Interactive visualization of event logs for cybersecurity

Hidden cyber threats revealed with new visualization software Eventpa

Методика визуального анализа маршрутов сотрудников организации для обнаружения аномалий

The detection of anomalies in the movement of employees is an important task of the cyber-physical security of enterprises, including critical infrastructures. The paper presents a technique to analyze the routes of the organization employees based on combination of the data mining and interactive visualization techniques. It includes two stages – detection of the groups of the employees with similar behavior and anomaly discovery. The self-organizing Kohonen maps are used to group employees on the basis of their behavior. To present spatiotemporal patterns, authors developed special visualization model named BandView. To detect anomalies authors present a rating mechanism assessing spatiotemporal attributes of the movement. The visualization of the anomalies is done using heatmaps that allow an analyst to spot place and time with a possibly suspicious activity. The technique is tested against data set provided within VAST MiniChallenge-2 contest that contains logs from access control sensors describing employees’ movement within organization building.Обнаружение аномалий в перемещениях сотрудников является важной задачей, которая связана с обеспечением киберфизической безопасности предприятий, включая критические инфраструктуры. В работе представлен подход к анализу перемещений сотрудников критической инфраструктуры, отличающийся сочетанием алгоритмов интеллектуального анализа данных и интерактивных методик визуализации. Он включает в себя два этапа – определение групп сотрудников с похожим поведением и обнаружение аномалий. Группировка пользователей по их поведению осуществляется с помощью самоорганизующихся карт Кохонена; для отображения пространственно-временных шаблонов поведения используется разработанная авторами модель визуализации BandView. Для обнаружения аномалий в поведении сотрудников предлагается механизм оценки значений пространственно-временных атрибутов движения. Отображение отклонений осуществляется с помощью тепловой карты, позволяющей аналитику с легкостью определить зону и интервал времени с подозрительной активностью. Подход апробирован на наборе данных, предоставленном в рамках конкурса VASTMiniChallenge-2 2016, который описывает перемещения сотрудников внутри здания организации

A Pattern Approach to Examine the Design Space of Spatiotemporal Visualization

Pattern language has been widely used in the development of visualization systems. This dissertation applies a pattern language approach to explore the design space of spatiotemporal visualization. The study provides a framework for both designers and novices to communicate, develop, evaluate, and share spatiotemporal visualization design on an abstract level. The touchstone of the work is a pattern language consisting of fifteen design patterns and four categories. In order to validate the design patterns, the researcher created two visualization systems with this framework in mind. The first system displayed the daily routine of human beings via a polygon-based visualization. The second system showed the spatiotemporal patterns of co-occurring hashtags with a spiral map, sunburst diagram, and small multiples. The evaluation results demonstrated the effectiveness of the proposed design patterns to guide design thinking and create novel visualization practices

What User Behaviors Make the Differences During the Process of Visual Analytics?

The understanding of visual analytics process can benefit visualization researchers from multiple aspects, including improving visual designs and developing advanced interaction functions. However, the log files of user behaviors are still hard to analyze due to the complexity of sensemaking and our lack of knowledge on the related user behaviors. This work presents a study on a comprehensive data collection of user behaviors, and our analysis approach with time-series classification methods. We have chosen a classical visualization application, Covid-19 data analysis, with common analysis tasks covering geo-spatial, time-series and multi-attributes. Our user study collects user behaviors on a diverse set of visualization tasks with two comparable systems, desktop and immersive visualizations. We summarize the classification results with three time-series machine learning algorithms at two scales, and explore the influences of behavior features. Our results reveal that user behaviors can be distinguished during the process of visual analytics and there is a potentially strong association between the physical behaviors of users and the visualization tasks they perform. We also demonstrate the usage of our models by interpreting open sessions of visual analytics, which provides an automatic way to study sensemaking without tedious manual annotations.Comment: This version corrects the issues of previous version

