Soon Tee Teoh

Case study: Interactive visualization for Internet security

Internet connectivity is defined by a set of routing protocols which let the routers that comprise the Internet backbone choose the best route for a packet to reach its destination. One way to improve the security and performance of Internet is to routinely examine the routing data. In this case study, we show how interactive visualization of Border Gateway Protocol (BGP) data helps characterize routing behavior, identify weaknesses in connectivity which could potentially cripple the Internet, as well as detect and explain actual anomalous events.

Detecting flaws and intruders with visual data analysis

The task of sifting through large amounts of data to find useful information spawned the field of data mining. Most data mining approaches are based on machine-learning techniques, numerical analysis, or statistical modeling. They use human interaction and visualization only minimally. Such automatic methods can miss some important features of the data. Incorporating human perception into the data mining process through interactive visualization can help us better understand the complex behaviors of computer network systems. This article describes visual-analytics-based solutions and outlines a visual exploration process for log analysis. Three log-file analysis applications demonstrate our approachs effectiveness in discovering flaws and intruders in network systems.

RINGS: A Technique for Visualizing Large Hierarchies

We present RINGS, a technique for visualizing large trees. We introduce a new ringed circular layout of nodes to make more efficient use of limited display space. RINGS provides the user with the means to specify areas of primary andsecond ary focus, andis able to show multiple foci without compromising understanding of the graph. The strength of RINGS is its ability to show more area in focus andmore contextual information than existing techniques. We demonstrate the effectiveness of RINGS by applying it to the visualization of a Unix file directory.

Combining visual and automated data mining for near-real-time anomaly detection and analysis in BGP

The security of Internet routing is a major concern because attacks and errors can result in data packets not reaching their intended destination and/or falling into the wrong hands. A key step in improving routing security is to analyze and understand it. In the past, we and other researchers have presented various visual-based, statistical-based, and signature-based methods of analyzing Internet routing data. In this paper, we describe an integration of visual and automated data mining methods for discovering and investigating anomalies in Internet routing. We show how these different components are combined in such a way as to complement each other, creating a very effective and useful analysis tool. In addition to performing analysis on archived data, our system is able to collect, process and visualize data in near-real-time.

PaintingClass: interactive construction, visualization and exploration of decision trees

Decision trees are commonly used for classification. We propose to use decision trees not just for classification but also for the wider purpose of knowledge discovery, because visualizing the decision tree can reveal much valuable information in the data. We introduce PaintingClass, a system for interactive construction, visualization and exploration of decision trees. PaintingClass provides an intuitive layout and convenient navigation of the decision tree. PaintingClass also provides the user the means to interactively construct the decision tree. Each node in the decision tree is displayed as a visual projection of the data. Through actual examples and comparison with other classification methods, we show that the user can effectively use PaintingClass to construct a decision tree and explore the decision tree to gain additional knowledge.

A visual exploration process for the analysis of Internet routing data

The Internet pervades many aspects of our lives and is becoming indispensable to critical functions in areas such as commerce, government, production and general information dissemination. To maintain the stability and efficiency of the Internet, every effort must be made to protect it against various forms of attacks, malicious users, and errors. A key component in the Internet security effort is the routine examination of Internet routing data, which unfortunately can be too large and complicated to browse directly. We have developed an interactive visualization process which proves to be very effective for the analysis of Internet routing data. In this application paper, we show how each step in the visualization process helps direct the analysis and glean insights from the data. These insights include the discovery of patterns, detection of faults and abnormal events, understanding of event correlations, formation of causation hypotheses, and classification of anomalies. We also discuss lessons learned in our visual analysis study.

BGP eye: a new visualization tool for real-time detection and analysis of BGP anomalies

Owing to the inter-domain aspects of BGP routing, it is difficult to correlate information across multiple domains in order to analyze the root cause of the routing outages. We present BGP Eye, a tool for visualization-aided root-cause analysis of BGP anomalies. In contrast to previous approaches, BGP Eye performs real-time analysis of BGP anomalies through hierarchical analysis. First, BGP updates are clustered to obtain BGP events that are more representative of an anomaly. These events are then correlated across all border routers to ascertain the extent of the anomaly. Furthermore, BGP Eye provides both the capability to analyze BGP anomalies from an Internet-Centric View through multiple vantage points as well as from a Home-Centric View of a particular Autonomous System. We present the capability for scalable and real-time root-cause analysis provided by BGP Eye through the analysis of two very different anomalies. First, we provide an Internet-Centric view from AS568 of the routing outages during the spread of the Slammer Worm on January 25th, 2003. Second, we provide a Home-Centric view from AS6458 of the routing outages caused by the inadvertent prefix hijacking by AS9121 on December 24th, 2004.

Evaluating the effectiveness of tree visualization systems for knowledge discovery

User studies, evaluations, and comparisons of tree visualization systems have so far focused on questions that can readily be answered by simple, automated queries without needing visualization. Studies are lacking on the actual use of tree visualization in discovering intrinsic, hidden, non-trivial and potentially valuable knowledge. We have thus formulated a set of tree exploration tasks not previously considered and have performed user studies and analysis to determine how visualization helps users to perform these tasks. In our study, we evaluated three systems: RINGS (a node-link representation), Treemap (a containment representation), and Windows Explorer. Our findings suggest a few ways that tree visualization helps users to perceive different aspects of hierarchical structured information. We then explain how these visual representations are able to trigger human perception to make these discoveries.

Generalized descriptions for the procedural modeling of ancient East Asian buildings

Many ancient East Asian buildings are noted for their immense beauty and intricate design. We introduce a graphics modeling library based on a generalized procedural description we formulated to describe East Asian architecture. By setting the desired parameters, a user can create a building in any of the many different styles, such as Chinese, Japanese or Korean. Different building types, such as palace halls, commoner houses, temples, pagodas, pavilions, ceremonial gates and fences, are described by our modeling system. This large range of traditional East Asian styles and structures is significantly more than those supported by existing systems.

RiverLand: An Efficient Procedural Modeling System for Creating Realistic-Looking Terrains

Generating realistic-looking but interesting terrains quickly is a great challenge. We present RiverLand, an efficient system for terrain synthesis. RiverLand creates a realistic-looking terrain by first generating river networks over the land. Then, the terrain is created to be consistent with the river networks. In this way, the terrains created have a proper drainage basin, an important feature lacking in many existing procedural terrain methods. The terrains generated by RiverLand are also widely varied, with rolling hills, river valleys, alpine mountains, and rocky cliffs, all seamlessly connected in the same terrain. Since RiverLand does not use complex fluid simulations, it is fast, and yet is able to produce many of the erosion features generated by the simulation methods.