>> Hello and welcome to
the third lesson from the module Campaign Analysis.
In this lesson, we are going to learn
another method or technique used for campaign analysis,
which is the visual analysis.
In this lesson, we are going to learn some of
the common aspects of visual analysis.
We are going to start with
a quick introduction to the visual analysis.
We will see how it can be useful for campaign analysis.
Why is graph visualization
so important and how it can help
businesses sift through large amounts of complex data,
and we will finish this lesson by enumerating
some tools that are offering visual analysis.
Over the last years the number of
IT security incidents has been
constantly increasing among companies.
In order to keep pace with this development,
there is a necessity for
ever improving protective measures.
As single entities are no longer able to
handle the vast amount of possible attack scenarios,
acting collaboratively against such attacks
is an emerging trend.
To meet these shortcomings,
we propose a graph analytics concept as
visual methods to analyze and visualize threat trends.
When you work with connected data,
graph visualization and analysis is
definitely more efficient method than
traditional analysis of spreadsheets
or data stored in relational databases.
First, let's see what is graph analysis.
Basically, graph analysis is also called
visual analysis or link analysis.
Graph visualization is the visual representation
of the nodes and edges of a graph.
Any type of dataset that contains information about
connections and be modeled and visualized as a graph,
even data initially stored in a tabular way.
Now, let's see why
visual analysis is a good method for campaign analysis.
First, you will spend
less time assimilating information because
the human brain processes
visual information much faster than a written one.
Visually displaying data ensures
>> a faster comprehension,
>> which in the end reduces the time to action.
Second, you have a higher chance to
discover insights by interacting with data.
Graph visualization tools offer
the possibility to manipulate data.
Third, you can achieve better understanding of
a problem by visualizing patterns and context.
Graph visualization tools are
perfect to visualize relationships,
but also to understand the context of a data.
Fourth reason, everybody can
work with graph visualization,
not only technical users.
All users can access the insights,
since specifying programming skills are not
required to interact with the graph visualizations.
In more practical way,
with graph technology,
you can combine multidimensional data.
It aggregates data from multiple sources
>> and formats into a single comprehensive
>> data model that can
>> scale up to billions of nodes and edges.
This is essential in multi intelligence or
all source analysis to identify suspicious patterns,
anomalies or irregular behavior.
Indeed, suspicious activities are
more easily detected when you analyze
the dynamics between entities and not
just the characteristics of single entity.
With this approach, analysts easily gather
and analyze data about people,
events, and locations, for example,
into one single view.
Now we can move to the tools.
Here are three examples of tools that you
can use to create and visualize your shared data.
These tools are Maltego,
Linkurious, and Keylines.
Let's see each one of them separately.
Keylines is a JavaScript SDK
for interactive graph visualization.
One major benefit of Keylines is that it works
with a verity of data sources and backends.
As long as the data can be parsed into JSON object,
Keylines can visualize it.
Even if you are using
relational or other databases or CSV files,
Keyline can handle it.
Users can build their own API translating
the relational or tabular data into a node link format,
which then can get best to key lines as a JSON object.
The second example is Linkurious.
In Linkurious, analysts can visually
investigate vast amount of data collections.
They can search for known patterns and
suspicious links from a browser-based interface.
Data filters and visual styles
>> help them focus on what's
>> important and reduce the noise
generated by large amounts of data.
The third example is Maltego.
This tool is widely used by
the community of cybersecurity practitioners.
Maltego is essentially a data mining tool
that creates directed graphs to be further analyzed.
This tool helps connect the dots,
which essentially means that it
helps find common ground between
different pieces of information
that may be gotten from the Internet.
There are multiple versions available for download.
For example, there is Maltego Community Edition.
This version is available for free.
However, a simple sign-up is required to use it.
It provides us with
same feature set as the commercial version.
However, with a view limitations such as
no more than 10,000 entities on single graph.
This is all for this lesson about visual analysis.
We started with definition of visual analysis.
We saw why is it important for
campaign analysis and how is it used in
threat intelligence and we
finish it with common tools that
are used for link or a visual analysis.
I hope you like this video.
In the next lesson, we will discover together
Mitre ATT&CK threat group tracker. See you later.