International audienceWe present our visualization systems and ﬁndings for the Badge and Network Trafﬁc as well as the Social Network and Geospatial challenges of the 2009 VAST contest. The summary starts by presenting an overview of our time series encoding of badge information and network trafﬁc. Our ﬁndings suggest that employee 30 may be of interest. In the second part of the paper, we describe our system for ﬁnding subgraphs in the social network subject to degree constraints. Subsequently, we present our most likely candidate network which is similar to scenario B

Archambault, Daniel

Brulin, Mathieu

Dubois, Jonathan

Gilbert, Frédéric

Koenig, Pierre-Yves

Lambert, Antoine

Mathiaut, Morgan

Melançon, Guy

Phan Quang, Trung Tien

Sicre, Ronan

Simonetto, Paolo

Vieux, Remi

Zaidi, Faraz

INRIA a CCSD electronic archive server

HAL Id: hal-00413602https://hal.archives-ouvertes.fr/hal-00413602Submitted on 4 Sep 2009HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.L’archive ouverte pluridisciplinaire HAL, estdestinée au dépôt et à la diffusion de documentsscientifiques de niveau recherche, publiés ou non,émanant des établissements d’enseignement et derecherche français ou étrangers, des laboratoirespublics ou privés.Solving the Traffic and Flitter Challenges with TulipPaolo Simonetto, Pierre-Yves Koenig, Faraz Zaidi, Daniel Archambault,Frédéric Gilbert, Trung Tien Phan Quang, Morgan Mathiaut, AntoineLambert, Jonathan Dubois, Ronan Sicre, et al.To cite this version:Paolo Simonetto, Pierre-Yves Koenig, Faraz Zaidi, Daniel Archambault, Frédéric Gilbert, et al.. Solv-ing the Traffic and Flitter Challenges with Tulip. IEEE Symposium on Visual Analytics Scienceand Technology 2009, Oct 2009, Atlantic City, New Jersey, USA, United States. pp.247-248. ￿hal-00413602￿Solving the Traffic and Flitter Challenges with TulipAward Traffic Mini Challenge: Innovative Visualization and Excellent DescriptionAward Flitter Mini Challenge: Representation of Uncertainty in Rules & in VisualizationPaolo Simonetto∗ Pierre-Yves Koenig∗ Faraz Zaidi∗ Daniel Archambault† Frédéric Gilbert∗Trung-Tien Phan-Quang∗ Morgan Mathiaut∗ Antoine Lambert∗ Jonathan Dubois∗Ronan Sicre∗ Mathieu Brulin∗ Remy Vieux∗Guy Melançon†INRIA Bordeaux Sud-Ouest and LaBRI, Université de Bordeaux IABSTRACTWe present our visualization systems and findings for the Badgeand Network Traffic as well as the Social Network and Geospa-tial challenges of the 2009 VAST contest. The summary starts bypresenting an overview of our time series encoding of badge infor-mation and network traffic. Our findings suggest that employee 30may be of interest. In the second part of the paper, we describeour system for finding subgraphs in the social network subject todegree constraints. Subsequently, we present our most likely can-didate network which is similar to scenario B.Index Terms: H.5.0 [Information Systems]: Information Inter-faces and Presentation—General; F.2.2 [Theory of Computation]:Nonnumerical Algorithms and Problems—Pattern matching;1 INTRODUCTIONIn order to determine the most likely candidates for the embassyleak and the pattern in the social network, we developed two visu-alization systems using the Tulip [1] graph drawing libraries andsoftware. The first system, presented in section 2, describes ourtime series visualization to understand the situation at the embassyusing a time series of widgets. Section 3 describes our system forfinding patterns in the larger social network.2 BADGE AND NETWORK TRAFFIC CHALLENGEOur visualization technique, shown in Figure 1, is based on a time-line view. The horizontal axis encodes the time of the day at hourintervals, while the vertical axis encodes the employee ID and IPaddress. The horizontal lines in the grid group employees into of-fices. For example, in Figure 1(a), employees 14 and 15 are in thesame office because they are in between the same horizontal lines.The timeline of each employee collects four kinds of data. First,the upwardly directed glyphs, the teal circles and bars, encode thedoor log events. Circles are badge-in events. Bars between twovertical lines encode the time interval between a badge-in-classifiedevent and badge-out-classified event for an employee. The centralblue bars show when the employee’s computer is active. Down-wardly directed circles represent transmissions and the size of thecircle is proportional to transmission size.A green background shows the average daily activity of an em-ployee over the thirty-one days. A more saturated green indicates ahigher probability that the employee is at work. The colour of this∗{paolo.simonetto, pierre-yves.koenig, faraz.zaidi, frederic.gilbert,phanquan, mathiaut, antoine.lambert, dubois, sicre, mathieu.brulin, vieux}@labri.fr†{daniel.archambault, guy.melancon}@inria.fr(a) Suspicious Activity(b) Classified ZoneFigure 1: Two suspicious transmissions. (a) Employee 13’s computeris used for a large upload on day twenty-two before the employeeusually arrives at work. (b) A case where an employee’s computer isused while the employee is in the classified zone.green background can be changed to red, highlighting suspiciousactivities. The most suspicious activities occur when an employeescomputer is active but he or she is most likely not at their desk.We found three exceptionally suspicious transmissions in thedata. In our first case, Figure 1(a) shows a large transmission fromemployee 13’s computer on day twenty-two, forty minutes beforethe employee usually arrives at work. The employee had yet tobadge into the building and the badge-in-building event recordedwas typical for this employee. In our second case, a large trans-mission is sent less than a minute before employee 20 badges intothe building on day twenty-nine, indicating the employee is prob-ably not at their desk. Finally, a large transmission is sent fromemployee 18’s computer over two hours since it was last active onday seventeen. In all three cases, the office was most likely emptyas the computer activity and the green background in the visualiza-tion indicate. A leak could have been sent from this computer bysomeone who is not assigned to this office.Subsequently, we looked for transmissions sent from an em-ployee’s computer when the employee was in the classified zone.During this time, the employee’s computer should not be used, be-cause they are away from their desk. Figure 1(b) shows an example,but, in reality, we found eight such cases.