Visualization of Anomalies using Graph-Based Anomaly Detection


  • Ramesh Paudel George Washington University
  • Lauren Tharp
  • Dulce Kaiser Tennessee Technological University
  • William Eberle Tennessee Technological University
  • Gerald Gannod Tennessee Technological University



anomaly detection, visualization, graph-based


Network protocol analyzers such asWireshark are valuable for analyzing network traffic but pose a challenge in that it can be difficult to determine which behaviors are out of the ordinary due to the volume of data that must be analyzed. Network anomaly detection systems can provide vital insights to security analysts to supplement protocol analyzers, but this feedback can be difficult to interpret due to the complexity of the algorithms used and the lack of context to determine the reasoning for which an event was labeled as anomalous. We present an approach for visualizing anomalies using a graph-based anomaly detection methodology that aims to provide visual context to network traffic. We demonstrate the approach using network traffic flows as an approach for aiding in the investigation and triage of anomalous network events. The simplicity of a visual representation supports fast analysis of anomalous traffic to identify true positives from false positives and prevent further potential damage.

Author Biographies

Ramesh Paudel, George Washington University

Department of Electrical and Computer Engineering


Dulce Kaiser, Tennessee Technological University

Department of Computer Science

William Eberle, Tennessee Technological University

Professor, Department of Computer Science




How to Cite

Paudel, R., Tharp, L., Kaiser, D., Eberle, W., & Gannod, G. (2021). Visualization of Anomalies using Graph-Based Anomaly Detection. The International FLAIRS Conference Proceedings, 34.



Main Track Proceedings