Visual Analytics of Anomalous User Behaviors: A Survey
---
paper_title: Deep Learning for Anomaly Detection: A Survey

paper_content:

Anomaly detection is an important problem that has been well-studied within diverse research areas and application domains. The aim of this survey is two-fold, firstly we present a structured and comprehensive overview of research methods in deep learning-based anomaly detection. Furthermore, we review the adoption of these methods for anomaly across various application domains and assess their effectiveness. We have grouped state-of-the-art research techniques into different categories based on the underlying assumptions and approach adopted. Within each category we outline the basic anomaly detection technique, along with its variants and present key assumptions, to differentiate between normal and anomalous behavior. For each category, we present we also present the advantages and limitations and discuss the computational complexity of the techniques in real application domains. Finally, we outline open issues in research and challenges faced while adopting these techniques.
---
paper_title: An overview of anomaly detection techniques: Existing solutions and latest technological trends

paper_content:

As advances in networking technology help to connect the distant corners of the globe and as the Internet continues to expand its influence as a medium for communications and commerce, the threat from spammers, attackers and criminal enterprises has also grown accordingly. It is the prevalence of such threats that has made intrusion detection systems-the cyberspace's equivalent to the burglar alarm-join ranks with firewalls as one of the fundamental technologies for network security. However, today's commercially available intrusion detection systems are predominantly signature-based intrusion detection systems that are designed to detect known attacks by utilizing the signatures of those attacks. Such systems require frequent rule-base updates and signature updates, and are not capable of detecting unknown attacks. In contrast, anomaly detection systems, a subset of intrusion detection systems, model the normal system/network behavior which enables them to be extremely effective in finding and foiling both known as well as unknown or ''zero day'' attacks. While anomaly detection systems are attractive conceptually, a host of technological problems need to be overcome before they can be widely adopted. These problems include: high false alarm rate, failure to scale to gigabit speeds, etc. In this paper, we provide a comprehensive survey of anomaly detection systems and hybrid intrusion detection systems of the recent past and present. We also discuss recent technological trends in anomaly detection and identify open problems and challenges in this area.
---
paper_title: Anomaly detection: A survey

paper_content:

Anomaly detection is an important problem that has been researched within diverse research areas and application domains. Many anomaly detection techniques have been specifically developed for certain application domains, while others are more generic. This survey tries to provide a structured and comprehensive overview of the research on anomaly detection. We have grouped existing techniques into different categories based on the underlying approach adopted by each technique. For each category we have identified key assumptions, which are used by the techniques to differentiate between normal and anomalous behavior. When applying a given technique to a particular domain, these assumptions can be used as guidelines to assess the effectiveness of the technique in that domain. For each category, we provide a basic anomaly detection technique, and then show how the different existing techniques in that category are variants of the basic technique. This template provides an easier and more succinct understanding of the techniques belonging to each category. Further, for each category, we identify the advantages and disadvantages of the techniques in that category. We also provide a discussion on the computational complexity of the techniques since it is an important issue in real application domains. We hope that this survey will provide a better understanding of the different directions in which research has been done on this topic, and how techniques developed in one area can be applied in domains for which they were not intended to begin with.
---
paper_title: Understanding user behavior in online social networks: a survey

paper_content:

Currently, online social networks such as Facebook, Twitter, Google+, LinkedIn, and Foursquare have become extremely popular all over the world and play a significant role in people?s daily lives. People access OSNs using both traditional desktop PCs and new emerging mobile devices. With more than one billion users worldwide, OSNs are a new venue of innovation with many challenging research problems. In this survey, we aim to give a comprehensive review of state-of-the-art research related to user behavior in OSNs from several perspectives. First, we discuss social connectivity and interaction among users. Also, we investigate traffic activity from a network perspective. Moreover, as mobile devices become a commodity, we pay attention to the characteristics of social behaviors in mobile environments. Last but not least, we review malicious behaviors of OSN users, and discuss several solutions to detect misbehaving users. Our survey serves the important roles of both providing a systematic exploration of existing research highlights and triggering various potentially significant research in these topics.
---
paper_title: A Survey on Visual Analytics of Social Media Data

paper_content:

