In this article, we present a visual analytics system, SemanticPrism, which aims to analyze large-scale high-dimensional cyber security datasets containing logs of a million computers. SemanticPrism visualizes the data from three different perspectives: spatiotemporal distribution, overall temporal trends, and pixel-based IP (Internet Protocol) address blocks. With each perspective, we use semantic zooming to present more detailed information. The interlinked visualizations and multiple levels of detail allow us to detect unexpected changes taking place in different dimensions of the data and to identify potential anomalies in the network. After comparing our approach to other submissions, we outline potential paths for future improvement.
FuaY-HWardMORundensteinerEA. Hierarchical parallel coordinates for exploration of large datasets. In: Proceedings of the conference on Visualization ’99: celebrating ten years, 24–29 October 1999, pp.43–50. Los Alamitos, CA: IEEE Computer Society Press.
3.
KeimDA. Designing pixel-oriented visualization techniques: theory and applications. IEEE T Vis Comput Gr2000; 6(1): 59–78.
4.
OelkeDJanetzkoHSimonS. Visual boosting in pixel-based visualizations. Computer Graphics Forum2011;30(3):871–880.
5.
KeimDAPanseCSipsM. Pixelmaps: A new visual data mining approach for analyzing large spatial data sets. In: Proceedings of the Third IEEE International Conference on Data Mining. 19–22 November 2003, pp. 565–568. Melbourne, FL: IEEE Computer Society Press.
6.
GuoDChenJMacEachrenAM. A visualization system for space-time and multivariate patterns (VIS-STAMP). IEEE T Vis Comput Gr2006; 12(6): 1461–1474.
7.
KeimDAPanseCSipsM. Information visualization: Scope, techniques and opportunities for geovisualization. In: Exploring Geovisualization (eds DykesJMaceachrenAKraakM), Oxford, UK.: Elsevier; 2005, pp.23–52.
8.
ZhangLStoffelABehrischM. Visual analytics for the big data era—a comparative review of state-of-the-art commercial systems. In: Proceedings of IEEE symposium on visual analytics science and technology, 14–19 October 2012, pp. 173–182. Seattle, WA: IEEE Computer Society Press.
9.
BedersonBBHollanJD. Pad++: A zooming graphical interface for exploring alternate interface physics. In: Proceedings of the 7th annual ACM symposium on User interface software and technology, 2–4 November 1994, pp. 17–26. Marina Del Rey, CA: ACM Press.
10.
PerlinKFoxD. Pad: An alternative approach to the computer interface. In: Proceedings of the 20th annual conference on computer graphics and interactive techniques, 2-6 August 1993, pp. 57–64. Anaheim, CA: ACM Press.
11.
WeaverC. Building highly-coordinated visualizations in improvise. In: IEEE Symposium on Information Visualization (INFOVIS 2004). 10–12 October 2004, pp.159–166. Austin, TX: IEEE Computer Society Press.
12.
ContiGGrizzardJAhamadM. Visual exploration of malicious network objects using semantic zoom, interactive encoding and dynamic queries. In: Visualization for Computer Security, 2005.(VizSEC 05), IEEE Workshop on. 26 October 2005, pp. 83–90. Minneapolis, MN: IEEE Computer Society Press.
13.
WoodruffAOlstonCAikenA. DataSplash: a direct manipulation environment for programming semantic zoom visualizations of tabular data. J Visual Lang Comput2001; 12(5): 551–571.
14.
BeckerRAEickSGWilksAR. Visualizing network data. IEEE T Vis Comput Gr1995; 1(1): 16–28.
15.
BoschettiASalgarelliLMuelderC. TVi: A visual querying system for network monitoring and anomaly detection. In: Proceedings of the 8th International Symposium on Visualization for Cyber Security. 20 July 2011, pp. 1. Pittsburgh, PA: ACM Press.
16.
IliofotouMPappuPFaloutsosM. Network monitoring using traffic dispersion graphs (tdgs). In: Proceedings of the 7th ACM SIGCOMM conference on Internet measurement. 24–26 October 2007, pp. 315–320. San Diego, CA: ACM Press.
17.
EadesP. A heuristic for graph drawing. Congr Numer1984; 42: 149–160.
18.
BallRFinkGANorthC. Home-centric visualization of network traffic for security administration. In: Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security. 25–29 October 2004, pp. 55–64. Washington, DC: ACM Press
19.
YinXYurcikWTreasterM. VisFlowConnect: Netflow visualizations of link relationships for security situational awareness. In: Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, 25–29 October 2004 pp. 26–34. Washington, DC: ACM Press.
20.
MuelderCMaKLBartolettiT. A visualization methodology for characterization of network scans. In: Visualization for Computer Security, 2005.(VizSEC 05). IEEE Workshop on, 26 October 2005, pp. 29–38. Minneapolis, MN: IEEE Computer Society Press.
