Chris Muelder

Proximity-based visualization of movement trace data

The increasing availability of motion sensors and video cameras in living spaces has made possible the analysis of motion patterns and collective behavior in a number of situations. The visualization of this movement data, however, remains a challenge. Although maintaining the actual layout of the data space is often desirable, direct visualization of movement traces becomes cluttered and confusing as the spatial distribution of traces may be disparate and uneven. We present proximity-based visualization as a novel approach to the visualization of movement traces in an abstract space rather than the given spatial layout. This abstract space is obtained by considering proximity data, which is computed as the distance between entities and some number of important locations. These important locations can range from a single fixed point, to a moving point, several points, or even the proximities between the entities themselves. This creates a continuum of proximity spaces, ranging from the fixed absolute reference frame to completely relative reference frames. By combining these abstracted views with the concrete spatial views, we provide a way to mentally map the abstract spaces back to the real space. We demonstrate the effectiveness of this approach, and its applicability to visual analytics problems such as hazard prevention, migration patterns, and behavioral studies.

A visualization methodology for characterization of network scans

Many methods have been developed for monitoring network traffic, both using visualization and statistics. Most of these methods focus on the detection of suspicious or malicious activities. But what they often fail to do refine and exercise measures that contribute to the characterization of such activities and their sources, once they are detected. In particular, many tools exist that detect network scans or visualize them at a high level, but not very many tools exist that are capable of categorizing and analyzing network scans. This paper presents a means of facilitating the process of characterization by using visualization and statistics techniques to analyze the patterns found in the timing of network scans through a method of continuous improvement in measures that serve to separate the components of interest in the characterization so the user can control separately for the effects of attack tool employed, performance characteristics of the attack platform, and the effects of network routing in the arrival patterns of hostile probes. The end result is a system that allows large numbers of network scans to be rapidly compared and subsequently identified.

Interactive visualization for network and port scan detection

Many times, network intrusion attempts begin with either a network scan, where a connection is attempted to every possible destination in a network, or a port scan, where a connection is attempted to each port on a given destination. Being able to detect such scans can help identify a more dangerous threat to a network. Several techniques exist to automatically detect scans, but these are mostly dependant on some threshold that an attacker could possibly avoid crossing. This paper presents a means to use visualization to detect scans interactively.

A hybrid space-filling and force-directed layout method for visualizing multiple-category graphs

Many graphs used in real-world applications consist of nodes belonging to more than one category. We call such graph “multiple-category graphs”. Social networks are typical examples of multiple-category graphs: nodes are persons, links are friendships, and categories are communities that the persons belong to. It is often helpful to visualize both connectivity and categories of the graphs simultaneously. In this paper, we present a new visualization technique for multiple-category graphs. The technique firstly constructs hierarchical clusters of the nodes based on both connectivity and categories. It then places the nodes by a new hybrid space-filling and force-directed layout algorithm to clearly display both connectivity and category information. We show layout results using our hybrid method and compare it with other methods, and present a case study using an active biological network dataset.

Rapid Graph Layout Using Space Filling Curves

Network data frequently arises in a wide variety of fields, and node-link diagrams are a very natural and intuitive representation of such data. In order for a node-link diagram to be effective, the nodes must be arranged well on the screen. While many graph layout algorithms exist for this purpose, they often have limitations such as high computational complexity or node colocation. This paper proposes a new approach to graph layout through the use of space filling curves which is very fast and guarantees that there will be no nodes that are colocated. The resulting layout is also aesthetic and satisfies several criteria for graph layout effectiveness.

Clustering, visualizing, and navigating for large dynamic graphs

In this paper, we present a new approach to exploring dynamic graphs. We have developed a new clustering algorithm for dynamic graphs which finds an ideal clustering for each time-step and links the clusters together. The resulting time-varying clusters are then used to define two visual representations. The first view is an overview that shows how clusters evolve over time and provides an interface to find and select interesting time-steps. The second view consists of a node link diagram of a selected time-step which uses the clustering to efficiently define the layout. By using the time-dependant clustering, we ensure the stability of our visualization and preserve user mental map by minimizing node motion, while simultaneously producing an ideal layout for each time step. Also, as the clustering is computed ahead of time, the second view updates in linear time which allows for interactivity even for graphs with upwards of tens of thousands of nodes.