The unprecedented availability of social media data offers substantial opportunities for data owners, system operators, solution providers, and end users to explore and understand social dynamics. However, the exponential growth in the volume, velocity, and variability of social media data prevents people from fully utilizing such data. Visual analytics, which is an emerging research direction, has received considerable attention in recent years. Many visual analytics methods have been proposed across disciplines to understand large-scale structured and unstructured social media data. This objective, however, also poses significant challenges for researchers to obtain a comprehensive picture of the area, understand research challenges, and develop new techniques. In this paper, we present a comprehensive survey to characterize this fast-growing area and summarize the state-of-the-art techniques for analyzing social media data. In particular, we classify existing techniques into two categories: gathering information and understanding user behaviors. We aim to provide a clear overview of the research area through the established taxonomy. We then explore the design space and identify the research trends. Finally, we discuss challenges and open questions for future studies.
---
paper_title: Visual Analytics in Urban Computing: An Overview

paper_content:

Nowadays, various data collected in urban context provide unprecedented opportunities for building a smarter city through urban computing. However, due to heterogeneity, high complexity and large volumes of these urban data, analyzing them is not an easy task, which often requires integrating human perception in analytical process, triggering a broad use of visualization. In this survey, we first summarize frequently used data types in urban visual analytics, and then elaborate on existing visualization techniques for time, locations and other properties of urban data. Furthermore, we discuss how visualization can be combined with automated analytical approaches. Existing work on urban visual analytics is categorized into two classes based on different outputs of such combinations: 1) For data exploration and pattern interpretation , we describe representative visual analytics tools designed for better insights of different types of urban data. 2) For visual learning , we discuss how visualization can help in three major steps of automated analytical approaches (i.e., cohort construction; feature selection & model construction; result evaluation & tuning) for a more effective machine learning or data mining process, leading to sort of artificial intelligence, such as a classifier, a predictor or a regression model. Finally, we outlook the future of urban visual analytics, and conclude the survey with potential research directions.
---
paper_title: A survey on visual analysis approaches for financial data

paper_content:

Market participants and businesses have made tremendous efforts to make the best decisions in a timely manner under varying economic and business circumstances. As such, decision-making processes based on financial data have been a popular topic in industries. However, analyzing financial data is a non-trivial task due to large volume, diversity and complexity, and this has led to rapid research and development of visualizations and visual analytics systems for financial data exploration. Often, the development of such systems requires researchers to collaborate with financial domain experts to better extract requirements and challenges in their tasks. Work to systematically study and gather the task requirements and to acquire an overview of existing visualizations and visual analytics systems that have been applied in financial domains with respect to real-world data sets has not been completed. To this end, we perform a comprehensive survey of visualizations and visual analytics. In this work, we categorize financial systems in terms of data sources, applied automated techniques, visualization techniques, interaction, and evaluation methods. For the categorization and characterization, we utilize existing taxonomies of visualization and interaction. In addition, we present task requirements extracted from interviews with domain experts in order to help researchers design better systems with detailed goals.
---
paper_title: A Survey of Visualization Systems for Network Security

paper_content:

Security Visualization is a very young term. It expresses the idea that common visualization techniques have been designed for use cases that are not supportive of security-related data, demanding novel techniques fine tuned for the purpose of thorough analysis. Significant amount of work has been published in this area, but little work has been done to study this emerging visualization discipline. We offer a comprehensive review of network security visualization and provide a taxonomy in the form of five use-case classes encompassing nearly all recent works in this area. We outline the incorporated visualization techniques and data sources and provide an informative table to display our findings. From the analysis of these systems, we examine issues and concerns regarding network security visualization and provide guidelines and directions for future researchers and visual system developers.
---
paper_title: Visual Analytics for cyber security and intelligence

paper_content:

