Riverside A Network Security Visualization Tool

The speaker, a recent master's graduate who works in the Coast Guard and previously worked in a SOC doing vulnerability assessments, starts with the problem. Network maps and asset lists were often missing or wrong, and working out what connected to what took days. Community input gathered for the thesis pushed the design toward dynamic discovery and drill-down views rather than showing everything at once.

Riverside is agent-based. Agents written in Go send raw host data over gRPC using protocol buffers to a server, which feeds a web front end through websockets and stores history in a database. Hosts appear as nodes, edges are colored by detected protocol, and thickness reflects throughput. A timeline lets viewers scrub backward or replay from a past moment. The demo replayed a simulated attack built in Docker, covering RDP brute forcing, SMB lateral movement, DNS beaconing and FTP exfiltration, with compromised hosts recolored to track them.

The speaker was candid about gaps: no PCAP import yet, no confirmed behavior on tap ports, and testing only up to about thirty hosts. Windows 10 and 11 plus several Linux distributions were checked. The takeaway is that a complete, time-aware map helps analysts spot unaccounted hosts and explain activity to non-technical stakeholders. The tool is on GitHub, and development is expected to continue.