Movement data sets collected using today's advanced tracking devices consist of complex trajectories in terms of length, shape, and number of recorded positions. Multiple additional attributes characterizing the movement and its environment are often also included making the level of complexity even higher. Simplification of trajectories can improve the visibility of relevant information by reducing less relevant details while maintaining important movement patterns. We propose a systematic stepwise methodology for simplifying and thematically enhancing trajectories in order to support their visual analysis. The methodology is applied iteratively and is composed of: (a) a simplification step applied to reduce the morphological complexity of the trajectories, (b) a thematic enhancement step which aims at accentuating patterns of movement, and (c) the representation and interactive exploration of the results in order to make interpretations of the findings and further refinement to the simplification and enhancement process. We illustrate our methodology through an analysis example of two different types of tracks, aircraft and pedestrian movement.

We present the results of a controlled experiment to investigate the performance of different temporal glyph designs in a small multiple setting. Analyzing many time series at once is a common yet difficult task in many domains, for example in network monitoring. Several visualization techniques have, thus, been proposed in the literature. Among these, iconic displays or glyphs are an appropriate choice because of their expressiveness and effective use of screen space. Through a controlled experiment, we compare the performance of four glyphs that use different combinations of visual variables to encode two properties of temporal data: a) the position of a data point in time and b) the quantitative value of this data point. Our results show that depending on tasks and data density, the chosen glyphs performed differently. Line Glyphs are generally a good choice for peak and trend detection tasks but radial encodings are more effective for reading values at specific temporal locations. From our qualitative analysis we also contribute implications for designing temporal glyphs for small multiple settings.

Colorpleth maps are commonly used to display election results, either by using one distinct color for representing the winning party in each district or by showing a proportion between two parties on a bi-polar colormap, for example, from red to blue representing Republicans vs. Democrats. Showing only the largest party may disable insights into the data whereas using bipolar colormaps works only reasonably well in cases of two parties. To overcome these limitations we introduce a new technique for visualizing proportions in such categorical data. In particular, we combine bipolar colormaps with an adapted double-rendering of polygons to simultaneously visually represent the first two categories and the spatial location. Our technique enables the recognition of close election results as well as clear majorities in a scalable manner. We proof our concept by applying our technique in a prototype implementation used to display election results from the U. S. Presidential election in 2008 and elections of the German Bundestag in 2005 and 2009. Different interesting findings are presented, which would not be recognizable when visualizing only the winner. As we additionally represent the party with the second most votes, we are able to show changes in the spatial distribution of the votes as well as outlier regions with exceptional results. Our visualization technique therefore enables valuable insights into categorical data with a spatial reference.

Routing in the Internet is vulnerable to attacks due to the insecure design of the border gateway protocol (BGP). One possible exploitation of this insecure design is the hijacking of IP blocks. Such hijacked IP blocks can then be used to conduct malicious activities from seemingly legitimate IP addresses. In this study we actively trace and monitor the routes to spam sources over several consecutive days after having received a spam message from such a source. However, the real challenge is to distinguish between legitimate routing changes and those ones that are related to systematic misuse in so-called spam campaigns. To combine the strengths of human judgement and computational efficiency, we thus present a novel visual analytics tool named Vistracer in this paper. This tool represents analysis results of our anomaly detection algorithms on large traceroute data sets with the help of several scalable representations to support the analyst to explore, identify and analyze suspicious events and their relations to malicious activities. In particular, pixel-based visualization techniques, novel glyph-based summary representations and a combination of temporal glyphs in a graph representation are used to give an overview of route changes to specific destinations over time. To evaluate our tool, real-world case studies demonstrate the usage of Vistracer in practice on large-scale data sets.

Firewalls have become essential components in the security concept of almost any modern computer network. Due to their relevance and central location in the network, their programming logic often survives several generations of administrators and hardware. Understanding the logic behind a firewall configuration is thus an important but challenging task for a network administrator. In general, there is a tendency to add new rules while old rules are only rarely changed or removed due to unexpected consequences in the network. In this paper we present a visualization tool to support the network administrator in this complex task of understanding firewall rule sets and object group definitions. The tool consists of a hierarchical sunburst visualization, which logically groups rules or object groups according to their common characteristics, a color-linked configuration editor and classical tree view components for rules and object groups. All these components are interactively linked to enable both exploratory and hypotheses testing tasks aimed at understanding the complex functionality of a firewall configuration. To verify our design, we present two case studies on the analysis of rule usage and on nested object groups and collected feedback from five firewall administrators.