In the context of modern defense and security operations, analysts are faced with a continuously growing set of information of different nature that causes significant information overload problems and prevents developing good situation awareness. Fortunately, Visual Analytics (VA) has emerged as an efficient way of handling and making sense of massive datasets by exploiting interactive visualization technologies and human cognitive abilities. Defence R&D Canada has conducted a review of the applicability of VA to support military and security operations. This paper is meant to provide someone new to this area with a quick overview of the current state of the art in VA. We introduce the important scientific visualization, interaction and reasoning concepts supporting VA, followed by VA advanced techniques. Then, we describe how VA can contribute to the cyber security and intelligence analysis application domains, along with promising research projects and commercial software. Finally, we discuss the futur...
---
paper_title: Suspicious Behavior Detection: Current Trends and Future Directions

paper_content:

Different real-world applications have varying definitions of suspicious behaviors. Detection methods often look for the most suspicious parts of the data by optimizing scores, but quantifying the suspiciousness of a behavioral pattern is still an open issue.
---
paper_title: Graph based anomaly detection and description: a survey

paper_content:

Detecting anomalies in data is a vital task, with numerous high-impact applications in areas such as security, finance, health care, and law enforcement. While numerous techniques have been developed in past years for spotting outliers and anomalies in unstructured collections of multi-dimensional points, with graph data becoming ubiquitous, techniques for structured graph data have been of focus recently. As objects in graphs have long-range correlations, a suite of novel technology has been developed for anomaly detection in graph data. This survey aims to provide a general, comprehensive, and structured overview of the state-of-the-art methods for anomaly detection in data represented as graphs. As a key contribution, we give a general framework for the algorithms categorized under various settings: unsupervised versus (semi-)supervised approaches, for static versus dynamic graphs, for attributed versus plain graphs. We highlight the effectiveness, scalability, generality, and robustness aspects of the methods. What is more, we stress the importance of anomaly attribution and highlight the major techniques that facilitate digging out the root cause, or the `why', of the detected anomalies for further analysis and sense-making. Finally, we present several real-world applications of graph-based anomaly detection in diverse domains, including financial, auction, computer traffic, and social networks. We conclude our survey with a discussion on open theoretical and practical challenges in the field.
---
paper_title: Anomaly detection: A survey

paper_content:

Anomaly detection is an important problem that has been researched within diverse research areas and application domains. Many anomaly detection techniques have been specifically developed for certain application domains, while others are more generic. This survey tries to provide a structured and comprehensive overview of the research on anomaly detection. We have grouped existing techniques into different categories based on the underlying approach adopted by each technique. For each category we have identified key assumptions, which are used by the techniques to differentiate between normal and anomalous behavior. When applying a given technique to a particular domain, these assumptions can be used as guidelines to assess the effectiveness of the technique in that domain. For each category, we provide a basic anomaly detection technique, and then show how the different existing techniques in that category are variants of the basic technique. This template provides an easier and more succinct understanding of the techniques belonging to each category. Further, for each category, we identify the advantages and disadvantages of the techniques in that category. We also provide a discussion on the computational complexity of the techniques since it is an important issue in real application domains. We hope that this survey will provide a better understanding of the different directions in which research has been done on this topic, and how techniques developed in one area can be applied in domains for which they were not intended to begin with.
---
paper_title: Predictive visual analytics of event evolution for user-created context

paper_content:

AbstractDigital big data provide the vast potential of increasing effectiveness and efficiency for decision making. Since the volume of the data is enormous, the data analysis requires large amount of time and effort. It is more problematic when predictive analysis is necessary for futuristic decision making. For predictive analysis, there have been many studies to forecast future trends spatio-temporally. However, most of studies provide just future tendency per event using graphs or maps without contextual compositive analysis. In this paper, we present a predictive visual analytics system to provide predictive event patterns. We infer the future event evolution by combining contextually similar cases occurring in the past. We utilize social media data to detect interesting abnormal events and match the detected abnormal events within the past news media data to retrieve similar event patterns. Then, we extract future event patterns through compositing contextual relationship among topics included in the similar past patterns. To evaluate our VA system, we demonstrate three use cases in this paper and validate our system with possible predictive story lines. In addition, we present an informal user study and feedback to validate the effectiveness of our system and improve the system in the future.Graphical AbstractGraphical Abstract text
---
paper_title: Anomaly detection: A survey

paper_content:

