Computer system, method and program for graphically representing network intrusions. Source icons are displayed in rows in a first column. The source icons represent source IP addresses from which intrusions were sent. Destination icons are displayed in rows in a second column. The destination icons represent destination IP addresses to which the intrusions were sent. The destination icons that receive intrusions from a same source icon are clustered together in the graphical representation across from the same source icon. An arrow is displayed from each of the source icons pointing to each of the destination icons to which each source icon sent an intrusion, such that there are "N" arrows from each source icon to "N" destination icons to which each source icon sent at least one intrusion.