While traditional distance measures are often capable of properly describing similarity between objects, in some application areas there is still potential to fine-tune these measures with additional information provided in the data sets. In this work we combine such traditional distance measures for document analysis with link information between documents to improve clustering results. In particular, we test the effectiveness of geodesic distances as similarity measures under the space assumption of spherical geometry in a 0-sphere. Our proposed distance measure is thus a combination of the cosine distance of the term-document matrix and some curvature values in the geodesic distance formula. To estimate these curvature values, we calculate clustering coefficient values for every document from the link graph of the data set and increase their distinctiveness by means of a heuristic as these clustering coefficient values are rough estimates of the curvatures. To evaluate our work, we perform clustering tests with the k-means algorithm on the English Wikipedia hyperlinked data set with both traditional cosine distance and our proposed geodesic distance. The effectiveness of our approach is measured by computing micro-precision values of the clusters based on the provided categorical information of each article.

The analysis of trajectories has become an important field in geographic visualization, as cheap GPS sensors have become commonplace and, in many cases, valuable information can be derived either from the data themselves or their metadata if processed and visualized in the right way. However, showing the "right" information to highlight dependencies or correlations between different measurements remains a challenge, because the technical intricacies of applying a combination of automatic and visual analysis methods prevents the majority of domain experts from analyzing and exploring the full wealth of their movement data. This paper presents an exploration through enrichment approach, which enables iterative generation of metadata based on exploratory findings and is aimed at enabling domain experts to explore their data beyond traditional means.

The growing amounts of hosts that are placed into the networks represent an enormous challenge to most network administrators who have to monitor these hosts conscientiously. While automatically monitoring the network for slow or failing components has become common practice, defining an acceptable state of the system is only possible to a very limited extent and thus exploratory analysis tasks by real human analysts complement the analysis process. However, this is a problem of scale since it is infeasible to manually inspect thousands of hosts without proper visual support for the tasks of gaining an overview, focusing and retrieving details on demand. In this paper we present a design study to enable visual support for monitoring large IP spaces. In particular, the presented system features 1) a scalable glyph representation in the style of a clock for giving an overview of the activity over time of thousands of hosts in the network, 2) subnet and port views for focusing the analysis to a particular subset of the data and 3) detailed pixel matrix visualizations for interpreting concrete traffic patterns. Furthermore, the tool's feedback loop, which is implemented through interaction capabilities, allows for retrieving new details, refocusing and enhancing of the overview.

Data warehouses are large-scale databases that are usually managed by means of diagram-based conceptual models. However, the complexity of those models often imposes significant design challenges. In particular, this article studies their different underlying graph layouts. The working hypothesis is that graph layouts influence diagram readability, with the latter being significant for facilitating the design process. We define the main viewpoints involved in conceptual modeling. For each one, surveyed as well as alternative layouts were evaluated against a set of aesthetics and efficiency measures. As a result, more readable graph layouts than those found in the literature were identified.

In recent years, social networking sites (SNSs) gained high popularity among Internet users as they combine the best of both worlds: befriending people outside real life situations and staying in touch with people already known. An important aspect of any SNS are user profiles, which allow users to virtually publish anything about themselves, including highly personal or sensitive information. With the inception of SNSs, the problem of personal information disclosure and privacy implications has turned into a serious issue. While privacy issues in SNSs have been extensively analyzed in the past five years showcasing flagships of "western" SNSs like Facebook and MySpace, SNSs that target mainly Russian speaking audiences are not yet analyzed and demand investigation. The goals of this paper are twofold: (1) to raise the awareness of the public to the problems of information revelation by studying the amount and type of information disclosed by users of Runet (Russian Segment of the Internet) SNSs (2) to compare our findings to the results of previous studies in the context of "western" SNSs. We investigate different aspects of information revelation of more than 30 million user profiles collected from five Runet SNS considered in this paper. In addition, we conducted a survey among a Russian speaking population to assess both the level of awareness of the privacy issues and the level of trust, and compared the results to previous studies. While the results indicate that Runet users tend to disclose less information and are more concerned about privacy implications, there is still a substantial gap between western and Runet SNS providers in understanding of privacy implications and implementation of security measures, which leads to exposure of extensive amounts of personal information.