Anomaly detection is an important problem that has been researched within diverse research areas and application domains. Many anomaly detection techniques have been specifically developed for certain application domains, while others are more generic. This survey tries to provide a structured and comprehensive overview of the research on anomaly detection. We have grouped existing techniques into different categories based on the underlying approach adopted by each technique. For each category we have identified key assumptions, which are used by the techniques to differentiate between normal and anomalous behavior. When applying a given technique to a particular domain, these assumptions can be used as guidelines to assess the effectiveness of the technique in that domain. For each category, we provide a basic anomaly detection technique, and then show how the different existing techniques in that category are variants of the basic technique. This template provides an easier and more succinct understanding of the techniques belonging to each category. Further, for each category, we identify the advantages and disadvantages of the techniques in that category. We also provide a discussion on the computational complexity of the techniques since it is an important issue in real application domains. We hope that this survey will provide a better understanding of the different directions in which research has been done on this topic, and how techniques developed in one area can be applied in domains for which they were not intended to begin with.
---
paper_title: Digital artifacts for remembering and storytelling: posthistory and social network fragments

paper_content:

As part of a long-term investigation into visualizing email, we have created two visualizations of email archives. One highlights social networks while the other depicts the temporal rhythms of interactions with individuals. While interviewing users of these systems, it became clear that the applications triggered recall of many personal events. One of the most striking and not entirely expected outcomes was that the visualizations motivated retelling stories from the users' pasts to others. In this paper, we discuss the motivation and design of these projects and analyze their use as catalysts for personal narrative and recall.
---
paper_title: Visual Exploration and Analysis of Historic Hotel Visits

paper_content:

Understanding the spatial and temporal characteristics of individual and group behavior in social networks is a critical component of visual tools for intelligence analysis, emergency management, consumer analysis, and human geography. Identification and analysis of patterns of recurring events is an essential feature of such tools. In this paper, we describe an interactive visual tool for exploring the visitation patterns of guests at two hotels in central Pennsylvania from 1894 to 1900. The centerpiece of the tool is a wrapping spreadsheet technique, called reruns, that reveals regular and irregular periodic patterns of events in multiple overlapping artificial and natural calendars. Implemented as a coordinated multiple view visualization in Improvise, the tool is in ongoing development through an iterative process of data collection, transcription, hypothesis, design, discovery, analysis, and evaluation in close collaboration with historical geographers. Numerous discoveries have driven additional data collection from archival newspaper and census sources, as well as plans to enhance analysis of spatial patterns using historic weather records and railroad schedules. Distributed online evaluations of usability and usefulness have resulted in feature and design recommendations that are being incorporated into the tool.
---
paper_title: Toward a Deeper Understanding of the Role of Interaction in Information Visualization

paper_content:

Even though interaction is an important part of information visualization (Infovis), it has garnered a relatively low level of attention from the Infovis community. A few frameworks and taxonomies of Infovis interaction techniques exist, but they typically focus on low-level operations and do not address the variety of benefits interaction provides. After conducting an extensive review of Infovis systems and their interactive capabilities, we propose seven general categories of interaction techniques widely used in Infovis: 1) Select, 2) Explore, 3) Reconfigure, 4) Encode, 5) Abstract/Elaborate, 6) Filter, and 7) Connect. These categories are organized around a user's intent while interacting with a system rather than the low-level interaction techniques provided by a system. The categories can act as a framework to help discuss and evaluate interaction techniques and hopefully lay an initial foundation toward a deeper understanding and a science of interaction.
---
paper_title: Brief Application Description; Visual Data Mining: Recognizing Telephone Calling Fraud

paper_content:

