Markus Wagner

A Survey of Visualization Systems for Malware Analysis

Due to the increasing threat from malicious software (malware), monitoring of vulnerable systems is becoming increasingly important. The need to log and analyze activity encompasses networks, individual computers, as well as mobile devices. While there are various automatic approaches and techniques available to detect, identify, or capture malware, the actual analysis of the ever-increasing number of suspicious samples is a time-consuming process for malware analysts. The use of visualization and highly interactive visual analytics systems can help to support this analysis process with respect to investigation, comparison, and summarization of malware samples. Currently, there is no survey available that reviews available visualization systems supporting this important and emerging field. We provide a systematic overview and categorization of malware visualization systems from the perspective of visual analytics. Additionally, we identify and evaluate data providers and commercial tools that produce meaningful input data for the reviewed malware visualization systems. This helps to reveal data types that are currently underrepresented, enabling new research opportunities in the visualization community.

Task Cube: A three-dimensional conceptual space of user tasks in visualization design and evaluation

User tasks play a pivotal role in visualization design and evaluation. However, the term ‘task’ is used ambiguously within the visualization community. In this article, we critically analyze the relevant literature and systematically compare definitions of ‘task’ and the usage of related terminology. In doing so, we identify a three-dimensional conceptual space of user tasks in visualization, referred to as the task cube, and the more precise concepts ‘objective’ and ‘action’ for tasks. We illustrate the usage of the task cube’s dimensions in an objective-driven visualization process, in different scenarios of visualization design and evaluation, and for comparing categorizations of abstract tasks. Thus, visualization researchers can better formulate their contributions which helps advance visualization as a whole.

Problem characterization and abstraction for visual analytics in behavior-based malware pattern analysis

Behavior-based analysis of emerging malware families involves finding suspicious patterns in large collections of execution traces. This activity cannot be automated for previously unknown malware families and thus malware analysts would benefit greatly from integrating visual analytics methods in their process. However existing approaches are limited to fairly static representations of data and there is no systematic characterization and abstraction of this problem domain. Therefore we performed a systematic literature study, conducted a focus group as well as semi-structured interviews with 10 malware analysts to elicit a problem abstraction along the lines of data, users, and tasks. The requirements emerging from this work can serve as basis for future design proposals to visual analytics-supported malware pattern analysis.

Evaluating Information Visualization on Mobile Devices: Gaps and Challenges in the Empirical Evaluation Design Space

With their increasingly widespread use, mobile devices have become a highly relevant target environment for Information Visualization. However, far too little attention has been paid to evaluation of interactive visualization techniques on mobile devices. To fill this gap, this paper provides a structured overview of the commonly used evaluation approaches for mobile visualization. For this, it systematically reviews the scientific literature of major InfoVis and HCI venues and categorizes the relevant work based on six dimensions circumscribing the design and evaluation space for visualization on mobile devices. Based on the 21 evaluations reviewed, reproducibility, device variety and usage environment surface as the three main issues in evaluation of information visualization on mobile devices. To overcome these issues, we argue for a transparent description of all research aspects and propose to focus more on context of usage and technology.

Visual Analytics of Electronic Health Records with a Focus on Time

Visual Analytics is a field of computer science that deals with methods to perform data analysis using both computer-based methods and human judgment facilitated by direct interaction with visual representations of data. Electronic health record systems that apply Visual Analytics methods have the potential to provide healthcare stakeholders with much-needed cognitive support in exploring and querying records. This chapter presents Visual Analytics projects addressing five particular challenges of electronic health records: (1) The complexity of time-oriented data constitutes a cross-cutting challenge so that all projects need to consider design aspects of time-oriented data in one way or another. (2) As electronic health records encompass patient conditions and treatment, they are inherently heterogeneous data. (3) Scaling from single patients to cohorts requires approaches for relative time, space efficiency, and aggregation. (4) Data quality and uncertainty are common issues that need to be considered in real-world projects. (5) A user-centered design process and suitable interaction techniques are another cross-cutting challenge for each and every Visual Analytics project.

Visualizing Text Data in Space and Time to Augment a Political News Broadcast on a Second Screen.

While second screen scenarios – that is, simultaneously using a phone, tablet or laptop while watching TV or a recorded broadcast are finding their ways into the homes of millions of people, our understanding of how to properly design them is still very limited. We envision this design space and investigate how interactive data visualization can be leveraged in a second screen context. In this paper, we present the design process of a tablet application visualizing content from the stenographic minutes of the Austrian National Council.

SEQUIN: a grammar inference framework for analyzing malicious system behavior

Targeted attacks on IT systems are a rising threat to the confidentiality of sensitive data and the availability of critical systems. The emergence of Advanced Persistent Threats (APTs) made it paramount to fully understand the particulars of such attacks in order to improve or devise effective defense mechanisms. Grammar inference paired with visual analytics (VA) techniques offers a powerful foundation for the automated extraction of behavioral patterns from sequential event traces. To facilitate the interpretation and analysis of APTs, we present SEQUIN, a grammar inference system based on the Sequitur compression algorithm that constructs a context-free grammar (CFG) from string-based input data. In addition to recursive rule extraction, we expanded the procedure through automated assessment routines capable of dealing with multiple input sources and types. This automated assessment enables the accurate identification of interesting frequent or anomalous patterns in sequential corpora of arbitrary quantity and origin. On the formal side, we extended the CFG with attributes that help describe the extracted (malicious) actions. Discovery-focused pattern visualization of the output is provided by our dedicated KAMAS VA prototype.

PubViz: Lightweight Visual Presentation of Publication Data.

Publications play a central role in presenting the outcome of scientific research but are typically presented as textual lists, whereas related work in visualization of publication focuses on exploration – not presentation. To bridge this gap, we conducted a design study of an interactive visual representation of publication data in a BibTeX file. This paper reports our domain and problem characterization as well as our visualization design decisions in light of our user-centered design process including interviews, two user studies with a paper prototype and a d3.js prototype, and practical application at our group’s website.