Visualization for internet of things: power system and financial network cases

National critical infrastructure networks, such as banks and industrial control systems (ICSs), can be serious damaged in the event of a security incident. Therefore, in all these major infrastructures, closed networks are constructed to cut off the attack path. However, owing to the emergence of cloud, Internet of Things (IoT), and artificial intelligence (AI) services, network interconnection is rapidly increasing; thus, many major infrastructure networks can no longer be called closed networks. The ICS, which was previously a strictly closed network, is now usually called Industrial Internet of Things (IIoT) and exhibits many changes, such as smart factories and remote control. Many payment modules use the financial network through IoT or AI-assisted services. In this massive connected environment, the existing closed network defense system may cause difficulties in providing the service. Therefore, there is a need for technology that can continuously monitor the possibility of advanced attacks. In this paper, we define the normal-behavior-based rules from the perspective of network forensics and conduct visualization studies to detect all possible attacks against the control protocol DNP3 (Distributed Network Protocol) and the financial protocol called FIX (Finance Information Exchange). Thus, we detected suspicious network packets on the ICS network and the financial network and identified abnormal behavior that could be the basis of serious attacks.