Human pattern recognition skills are remarkable and in many situations far exceed the ability of automated mining algorithms. By building domain-specific interfaces that present information visually, we can combine human detection with machines‘ far greater computational capacity. We illustrate our ideas by describing a suite of visual interfaces we built for telephone fraud detection.
---
paper_title: PeopleGarden: creating data portraits for users

paper_content:

Many on-line interaction environments have a large number of users. It is difficult for the participants, especially new ones, to form a clear mental image about those with whom they are interacting. How can we compactly convey information about these participants to each other? We propose the data portrait , a novel graphical representation of users based on their past interactions. Data portraits can inform users about each other and the overall social environment. We use a flower metaphor for creating individual data portraits, and a garden metaphor for combining these portraits to represent an on-line environment. We will review previous work in visualizing both individuals and groups. We will then describe our visualizations, explain how to create them, and show how they can be used to address user questions.
---
paper_title: Anomaly detection: A survey

paper_content:

Anomaly detection is an important problem that has been researched within diverse research areas and application domains. Many anomaly detection techniques have been specifically developed for certain application domains, while others are more generic. This survey tries to provide a structured and comprehensive overview of the research on anomaly detection. We have grouped existing techniques into different categories based on the underlying approach adopted by each technique. For each category we have identified key assumptions, which are used by the techniques to differentiate between normal and anomalous behavior. When applying a given technique to a particular domain, these assumptions can be used as guidelines to assess the effectiveness of the technique in that domain. For each category, we provide a basic anomaly detection technique, and then show how the different existing techniques in that category are variants of the basic technique. This template provides an easier and more succinct understanding of the techniques belonging to each category. Further, for each category, we identify the advantages and disadvantages of the techniques in that category. We also provide a discussion on the computational complexity of the techniques since it is an important issue in real application domains. We hope that this survey will provide a better understanding of the different directions in which research has been done on this topic, and how techniques developed in one area can be applied in domains for which they were not intended to begin with.
---
paper_title: Studying cooperation and conflict between authors with history flow visualizations

paper_content:

The Internet has fostered an unconventional and powerful style of collaboration: "wiki" web sites, where every visitor has the power to become an editor. In this paper we investigate the dynamics of Wikipedia, a prominent, thriving wiki. We make three contributions. First, we introduce a new exploratory data analysis tool, the history flow visualization, which is effective in revealing patterns within the wiki context and which we believe will be useful in other collaborative situations as well. Second, we discuss several collaboration patterns highlighted by this visualization tool and corroborate them with statistical analysis. Third, we discuss the implications of these patterns for the design and governance of online collaborative social spaces. We focus on the relevance of authorship, the value of community surveillance in ameliorating antisocial behavior, and how authors with competing perspectives negotiate their differences.
---
paper_title: Suspicious Behavior Detection: Current Trends and Future Directions

paper_content:

Different real-world applications have varying definitions of suspicious behaviors. Detection methods often look for the most suspicious parts of the data by optimizing scores, but quantifying the suspiciousness of a behavioral pattern is still an open issue.
---
paper_title: Interactive analysis of event data using space-time cube

paper_content:

In exploratory data analysis, the choice of tools depends on the data to be analyzed and the analysis tasks, i.e. the questions to be answered. The same applies to design of new analysis tools. In this paper, we consider a particular type of data: data that describe transient events having spatial and temporal references, such as earthquakes, traffic incidents, or observations of rare plants or animals. We focus on the task of detecting spatio-temporal patterns in event occurrences. We demonstrate the insufficiency of the existing techniques and approaches to event exploration and substantiate the need in a new exploratory tool. The technique of space-time cube, which has been earlier proposed for the visualization of movement in geographical space, possesses the required properties. However, it must be implemented so as to allow particular interactive manipulations: changing the viewing perspective, temporal focusing, and dynamic linking with a map display through simultaneous highlighting of corresponding symbols. We describe our implementation of the space-time cube technique and demonstrate by an example how it can be used for detecting spatio-temporal clusters of events.
---
paper_title: A textbook of graph theory

paper_content:

