K-means clustering is widely used, but its iterative and initialization-sensitive nature makes results hard to interpret, compare, and debug, especially when multiple runs are needed to obtain a reliable solution. This paper presents VISPEK, a visual interactive system for progressive ensemble k-means clustering that helps users understand how clustering results evolve and how agreement emerges across runs. By combining Progressive Visual Analytics with an ensemble-based strategy, VISPEK exposes intermediate results, stability and quality metrics, and similarities among runs, enabling users to inspect, explain, and steer the clustering process before convergence. In this way, VISPEK supports the interpretation of consensus formation, highlights uncertainty, and helps users identify promising results early. We validate the approach through two usage scenarios and an expert study with data science and machine learning experts, showing that VISPEK improves analysis transparency while reducing time and computational effort.

Abstract Differential gene expression (DGE) analysis is one of the most widely used techniques for investigating RNA‐seq data and supports numerous medical and biological applications, including biomarker identification for diagnosis and prognosis, as well as the evaluation of medical treatments. However, performing DGE analysis typically requires navigating a complex multistep pipeline and proficiency in programming languages such as R. This poses a barrier for researchers ‐‐‐ including biologists and clinicians ‐‐‐ who may lack coding expertise, and adds overhead for experienced bioinformaticians. To address these challenges, we propose a workflow‐driven visual analytics approach for DGE analysis that integrates state‐of‐the‐art methodologies and supports interactive exploration of gene expression data through a guided step‐by‐step process. Building on this workflow, we developed GEVIS, a visual analytics system that enables users to conduct DGE analysis without writing code, thereby reducing analytical overhead and making the process more accessible to a broader audience. Both the workflow and the GEVIS system have been validated by experts in bioinformatics and demonstrated through a use case.

Declarative process models allow us to capture the behavior of a business process through temporal constraints on the evolution of process activities. In process mining, declarative process discovery focuses on deriving these constraints from event logs. Although the semantic aspects of declarative processes have been extensively investigated, there has been less focus on designing declarative visual notations that enhance model understanding and support analysts in solving process mining tasks. To improve the human understandability of declarative process models, in this paper, we present easyDeclare , a novel visual notation to specify declarative process models using the Declare language. easyDeclare was developed with consideration of the well-established Moody’s design principles. We conducted extensive user experiments to demonstrate that easyDeclare , when compared with the original graphical representation of Declare , reduces the cognitive load required to interpret Declare models of increasing complexity, making it a promising alternative to enhancing overall comprehension of declarative process discovery tasks.

Machine learning techniques are a driving force for research in various fields, from credit card fraud detection to stock analysis. Recently, a growing interest in increasing human involvement has emerged, with the primary goal of improving the interpretability of machine learning models. Among different techniques, Partial Dependence Plots (PDP) represent one of the main model-agnostic approaches for interpreting how the features influence the prediction of a machine learning model. However, its limitations (i.e., visual interpretation, aggregation of heterogeneous effects, inaccuracy, and computability) could complicate or misdirect the analysis. Moreover, the resulting combinatorial space can be challenging to explore both computationally and cognitively when analyzing the effects of more features at the same time. This paper proposes a conceptual framework that enables effective analysis workflows, mitigating state-of-the-art limitations. The proposed framework allows for exploring and refining computed partial dependences, observing incrementally accurate results, and steering the computation of new partial dependences on user-selected subspaces of the combinatorial and intractable space. With this approach, the user can save both computational and cognitive costs, in contrast with the standard monolithic approach that computes all the possible combinations of features on all their domains in batch. The framework is the result of a careful design process involving experts' knowledge during its validation and informed the development of a prototype, W4SP (available athttps://aware-diag-sapienza.github.io/W4SP/), that demonstrates its applicability traversing its different paths. A case study shows the advantages of the proposed approach.

Abstract The use and creation of machine‐learning‐based solutions to solve problems or reduce their computational costs are becoming increasingly widespread in many domains. Deep Learning plays a large part in this growth. However, it has drawbacks such as a lack of explainability and behaving as a black‐box model. During the last few years, Visual Analytics has provided several proposals to cope with these drawbacks, supporting the emerging eXplainable Deep Learning field. This survey aims to (i) systematically report the contributions of Visual Analytics for eXplainable Deep Learning; (ii) spot gaps and challenges; (iii) serve as an anthology of visual analytical solutions ready to be exploited and put into operation by the Deep Learning community (architects, trainers and end users) and (iv) prove the degree of maturity, ease of integration and results for specific domains. The survey concludes by identifying future research challenges and bridging activities that are helpful to strengthen the role of Visual Analytics as effective support for eXplainable Deep Learning and to foster the adoption of Visual Analytics solutions in the eXplainable Deep Learning community. An interactive explorable version of this survey is available online at https://aware‐diag‐sapienza.github.io/VA4XDL .

RadViz contributes to multidimensional analysis by using 2D points for encoding data elements and interpreting them along the original data dimensions. For these characteristics it is used in different application domains, like clustering, anomaly detection, and software visualization. However, it is likely that using the dimension arrangement that comes with the data will produce a plot that leads users to make inaccurate conclusions about points values and data distribution. This article attacks this problem without altering the original RadViz design: It defines, for both a single point and a set of points, the metric of effectiveness error, and uses it to define the objective function of a dimension arrangement strategy, arguing that minimizing it increases the overall RadViz visual quality. This article investigated the intuition that reducing the effectiveness error is beneficial for other well-known RadViz problems, like points clumping toward the center, many-to-one plotting of non-proportional points, and cluster separation. It presents an algorithm that reduces to zero the effectiveness error for a single point and a heuristic that approximates the dimension arrangement minimizing the effectiveness error for an arbitrary set of points. A set of experiments based on 21 real datasets has been performed, with the goals of analyzing the advantages of reducing the effectiveness error, comparing the proposed dimension arrangement strategy with other related proposals, and investigating the heuristic accuracy. The Effectiveness Error metric, the algorithm, and the heuristic presented in this article have been made available in a d3.js plugin at https://aware-diag-sapienza.github.io/d3-radviz.