Spatiotemporal analysis of sensor logs is a challenging research field due to three facts: a) traditional two-dimensional maps do not support multiple events to occur at the same spatial location, b) three-dimensional solutions introduce ambiguity and are hard to navigate, and c) map distortions to solve the overlap problem are unfamiliar to most users. This paper introduces a novel approach to represent spatial data changing over time by plotting a number of non-overlapping pixels, close to the sensor positions in a map. Thereby, we encode the amount of time that a subject spent at a particular sensor to the number of plotted pixels. Color is used in a twofold manner; while distinct colors distinguish between sensor nodes in different regions, the colors' intensity is used as an indicator to the temporal property of the subjects' activity. The resulting visualization technique, called Growth Ring Maps, enables users to find similarities and extract patterns of interest in spatiotemporal data by using humans' perceptual abilities. We demonstrate the newly introduced technique on a dataset that shows the behavior of healthy and Alzheimer transgenic, male and female mice. We motivate the new technique by showing that the temporal analysis based on hierarchical clustering and the spatial analysis based on transition matrices only reveal limited results. Results and findings are cross-validated using multidimensional scaling. While the focus of this paper is to apply our visualization for monitoring animal behavior, the technique is also applicable for analyzing data, such as packet tracing, geographic monitoring of sales development, or mobile phone capacity planning.

The Internet has become a wild place: malicious code is spread on personal computers across the world, deploying botnets ready to attack the network infrastructure. The vast number of security incidents and other anomalies overwhelms attempts at manual analysis, especially when monitoring service provider backbone links. We present an approach to interactive visualization with a case study indicating that interactive visualization can be applied to gain more insight into these large data sets. We superimpose a hierarchy on IP address space, and study the suitability of Treemap variants for each hierarchy level. Because viewing the whole IP hierarchy at once is not practical for most tasks, we evaluate layout stability when eliding large parts of the hierarchy, while maintaining the visibility and ordering of the data of interest.

In today's applications data is produced at unprecedented rates. While the capacity to collect and store new data grows rapidly, the ability to analyze these data volumes increases at much lower pace. This gap leads to new challenges in the analysis process, since analysts, decision makers, engineers, or emergency response teams depend on information "concealed" in the data. The emerging field of visual analytics focuses on handling massive, heterogenous, and dynamic volumes of information through integration of human judgement by means of visual representations and interaction techniques in the analysis process. Furthermore, it is the combination of related research areas including visualization, data mining, and statistics that turns visual analytics into a promising field of research. This paper aims at providing an overview of visual analytics, its scope and concepts, and details the most important technical research challenges in the field

Network communication has become indispensable in business, education, and government. With the pervasive role of the Internet as a means of sharing information across networks, its misuse for destructive purposes, such as spreading malicious code, compromising remote hosts, or damaging data through unauthorized access, has grown immensely in the recent years. The classical way of monitoring the operation of large network systems is by analyzing the system logs for detecting anomalies. In this work, we introduce Hierarchical Network Map, an interactive visualization technique for gaining a deeper insight into network flow behavior by means of user-driven visual exploration. Our approach is meant as an enhancement to conventional analysis methods based on statistics or machine learning. We use multidimensional modeling combined with position and display awareness to view source and target data of the hosts in a hierarchical fashion with the ability to interactively change the level of aggregation or apply filtering. The interdisciplinary approach integrating data warehouse technology, information visualization, and decision support, brings about the benefit of efficiently collecting the input data and aggregating over very large data sets, visualizing the results, and providing interactivity to facilitate analytical reasoning.

In today’s world, e-mail has become one of the most important means of communication in business and private lives due to its efficiency. However, the problems start as soon as mail volumes go beyond the scope of human information processing capabilities. Firstly, time does not allow for leaving certain messages unanswered for a long time, and in certain cases, for reading all messages. Secondly, the dilemma of electronic filters leaves a choice of too many junk mails getting through versus a risk of solicited mails being dumped. In this paper we present a new interactive visual data mining approach for analyzing individual e-mail communication. It combines classical visual analytics (help to identify pattern such as peaks and trends over time) with geo-spatial map distortions (help to understand the routes of e-mails). Experiments show that our visual e-mail explorer produces useful and interesting visualizations of large collections of e-mail and is practical for exploring temporal and geo-spatial patterns hidden in the e-mail data.