21.
MansmannFMeierLKeimD. Graph-based monitoring of host behavior for network security. In: Visualization for Computer Security, 2007.(VizSEC 07). IEEE Workshop on. 29 October 2007, pp. 187–202. Sacramento, CA: Springer.
22.
BorgoRProctorKChenM. Evaluating the impact of task demands and block resolution on the effectiveness of pixel-based visualization. IEEE T Vis Comput Gr2010; 16(6): 963–972.
23.
ZieglerHNietzschmannTKeimDA. Visual analytics on the financial market: Pixel-based analysis and comparison of long-term investments. In: Information Visualisation, 2008. IV’08. 12th International Conference. 8–11 July 2008, pp. 287–295. London, UK: IEEE Computer Society Press.
24.
KoSMaciejewskiRJangY. MarketAnalyzer: An interactive visual analytics system for analyzing competitive advantage using point of sale data. Computer Graphics Forum. 2012;31(3):1245–1254.
25.
PanseCSipsMKeimD. Visualization of geo-spatial point sets via global shape transformation and local pixel placement. IEEE T Vis Comput Gr2006; 12(5): 749–756.
26.
MacEachrenAMKraakMJ. Research challenges in geovisualization. Cartogr Geogr Inf Sci2001; 28(1): 3–12.
27.
MalikAMaciejewskiRCollinsTF. Visual analytics law enforcement toolkit. In: Technologies for Homeland Security (HST), 2010 IEEE International Conference on, 8–10 November 2010, pp. 222–228. Waltham, MA: IEEE Xplore.
28.
SopanANohASIKarolS. Community health map: A geospatial and multivariate data visualization tool for public health datasets. Government Information Quarterly2012; 29(2):223–234.
29.
PodnarHGschwenderAWorkmanR. Geospatial visualization of student population using Google™ Maps. J Comput Sci Coll2006; 21(6): 175–181.
30.
CoddEFCoddSBSalleyCT. Providing OLAP (On-Line Analytical Processing) to User Analysts: An IT Mandate. White Paper, EF Codd & Associates, 1993.
EpanechnikovVA. Non-parametric estimation of a multivariate probability density. Theor Probab Appl1969; 14(1): 153–158.
33.
SimonHA. The sciences of the artificial. 3rd ed.Cambridge, MA: MIT Press, 1996.
34.
HoffmanJESubramaniamB. The role of visual attention in saccadic eye movements. Atten Percept Psycho1995; 57(6): 787–795.
35.
ShneidermanB. The eyes have it: A task by data type taxonomy for information visualizations. In: Proceedings of IEEE symposium on visual languages, 3–6 September 1996, pp. 336–343. Boulder, CO: IEEE Xplore.
36.
JavedWElmqvistN. Stack zooming for multi-focus interaction in time-series data visualization. In: Pacific Visualization Symposium (PacificVis), 2010 IEEE, 2–5 March 2010, pp. 33–40. Taipei, Taiwan: IEEE Xplore.
37.
ChoudurySKodagodaNNguyenP. M-Sieve: A visualisation tool for supporting network security analysts. In: Vast 2012 MC1 Award: “Subject Matter Expert’s Award, 14–19 October 2012, pp. 165–166. Seattle, WA: IEEE Society.
38.
ChenYVQianZCZhangL. Mobile analymator: Animating data changes on mobile devices. In: Proceedings of IEEE Conference on Visual Analytics Sciences and Technology, 23–28 October 2011, pp. 311–312. Providence, RI: IEEE Society.
39.
ShneidermanB. Designing the user interface: strategies for effective human-computer interaction. Boston, MA: Addison Wesley, 1986.
40.
DudasLFeketeZGobolos-SzaboJ. OWLAP - using OLAP approach in anomaly detection. In: IEEE Conference on Visual Analytics Science and Technology. 14–19 October 2012, pp. 167–168. Seattle, WA: IEEE Society.
41.
KachkaevADillinghamIBeechamR. Monitoring the health of computer networks with visualization. In: IEEE conference on visual analytics science and technology, 2012, pp. 169–170. Seattle, WA: IEEE Society.
42.
RobertP. Business forensics HQ. VAST challenge MC1 award: “Good Visualization”. In: IEEE Conference on Visual Analytics Science and Technology. 14–19 October 2012, pp. 161–162. Seattle, WA: IEEE Society.
43.
CookKAGrinsteinGWhitingM. VAST challenge 2012: Visual analytics for big data. In: IEEE Conference on Visual Analytics Science and Technology. 14–19 October 2012, pp. 151–155. Seattle, WA: IEEE Society.