Visual Analytics Methods for Exploring Geographically Networked Phenomena

abstract: The connections between different entities define different kinds of networks, and many such networked phenomena are influenced by their underlying geographical relationships. By integrating network and geospatial analysis, the goal is to extract information about interaction topologies and the relationships to related geographical constructs. In the recent decades, much work has been done analyzing the dynamics of spatial networks; however, many challenges still remain in this field. First, the development of social media and transportation technologies has greatly reshaped the typologies of communications between different geographical regions. Second, the distance metrics used in spatial analysis should also be enriched with the underlying network information to develop accurate models. Visual analytics provides methods for data exploration, pattern recognition, and knowledge discovery. However, despite the long history of geovisualizations and network visual analytics, little work has been done to develop visual analytics tools that focus specifically on geographically networked phenomena. This thesis develops a variety of visualization methods to present data values and geospatial network relationships, which enables users to interactively explore the data. Users can investigate the connections in both virtual networks and geospatial networks and the underlying geographical context can be used to improve knowledge discovery. The focus of this thesis is on social media analysis and geographical hotspots optimization. A framework is proposed for social network analysis to unveil the links between social media interactions and their underlying networked geospatial phenomena. This will be combined with a novel hotspot approach to improve hotspot identification and boundary detection with the networks extracted from urban infrastructure. Several real world problems have been analyzed using the proposed visual analytics frameworks. The primary studies and experiments show that visual analytics methods can help analysts explore such data from multiple perspectives and help the knowledge discovery process.Dissertation/ThesisDoctoral Dissertation Computer Science 201

Visual Analytics of Mobility and Transportation: State of the Art and Further Research Directions

Many cities and countries are now striving to create intelligent transportation systems that utilize the current abundance of multisource and multiform data related to the functionality and the use of transportation infrastructure to better support human mobility, interests, and lifestyles. Such intelligent transportation systems aim to provide novel services that can enable transportation consumers and managers to be better informed and make safer and more efficient use of the infrastructure. However, the transportation domain is characterized by both complex data and complex problems, which calls for visual analytics approaches. The science of visual analytics is continuing to develop principles, methods, and tools to enable synergistic work between humans and computers through interactive visual interfaces. Such interfaces support the unique capabilities of humans (such as the flexible application of prior knowledge and experiences, creative thinking, and insight) and couple these abilities with machines' computational strengths, enabling the generation of new knowledge from large and complex data. In this paper, we describe recent developments in visual analytics that are related to the study of movement and transportation systems and discuss how visual analytics can enable and improve the intelligent transportation systems of the future. We provide a survey of literature from the visual analytics domain and organize the survey with respect to the different types of transportation data, movement and its relationship to infrastructure and behavior, and modeling and planning. We conclude with lessons learned and future directions, including social transportation, recommender systems, and policy implications

Visual analytics of location-based social networks for decision support

Recent advances in technology have enabled people to add location information to social networks called Location-Based Social Networks (LBSNs) where people share their communication and whereabouts not only in their daily lives, but also during abnormal situations, such as crisis events. However, since the volume of the data exceeds the boundaries of human analytical capabilities, it is almost impossible to perform a straightforward qualitative analysis of the data. The emerging field of visual analytics has been introduced to tackle such challenges by integrating the approaches from statistical data analysis and human computer interaction into highly interactive visual environments. Based on the idea of visual analytics, this research contributes the techniques of knowledge discovery in social media data for providing comprehensive situational awareness. We extract valuable hidden information from the huge volume of unstructured social media data and model the extracted information for visualizing meaningful information along with user-centered interactive interfaces. We develop visual analytics techniques and systems for spatial decision support through coupling modeling of spatiotemporal social media data, with scalable and interactive visual environments. These systems allow analysts to detect and examine abnormal events within social media data by integrating automated analytical techniques and visual methods. We provide comprehensive analysis of public behavior response in disaster events through exploring and examining the spatial and temporal distribution of LBSNs. We also propose a trajectory-based visual analytics of LBSNs for anomalous human movement analysis during crises by incorporating a novel classification technique. Finally, we introduce a visual analytics approach for forecasting the overall flow of human crowds