Lane Harrison

cMotion: A New Game Design to Teach Emotion Recognition and Programming Logic to Children using Virtual Humans

This paper presents the design of the final stage of a new game currently in development, entitled cMotion, which will use virtual humans to teach emotion recognition and programming concepts to children. Having multiple facets, cMotion is designed to teach the intended users how to recognize facial expressions and manipulate an interactive virtual character using a visual drag-and-drop programming interface. By creating a game which contextualizes emotions, we hope to foster learning of both emotions in a cultural context and computer programming concepts in children. The game will be completed in three stages which will each be tested separately: a playable introduction which focuses on social skills and emotion recognition, an interactive interface which focuses on computer programming, and a full game which combines the first two stages into one activity.

Influencing visual judgment through affective priming

Recent research suggests that individual personality differences can influence performance with visualizations. In addition to stable personality traits, research in psychology has found that temporary changes in affect (emotion) can also significantly impact performance during cognitive tasks. In this paper, we show that affective priming also influences user performance on visual judgment tasks through an experiment that combines affective priming with longstanding graphical perception experiments. Our results suggest that affective priming can influence accuracy in common graphical perception tasks. We discuss possible explanations for these findings, and describe how these findings can be applied to design visualizations that are less (or more) susceptible to error in common visualization contexts.

The future of security visualization: Lessons from network visualization

Approaches in security visualization have made significant progress in addressing challenges in the ever changing landscape of network security. However, many approaches are limited in both scope and scale, especially when we consider the complexity of the complete security analysis process. In this article, we review several notable recent systems in security visualization, examining their relative strengths and limitations. We then show that recent research in general network visualization, which often deals with domains other than security, provides new visual metaphors and interaction techniques that will help address limitations in security visualization systems. We examine several of these network visualization approaches in detail, and discuss how they can be applied to meet the challenges of the next generation of security visualization systems.

Interactive detection of network anomalies via coordinated multiple views

This paper presents a new approach to intrusion detection that supports the identification and analysis of network anomalies using an interactive coordinated multiple views (CMV) mechanism. A CMV visualization consisting of a node-link diagram, scatterplot, and time histogram is described that allows interactive analysis from different perspectives, as some network anomalies can only be identified through joint features in the provided spaces. Spectral analysis methods are integrated to provide visual cues that allow identification of malicious nodes. An adjacency-based method is developed to generate the time histogram, which allows users to select time ranges in which suspicious activity occurs. Data from Sybil attacks in simulated wireless networks is used as the test bed for the system. The results and discussions demonstrate that intrusion detection can be achieved with a few iterations of CMV exploration. Quantitative results are collected on the accuracy of our approach and comparisons are made to single domain exploration and other high-dimensional projection methods. We believe that this approach can be extended to anomaly detection in general networks, particularly to Internet networks and social networks.

Comparing different levels of interaction constraints for deriving visual problem isomorphs

Interaction and manual manipulation have been shown in the cognitive science literature to play a critical role in problem solving. Given different types of interactions or constraints on interactions, a problem can appear to have different degrees of difficulty. While this relationship between interaction and problem solving has been well studied in the cognitive science literatures, the visual analytics community has yet to exploit this understanding for analytical problem solving. In this paper, we hypothesize that constraints on interactions and constraints encoded in visual representations can lead to strategies of varying effectiveness during problem solving. To test our hypothesis, we conducted a user study in which participants were given different levels of interaction constraints when solving a simple math game called Number Scrabble. Number Scrabble is known to have an optimal visual problem isomorph, and the goal of this study is to learn if and how the participants could derive the isomorph and to analyze the strategies that the participants utilize in solving the problem. Our results indicate that constraints on interactions do affect problem solving, and that while the optimal visual isomorph is difficult to derive, certain interaction constraints can lead to a higher chance of deriving the isomorph.

NV: Nessus vulnerability visualization for the web

Network vulnerability is a critical component of network security. Yet vulnerability analysis has received relatively little attention from the security visualization community. This paper describes nv, a web-based Nessus vulnerability visualization. Nv utilizes treemaps and linked histograms to allow security analysts and systems administrators to discover, analyze, and manage vulnerabilities on their networks. In addition to visualizing single Nessus scans, nv supports the analysis of sequential scans by showing which vulnerabilities have been fixed, remain open, or are newly discovered. Nv operates completely in-browser, to avoid sending sensitive data to outside servers. We discuss the design of nv, as well as provide case studies demonstrating vulnerability analysis workflows which include a multiple-node testbed and data from the 2011 VAST Challenge.

situ: Situational understanding and discovery for cyber attacks

Our entry into the VAST 2012 Mini Challenge 2 is a streaming visual analytic system that scores events based on anomalousness and maliciousness and presents each event to the user in a user-defined groupings in animated small-multiple views. The anomaly detection algorithm identifies low probability events, supporting awareness regarding atypical traffic patterns on the network. The maliciousness classifier incorporates both situated knowledge of an environment (policy and machine roles) and domain knowledge (encoded in the IDS alerts). We discuss the visualization design and classification techniques, as well as provide examples of timely detection from the challenge dataset.

Exploring the impact of emotion on visual judgement

Existing research suggests that individual personality differences can influence performance with visualizations. In addition to stable traits such as locus of control, research in psychology has found that temporary changes in affect (emotion) can significantly impact individual performance on cognitive tasks. We examine the relationship between fundamental visual judgement tasks and affect through a crowdsourced user study that combines affective-priming techniques from psychology with longstanding graphical perception experiments. Our results suggest that affective-priming can significantly influence accuracy in visual judgements, and that some chart types may be more affected than others.

User Studies of Principled Model Finder Output

Model-finders such as SAT-solvers are attractive for producing concrete models, either as sample instances or as counterexamples when properties fail. However, the generated model is arbitrary. To address this, several research efforts have proposed principled forms of output from model-finders. These include minimal and maximal models, unsat cores, and proof-based provenance of facts.

Guiding security analysis through visualization

We present a multiple views visualization for the security data in the VAST 2010 Mini Challenge 2. The visualization is used to monitor log event activity on the network log data included in the challenge. Interactions are provided that allow analysts to investigate suspicious activity and escalate events as needed. Additionally, a database application is used to allow SQL queries for more detailed investigation.