(a) Query Interface (b) Degree Selection (c) Candidate SolutionFigure 2: Task 2 visualization system. (a) Visual Query Generator interface with the tool bar showing Employee(EMB), Handlers(Hi), Middle-men(BMH), Fearless Leader(FL) nodes and required or optional edges. (b) Histogram view allowing user to choose the range for the number ofconnections for each role. (c) Our best candidate solution for this task.All eleven of these suspicious transmissions were sent to thesame IP address, 100.59.151.133, and on the same port, 8080.We figured that this machine is where the leaks were uploaded.Subsequently, we highlighted all transmissions to this IP addressand found seven other transmissions. The office was probablyempty in all cases with one interesting exception: employee 30 wasmost likely in 30/31’s office when three of the suspicious transmis-sions were sent from employee 31’s computer. After plotting allsuspicious transmissions on the embassy map, we found that theywere clustered around office 15: employee 30’s office.Finally, we found five cases where an employee either badgedinto the secure zone without badging out or vice versa, and em-ployee 30 was involved in three of these five infractions.3 SOCIAL NETWORK AND GEOSPATIAL CHALLENGEThe interactive query generator, shown in figure 2(a), enables theuser to generate the pattern to be found in the larger graph througha visual interface. Using the supplied input, the system applies con-straints to the graph, simplifying the search for the given pattern.The tool bar contains nodes with different roles and edges, allow-ing the user to construct patterns. The user can choose any numberof handlers, middlemen, and fearless leaders. These nodes are con-nected through optional or required edges. Required edges playan important role in filtering as they impose minimum degree con-straints for each role. The Employee (EMB), handlers (Hi), mid-dlemen (BMH) and fearless leader (FL) all have different degreeconstraints. Through a histogram view, shown in figure 2(b), theuser chooses degree ranges for each role based on the degree distri-bution in the entire graph.For example, in the task description, the degree of an employeeis about 40. In the histogram view, few nodes have a degree above45. Therefore, we take 45 as an upper bound for employee de-gree and the same level of uncertainty as a lower bound. Handlercandidates have a degree range between 30 and 40. We enter therange [27, 43], ensuring that no solution near these bounds wouldbe missed. We estimate that the degree of a middleman is about6. These middlemen communicate with one or more handlers andthere are 3 at most. Middlemen have one or two more contacts, oneof them being the fearless leader. Therefore, a middleman has a de-gree of about 5 (3 handlers + 1 or 2 other contacts). Thus, we set amaximum degree of 6, which allows for some uncertainty. Finally,the fearless leader has over 100 contacts which we use as a lowerbound.To search for the patterns in the graph, the algorithm creates setsof possible candidates for each role based on the degree constraintsand iteratively removes elements from these sets based on connec-tivity constraints. The induced subgraph of the union of these sets iscomputed to filter the network. Additional connectivity constraintsare applied from the given pattern drawn in the query generator.For example, an employee must be connected to three handlers,thus, any node having a degree less than three is removed. Similarconstraints can be applied to handlers, middlemen, and the fearlessleader.Connection constraints exist between all roles: the employee isconnected to the handlers, the handlers to the middlemen, and themiddlemen to the fearless leader. We use these constraints to filterthe network further. Once complete, our system constructs separategraphs for each possible candidate network.From this point forward, we manually filter the candidate net-works. The system uses shape to encode each role: squares foremployees, circles for handlers, triangles for middlemen, and pen-tagons for fearless leaders. The constraint that allowed us to elim-inate the most candidate networks was that handlers had to be di-rectly connected to the employee and must communicate with thefearless leader through a middleman. In any of the candidate net-works, if we see a fearless leader doesn’t communicate with exactlythree handlers then the candidate network is rejected.To filter this list of solutions further, we use the geospatial infor-mation. Nodes in the candidate network are coloured by city sizeaccording to the legend on the Flovania map. Distances betweencities are mapped to edge width where thicker edges correspond tonodes that are close geospatially. Our best candidate solution to theFlitter challenge is shown in figure 2(c). As the leader is in a largercity, the fearless leader must be coloured either yellow or red. Mid-dlemen are in a city geospatially close to the employee or to thehandler, and, thus, should have thick edges in these connections.4 CONCLUSIONWe believe that employee 30 probably caused the embassy leak,because most of the suspicious transmissions were sent from loca-tions near the employee’s office, and he or she is one of the fewemployees who could have sent all of these transmissions.We, also, believe that employee working at the embassy has aFlitter name @terekhov. Our candidate solution matches scenarioB where each handler has his or her own middleman. The fearlessleader in this network has Flitter name @irvin.ACKNOWLEDGEMENTSWe thank the INRIA the Gravité project for supporting this work.REFERENCES[1] D. Auber. Tulip : A huge graph visualization framework. In P. Mutzeland M. Jünger, editors, Graph Drawing Software, Mathematics and Vi-sualization, pages 105–126. Springer-Verlag, 2003.

Solving the Traffic and Flitter Challenges with Tulip

https://hal.archives-ouvertes.fr/hal-00413602/document

Solving the Traffic and Flitter Challenges with Tulip

Abstract

Similar works

Full text

Available Versions

INRIA a CCSD electronic archive server