Basic Results.- Directed Graphs.- Connectivity.- Trees.- Independent Sets and Matchings.- Eulerian and Hamiltonian Graphs.- Graph Colourings.- Planarity.- Triangulated Graphs.- Applications.
---
paper_title: Reordering Massive Sequence Views: Enabling temporal and structural analysis of dynamic networks

paper_content:

Networks are present in many fields such as finance, sociology, and transportation. Often these networks are dynamic: they have a structural as well as a temporal aspect. We present a technique that extends the Massive Sequence View (MSV) for the analysis of the temporal and structural aspects of dynamic networks. Using features in the data as well as in the visualization based on the Gestalt principles closure, proximity, and similarity, we developed node reordering strategies for the MSV to make these features stand out. This enables users to find temporal properties such as trends, counter trends, periodicity, temporal shifts, and anomalies in the network as well as structural properties such as communities and stars. We show the effectiveness of the reordering methods on both synthetic and real-world transaction data sets.
---
paper_title: Dynamic Network Visualization withExtended Massive Sequence Views

paper_content:

Networks are present in many fields such as finance, sociology, and transportation. Often these networks are dynamic: they have a structural as well as a temporal aspect. In addition to relations occurring over time, node information is frequently present such as hierarchical structure or time-series data. We present a technique that extends the Massive Sequence View ( msv) for the analysis of temporal and structural aspects of dynamic networks. Using features in the data as well as Gestalt principles in the visualization such as closure, proximity, and similarity, we developed node reordering strategies for the msv to make these features stand out that optionally take the hierarchical node structure into account. This enables users to find temporal properties such as trends, counter trends, periodicity, temporal shifts, and anomalies in the network as well as structural properties such as communities and stars. We introduce the circular msv that further reduces visual clutter. In addition, the (circular) msv is extended to also convey time-series data associated with the nodes. This enables users to analyze complex correlations between edge occurrence and node attribute changes. We show the effectiveness of the reordering methods on both synthetic and a rich real-world dynamic network data set.
---
paper_title: Balancing Systematic and Flexible Exploration of Social Networks

paper_content:

Social network analysis (SNA) has emerged as a powerful method for understanding the importance of relationships in networks. However, interactive exploration of networks is currently challenging because: (1) it is difficult to find patterns and comprehend the structure of networks with many nodes and links, and (2) current systems are often a medley of statistical methods and overwhelming visual output which leaves many analysts uncertain about how to explore in an orderly manner. This results in exploration that is largely opportunistic. Our contributions are techniques to help structural analysts understand social networks more effectively. We present SocialAction, a system that uses attribute ranking and coordinated views to help users systematically examine numerous SNA measures. Users can (1) flexibly iterate through visualizations of measures to gain an overview, filter nodes, and find outliers, (2) aggregate networks using link structure, find cohesive subgroups, and focus on communities of interest, and (3) untangle networks by viewing different link types separately, or find patterns across different link types using a matrix overview. For each operation, a stable node layout is maintained in the network visualization so users can make comparisons. SocialAction offers analysts a strategy beyond opportunism, as it provides systematic, yet flexible, techniques for exploring social networks
---
paper_title: Space-time dynamics of topics in streaming text

paper_content:

