • I was one of the co-authors of Design of an Intrusion-Tolerant Intrusion Detection System, a long-term research project funded by the European Union under the Information Society Fifth Framework Programme.
  • Thor: A Tool to Test Intrusion Detection Systems by Variations of Attacks.
  • My second term project I was working on was to improve an anonymity network by adding so called mixes. Read more on the Mixer page.
  • My first term project I wrote at the Institute of Robotics at the ETH. My task was to develop a device driver for a PCMCIA Adapter and on top of that I had to implement the FAT-Filesystem in order to access ATA-compatible drives. Check out the special page to find out more.
  • During a seminar that I attended while studying computer science, I worked together with Robert Hass on the topic: "IP over Everything". It's about the network layers IP works on, with a strong emphasis on the core-network technologies. Further we present a couple of services which use IP and what functionalities these services will demand from IP. In the services chapter I wrote a paragraph about security in the near future and what criterias the IP protocol will have to fullfill. Further there is another interesting chapter about VPNs. The presentation is available online as well.

Memberships

Future Speaking Engagements

Voices

Tools / Projects

  • Security Data Visualization Portal
  • AfterGlow - Visualization Tool
  • Thor - Intrusion Detection Testing and Correlation Tool
  • DAVIX - Data Analysis and Visualization Linux
  • Predict, a project for open log sharing, sponsored by the DHS
  • NIST 800-41, contributed to the Guidelines on Firewalls, and Firewall Policy.
  • NIST 800-92, contributed to the Guide to Computer Security Log Management

Areas of Expertise

  • Security Data Visualization
  • Log Management
  • Intrusion Detection
  • Insider Threat
  • Governance Risk and Compliance
  • HoneyNets
  • UNIX security
  • Product Management

Education / Certification

  • Certified Product Manager, Pragmatic Marketing, October 2006.
  • SANS GIAC Certified Intrusion Analyst (GCIA), February 2005.
  • IBM IT Security Methodology Certification, March 2003.
  • Certified Information System Security Professional (CISSP), November 2002.
  • Masters in Computer Science from Federal Institute of Technology (ETH) in Zurich, Switzerland
  • Teaching assistant for Network Security 2001 at ETH Zurich.

Photos

PGP Key

KeyID: 0x4E0F59A9

3000 D9E8 4442 211D 1523 6C96 6818 90EA

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: PGPfreeware 6.5.2 for non-commercial use 

mQENAziQ0UMAAAEIAJd+CJUBgU/OmOmT9P9jWAQyRQ5XtwJF8t5L+rYoJm6mlyGl
29gFSq9pj5fzWXUiMbRnFtI2w47EO3UBa8+X0Xc+FxfeZNVpD5R5Cxt7h9BFOFd+
ej7DdoXd2pFrgc/K5OxBiUrFU14EZePRnyooavC0CZqRynGajtV3noUewDGrmnhF
dR8pamh6srrJ4WburYAKe0aV/P/jT4d0+VfFjgpGFRE2BiKKni3CxVxofpMK//gy
WDD8qfJ8Zi/ncGn1U0e4WeQ7wkjQjAQfQm60RUbZt2kkYuB2t5vwWFn3INiXW+Do
8zArUilLF/7bD0dX61Q4kKP9Ciwifyuevk4PWakABRG0HlJhZmZhZWwgTWFydHkg
PGFkbWluQHJhZmZ5LmNoPokBFQMFEDiQ0UN/K56+Tg9ZqQEB0uMH/jCZ4NOSi0eF
d+0Z/OkGuM9Y5J6kD5SvAIl6dkyJBvaUDWm6y3xh/j71LGwwZebJB5q2yhUPUFXm
v+EnO22+OAmFgJbd6YUGZn9hJWMD+KG4ms10S5joxPjpYqgQL5ATdhvDXbWrcGf/
C4x8GgJW8fQCMcSITGt6y6wDD77kroxCS0asioboBfUoU5AF98QCdS5wPo3GZz6Q
7nZEoPo4M0Cfxx7wvKTjHOvrXe7qtBkVZV3fKC3u4bKRUaXQ3APBYhAvCzU6ZzLO
HOhY450NWpOKLKArcRqx5Hkv3PZQj60MMmMLvvxzmgTXnUt+1vaQ+pYLFfgJTqJl
2bSv6v5/bQiJARUDBRA4kNGSChXrei1SV9sBAWdYCACuUR5InXwK2VkhPD3wxHH/
+EE/GVD8r4A2zLZpYjqIeXfST/Ve4mXTnwriFx5Sq8Yqwtq1UoGN6Vk3MYwo6+Eo
0Pi6vgmQO2FY9vmqYS0ZmbJvxC8LNO+lK0PqrzzPkun/BBTMqUkp+ClOwzQMXNkl
FOlKOjC8VDidz9aNvjTnb2p6YzWedM2UMKGX0mOnv+PmqD9MpKGixQHVmVwROBQ1
gwj4F4NiIZz4mb4OltJKiwPw2AZsnrK8Y5+x5GKmLk/JYh7FoJsW4VfZK+sj/gUH
85kiHwPh+OhRYC9JsimSihn35VdiSEFFyNtjikMYLKdq8RA9sk8CIGoIoxQXfRC9
=3xQU
-----END PGP PUBLIC KEY BLOCK-----