Analyzing and mitigating the threats that cyber-attacks pose on the services of a critical infrastructure is not a trivial activity. Research solutions have been developed using data about the devices used for implementing the services, services dependencies, network topology, and the vulnerabilities that can be exploited to attack the network. However, most of the proposed solutions fail to consider these aspects in an integrated fashion, allowing the user to understand global dependencies and weaknesses. This paper contributes this issue with BUCEPHALUS, a Visual Analytics solution providing a) a visual overview of the existing relationships among business functions, devices, and vulnerabilities, and b) a what-if analysis scenario, in which the user is supported on making decisions on which vulnerabilities are more appropriate to fix. BUCEPHALUS has been developed and validated within a user-centered design process involving security professionals.

Filtering is one of the basic interaction techniques in Information Visualization, with the main objective of limiting the amount of displayed information using constraints on attribute values. Research focused on direct manipulation selection means or on simple interactors like sliders or check-boxes: while the interaction with a single attribute is, in principle, straightforward, getting an understanding of the relationship between multiple attribute constraints and the actual selection might be a complex task. To cope with this problem, usually referred as cross-filtering, the paper provides a general definition of the structure of a filter, based on domain values and data distribution, the identification of visual feedbacks on the relationship between filters status and the current selection, and guidance means to help in fulfilling the requested selection. Then, leveraging on the definition of these design elements, the paper proposes CrossWidgets, modular attribute selectors that provide the user with feedback and guidance during complex interaction with multiple attributes. An initial controlled experiment demonstrates the benefits that CrossWidgets provide to cross-filtering activities.

Modern software systems require the support of automatic program analyses to answer questions about their correctness, reliability, and safety. In recent years, symbolic execution techniques have played a pivotal role in this field, backing research in different domains such as software testing and software security. Like other powerful machine analyses, symbolic execution is often affected by efficiency and scalability issues that can be mitigated when a domain expert interacts with its working, steering the computation to achieve the desired goals faster. In this paper we explore how visual analytics techniques can help the user to grasp properties of the ongoing analysis and use such insights to refine the symbolic exploration process. To this end, we discuss two real-world usage scenarios from the malware analysis and the vulnerability detection domains, showing how our prototype system can help users make a wiser use of symbolic exploration techniques in the analysis of binary code.

Vulnerabilities represent one of the main weaknesses of IT systems and the availability of consolidated official data, like CVE (Common Vulnerabilities and Exposures), allows for using them to compute the paths an attacker is likely to follow. However, even if patches are available, business constraints or lack of resources create obstacles to their straightforward application. As a consequence, the security manager of a network needs to deal with a large number of vulnerabilities, making decisions on how to cope with them. This paper presents VULNUS (VULNerabilities visUal aSsessment), a visual analytics solution for dynamically inspecting the vulnerabilities spread on networks, allowing for a quick understanding of the network status and visually classifying nodes according to their vulnerabilities. Moreover, VULNUS computes the approximated optimal sequence of patches able to eliminate all the attack paths and allows for exploring sub-optimal patching strategies, simulating the effect of removing one or more vulnerabilities. VULNUS has been evaluated by domain experts using a lab-test experiment, investigating the effectiveness and efficiency of the proposed solution.

In the last years, several standards and frameworks have been developed to help organizations to increase the security of their Information Technology (IT) systems. In order to deal with the continuous evolution of the cyber-attacks complexity, such solutions have to cope with an overwhelming set of concepts, and are perceived as complex and hard to implement. The exploration of the cyber-security state of an organization can be made more effective and proficient if supported by the right level of automation. This paper presents the implementation of a visual analytics solution, called CybeR secUrity fraMework BrowSer (CRUMBS) [2], targeted at dealing with the Italian Adaptation of the Cyber Security Framework (IACSF), derived by the National Institute of Standards and Technology (NIST) proposal [1], adaptation that, in its full complexity, presents the security managers with hundreds of scattered concepts, like functions, categories, subcategories, priorities, maturity levels, current and target profiles, and controls, making its adoption a complex activity. The prototype is available at: http://awareserver.dis.uniroma1.it:11768/crumbs/.

This paper presents a system that prioritizes user actions according to the domain context and user preferences, in order to provide the adaptation process with a partial order of functionalities, useful to optimize the user interface with the main goal of minimizing screen usage and user interaction. The solution is instantiated in a smart home environment in the form of a smart user interface exploiting visual means to convey information. An user evaluation based on this use case is provided, confirming the benefits of the solution in terms of utility and easiness of usage.

Exploits based on ROP (Return-Oriented Programming) are increasingly present in advanced attack scenarios. Testing systems for ROP-based attacks can be valuable for improving the security and reliability of software. In this paper, we propose ROPMATE, the first Visual Analytics system specifically designed to assist human red team ROP exploit builders. In contrast, previous ROP tools typically require users to inspect a puzzle of hundreds or thousands of lines of textual information, making it a daunting task. ROPMATE presents builders with a clear interface of well-defined and semantically meaningful gadgets, i.e., fragments of code already present in the binary application that can be chained to form fully-functional exploits. The system supports incrementally building exploits by suggesting gadget candidates filtered according to constraints on preserved registers and accessed memory. Several visual aids are offered to identify suitable gadgets and assemble them into semantically correct chains. We report on a preliminary user study that shows how ROPMATE can assist users in building ROP chains.