\subsection*{Rumint}
This tool takes its name from a term used in the intelligence community that stands for ``Rumor Intelligence". RUMINT \cite{rumint_site} is an open source network and security visualization tool that uses a VCR-like interface to enable analyst to visually play back traffic from any point within the set of packets. The data used in input are in the pcap format, that stands for ``packet capture", a standard file format which stores network data in binary format, used in the field of network analysis. 

After loading the data through the simple interface, the tool allows you to reproduce the transmission of the packets through seven different types of visualization, which are Text Rainfall, Byte Frequency, Parallel Plot, Binary Rainfall, Scatter Plot, Packet Detail and Combined, which can be activated individually and, allowing multiple simultaneous views for the analyst. Each visualization in turn allows, once opened, to choose between different options regarding the possible data to be used in the plot. For example, in the case of the scatter plot, it is possible to choose up to 19 different types of data, among which you can find the most common fields such as Source IP, Destination IP, TCP or UDP Source, TCP or UDP Destination, or more specific fields such as IP Header checksum, the TTL, or the Ethertype, if present within the string representing the packet.

In the screenshots shown, which show the various views of the tool, a pcap format file was used, containing the data of a spoofed TCP synflood attack \cite{packet_captures_site}. To allow a better use of the images, in the screenshots the analyzes have been stopped at a few packets, in the order of tens and hundreds, to obtain images that can be shown clearly and allow a correct understanding in the case of virtual reading mode and in case of printing. However, the deductions reported in the following lines, although they are already confirmed by these visualizations with a reduced quantity of packets, were made on the complete analysis of the sample that the tool allowed to load.

From some of the views produced by the tool (figures \ref{fig:Text Rainfall}, \ref{fig:Byte Frequency}, \ref{fig:Binary Rainfall}), we can see how the data flow contains a large amount of packets with similar content, which can in turn be inspected individually (figure \ref{fig:Packet Details}). For example, through the Text Rainfall visualization, in this case setted to represent the data via ASCII characters, it can be seen that the packet header is the same for all.
Through the other views (figures \ref{fig:Parallele Coordinate Plot}, \ref{fig:Scatter Plot}) where it was chosen to use the starting and destination IP addresses as parameters of the coordinates instead, it can be seen that the destination of all the packets is unique, and then in the last case (figure \ref{fig:Combined}), i.e. in the combined view, where instead chosen to represent the source and destination ports of the TCP service, it can be seen that here too the target is a single and specific port.


\begin{figure}[h]
\centering
\begin{minipage}{.5\textwidth}
  \centering
  \includegraphics[scale=.5]{Figures/chapter4/Rumint/TextRainfall.png}
  \caption{Text Rainfall}
  \label{fig:Text Rainfall}
\end{minipage}%
\begin{minipage}{.5\textwidth}
  \centering
  \includegraphics[scale=.7]{Figures/chapter4/Rumint/ByteFrequency.png}
  \caption{Byte Frequency}
  \label{fig:Byte Frequency}
\end{minipage}
\end{figure}

RUMINT is certainly one of the first examples of tools developed with a focus on security visualization, given that its first versions date back as far as 2005, years in which research focused on the use of more generic software. One of its main strengths lies in the possibility of simultaneously having all the different types of visualization that it offers independently in order to allow a varied and customizable use, together with the multitudes of data that can be chosen to represent. Another feature that facilitates its use is the absence of necessary configurations. The application only needs to be downloaded and once started it is ready to load the file, using the appropriate drop-down menu, and open the various views.

\begin{figure}[h]
\centering
\begin{minipage}{.4\textwidth}
  \centering
  \includegraphics[scale=.45]{Figures/chapter4/Rumint/ParallelCordinatePlot.png}
  \caption{Parallel Coordinate Plot}
  \label{fig:Parallele Coordinate Plot}
\end{minipage}%
\hfill
\begin{minipage}{.4\textwidth}
  \centering
  \includegraphics[scale=.65]{Figures/chapter4/Rumint/PacketDetail.png}
  \caption{Packet Details}
  \label{fig:Packet Details}
\end{minipage}
\end{figure}

\begin{figure}[ht]
    \centering
    \includegraphics[scale=.7]{Figures/chapter4/Rumint/Combined.png}
    \caption{Combined Representation}
    \label{fig:Combined}
\end{figure}
\FloatBarrier

However, his not young age is one of his main limitations. The latest update is dated September 2007 and as can be seen from the screens shown, the compatibility of the windows is not suitable for modern operating systems. Although the graphs do not undergo variations and are not influenced, the various optional settings that can be activated via buttons, the drop-down menus and some details are not correctly shown by the windows and therefore make their use more complicated and in some cases not possible. From a more technical side, however, the greatest limitation is given by the capacity of the buffer that stores the packets limited to 30,000 packets in memory, which in some contexts may not be sufficient. Finally, the installation file is supplied only with the .exe extension, therefore available only for Windows operating systems.

\begin{figure}[h]
\centering
\begin{minipage}{.4\textwidth}
  \centering
  \includegraphics[scale=.45]{Figures/chapter4/Rumint/BinaryRainfall.png}
  \caption{Binary Rainfall}
  \label{fig:Binary Rainfall}
\end{minipage}%
\hfill
\begin{minipage}{.4\textwidth}
  \centering
  \includegraphics[scale=.45]{Figures/chapter4/Rumint/ScatterPlot.png}
  \caption{Scatter Plot}
  \label{fig:Scatter Plot}
\end{minipage}
\end{figure}