A Treemap Based Method for Rapid Layout of Large Graphs

Abstract graphs or networks are a commonly recurring data type in many fields. In order to visualize such graphs effectively, the graph must be laid out on the screen coherently. Many algorithms exist to do this, but many of these algorithms tend to be very slow when the input graph is large. This paper presents a new approach to the large graph layout problem, which quickly generates an effective layout. This new method proceeds by generating a clustering hierarchy for the graph, applying a treemap to this hierarchy, and finally placing the graph vertices in their associated regions in the treemap. It is ideal for interactive systems where operations such as semantic zooming are to be performed, since most of the work is done in the initial hierarchy calculation, and it takes very little work to recalculate the layout. This method is also valuable in that the resulting layout can be used as the input to an iterative algorithm (e.g., a force directed method), which greatly reduces the number of iterations required to converge to a near optimal layout.

A Study of Layout, Rendering, and Interaction Methods for Immersive Graph Visualization

Information visualization has traditionally limited itself to 2D representations, primarily due to the prevalence of 2D displays and report formats. However, there has been a recent surge in popularity of consumer grade 3D displays and immersive head-mounted displays (HMDs). The ubiquity of such displays enables the possibility of immersive, stereoscopic visualization environments. While techniques that utilize such immersive environments have been explored extensively for spatial and scientific visualizations, contrastingly very little has been explored for information visualization. In this paper, we present our considerations of layout, rendering, and interaction methods for visualizing graphs in an immersive environment. We conducted a user study to evaluate our techniques compared to traditional 2D graph visualization. The results show that participants answered significantly faster with a fewer number of interactions using our techniques, especially for more difficult tasks. While the overall correctness rates are not significantly different, we found that participants gave significantly more correct answers using our techniques for larger graphs.

Interactive feature extraction and tracking by utilizing region coherency

The ability to extract and follow time-varying flow features in volume data generated from large-scale numerical simulations enables scientists to effectively see and validate modeled phenomena and processes. Extracted features often take much less storage space and computing resources to visualize. Most feature extraction and tracking methods first identify features of interest in each time step independently, then correspond these features in consecutive time steps of the data. Since these methods handle each time step separately, they do not use the coherency of the feature along the time dimension in the extraction process. In this paper, we present a prediction-correction method that uses a prediction step to make the best guess of the feature region in the subsequent time step, followed by growing and shrinking the border of the predicted region to coherently extract the actual feature of interest. This method makes use of the temporal-space coherency of the data to accelerate the extraction process while implicitly solving the tedious correspondence problem that previous methods focus on. Our method is low cost with very little storage overhead, and thus facilitates interactive or runtime extraction and visualization, unlike previous methods which were largely suited for batch-mode processing due to high computational cost.

TVi: a visual querying system for network monitoring and anomaly detection

Monitoring, anomaly detection and forensics are essential tasks that must be carried out routinely for every computer network. The sheer volume of data generated by conventional anomaly detection tools such as Snort often makes it difficult to explain the nature of an attack and track down its source. In this paper we present TVi, a tool that combines multiple visual representations of network traces carefully designed and tightly coupled to support different levels of visual-based querying and reasoning required for making sense of complex traffic data. TVi allows analysts to visualize data starting at a high level, providing information related to the entire network, and easily move all the way down to a very low level, providing detailed information about selected hosts, anomalies and attack paths. We designed TVi with scalability and extensibility in mind: its DBMS foundations make it scalable with virtually no limitations, and other state-of-the-art IDS, like Snort or Bro, can be easily integrated in our tool. We demonstrate with two case studies, a synthetic dataset (DARPA 1999) and a real one (University of Brescia, UniBS, 2009), how TVi can enhance a network administrators ability to reveal hidden patterns in network traces and link their key information so as to easily reveal details that by merely observing Snorts output would go unnoticed. We make TVis source code available to the community under an Open Source license.