Human-generated textual data streams from services such as Twitter increasingly become geo-referenced. The spatial resolution of their coverage improves quickly, making them a promising instrument for sensing various aspects of evolution and dynamics of social systems. This work explores spacetime structures of the topical content of short textual messages in a stream available from Twitter in Ireland. It uses a streaming Latent Dirichlet Allocation topic model trained with an incremental variational Bayes method. The posterior probabilities of the discovered topics are post-processed with a spatial kernel density and subjected to comparative analysis. The identified prevailing topics are often found to be spatially contiguous. We apply Markov-modulated non-homogeneous Poisson processes to quantify a proportion of novelty in the observed abnormal patterns. A combined use of these techniques allows for real-time analysis of the temporal evolution and spatial variability of population's response to various stimuli such as large scale sportive, political or cultural events.
---
paper_title: TargetVue: Visual Analysis of Anomalous User Behaviors in Online Communication Systems

paper_content:

Users with anomalous behaviors in online communication systems (e.g. email and social medial platforms) are potential threats to society. Automated anomaly detection based on advanced machine learning techniques has been developed to combat this issue; challenges remain, though, due to the difficulty of obtaining proper ground truth for model training and evaluation. Therefore, substantial human judgment on the automated analysis results is often required to better adjust the performance of anomaly detection. Unfortunately, techniques that allow users to understand the analysis results more efficiently, to make a confident judgment about anomalies, and to explore data in their context, are still lacking. In this paper, we propose a novel visual analysis system, TargetVue, which detects anomalous users via an unsupervised learning model and visualizes the behaviors of suspicious users in behavior-rich context through novel visualization designs and multiple coordinated contextual views. Particularly, TargetVue incorporates three new ego-centric glyphs to visually summarize a user's behaviors which effectively present the user's communication activities, features, and social interactions. An efficient layout method is proposed to place these glyphs on a triangle grid, which captures similarities among users and facilitates comparisons of behaviors of different users. We demonstrate the power of TargetVue through its application in a social bot detection challenge using Twitter data, a case study based on email records, and an interview with expert users. Our evaluation shows that TargetVue is beneficial to the detection of users with anomalous communication behaviors.
---
paper_title: The spread of low-credibility content by social bots

paper_content:

The massive spread of digital misinformation has been identified as a major threat to democracies. Communication, cognitive, social, and computer scientists are studying the complex causes for the viral diffusion of misinformation, while online platforms are beginning to deploy countermeasures. Little systematic, data-based evidence has been published to guide these efforts. Here we analyze 14 million messages spreading 400 thousand articles on Twitter during ten months in 2016 and 2017. We find evidence that social bots played a disproportionate role in spreading articles from low-credibility sources. Bots amplify such content in the early spreading moments, before an article goes viral. They also target users with many followers through replies and mentions. Humans are vulnerable to this manipulation, resharing content posted by bots. Successful low-credibility sources are heavily supported by social bots. These results suggest that curbing social bots may be an effective strategy for mitigating the spread of online misinformation.Online misinformation is a threat to a well-informed electorate and undermines democracy. Here, the authors analyse the spread of articles on Twitter, find that bots play a major role in the spread of low-credibility content and suggest control measures for limiting the spread of misinformation.
---
paper_title: Lessons Learned Developing a Visual Analytics Solution for Investigative Analysis of Scamming Activities

paper_content:

The forensic investigation of communication datasets which contain unstructured text, social network information, and metadata is a complex task that is becoming more important due to the immense amount of data being collected. Currently there are limited approaches that allow an investigator to explore the network, text and metadata in a unified manner. We developed Beagle as a forensic tool for email datasets that allows investigators to flexibly form complex queries in order to discover important information in email data. Beagle was successfully deployed at a security firm which had a large email dataset that was difficult to properly investigate. We discuss our experience developing Beagle as well as the lessons we learned applying visual analytic techniques to a difficult real-world problem.
---
paper_title: Visualization of sanitized email logs for spam analysis

paper_content:

Email has become an integral method of communication. However, it is still plagued by vast amounts of spam. Many statistical techniques, such as Bayesian filtering, have been applied to this problem, and been proven useful. But these techniques in general require training. Another common method of spam prevention is blacklisting known spam sources. In order to do this, the sources must be identified. What this paper presents is a set of visualization techniques designed to show patterns in incoming email which can reveal misidentified pieces of spam, common spam sources, and patterns such as periods of increased spam activity, while maintaining the privacy of the email. This can aid system administrators in rapidly and effectively adjusting system level filters, which would improve the quality of service and decrease the time and resources wasted by spam.
---
paper_title: Twitinfo: aggregating and visualizing microblogs for event exploration

paper_content:

Microblogs are a tremendous repository of user-generated content about world events. However, for people trying to understand events by querying services like Twitter, a chronological log of posts makes it very difficult to get a detailed understanding of an event. In this paper, we present TwitInfo, a system for visualizing and summarizing events on Twitter. TwitInfo allows users to browse a large collection of tweets using a timeline-based display that highlights peaks of high tweet activity. A novel streaming algorithm automatically discovers these peaks and labels them meaningfully using text from the tweets. Users can drill down to subevents, and explore further via geolocation, sentiment, and popular URLs. We contribute a recall-normalized aggregate sentiment visualization to produce more honest sentiment overviews. An evaluation of the system revealed that users were able to reconstruct meaningful summaries of events in a small amount of time. An interview with a Pulitzer Prize-winning journalist suggested that the system would be especially useful for understanding a long-running event and for identifying eyewitnesses. Quantitatively, our system can identify 80-100% of manually labeled peaks, facilitating a relatively complete view of each event studied.
---
paper_title: Spatiotemporal anomaly detection through visual analysis of geolocated Twitter messages

paper_content:

Analyzing message streams from social blogging services such as Twitter is a challenging task because of the vast number of documents that are produced daily. At the same time, the availability of geolocated, realtime, and manually created status updates are an invaluable data source for situational awareness scenarios. In this work we present an approach that allows for an interactive analysis of location-based microblog messages in realtime by means of scalable aggregation and geolocated text visualization. For this purpose, we use a novel cluster analysis approach and distinguish between local event reports and global media reaction to detect spatiotemporal anomalies automatically. A workbench allows the scalable visual examination and analysis of messages featuring perspective and semantic layers on a world map representation. Our novel techniques can be used by analysts to classify the presented event candidates and examine them on a global scale.
---
paper_title: ScatterBlogs2: Real-Time Monitoring of Microblog Messages through User-Guided Filtering

paper_content:

The number of microblog posts published daily has reached a level that hampers the effective retrieval of relevant messages, and the amount of information conveyed through services such as Twitter is still increasing. Analysts require new methods for monitoring their topic of interest, dealing with the data volume and its dynamic nature. It is of particular importance to provide situational awareness for decision making in time-critical tasks. Current tools for monitoring microblogs typically filter messages based on user-defined keyword queries and metadata restrictions. Used on their own, such methods can have drawbacks with respect to filter accuracy and adaptability to changes in trends and topic structure. We suggest ScatterBlogs2, a new approach to let analysts build task-tailored message filters in an interactive and visual manner based on recorded messages of well-understood previous events. These message filters include supervised classification and query creation backed by the statistical distribution of terms and their co-occurrences. The created filter methods can be orchestrated and adapted afterwards for interactive, visual real-time monitoring and analysis of microblog feeds. We demonstrate the feasibility of our approach for analyzing the Twitter stream in emergency management scenarios.
---
paper_title: #FluxFlow: Visual Analysis of Anomalous Information Spreading on Social Media

paper_content:

We present FluxFlow, an interactive visual analysis system for revealing and analyzing anomalous information spreading in social media. Everyday, millions of messages are created, commented, and shared by people on social media websites, such as Twitter and Facebook. This provides valuable data for researchers and practitioners in many application domains, such as marketing, to inform decision-making. Distilling valuable social signals from the huge crowd's messages, however, is challenging, due to the heterogeneous and dynamic crowd behaviors. The challenge is rooted in data analysts' capability of discerning the anomalous information behaviors, such as the spreading of rumors or misinformation, from the rest that are more conventional patterns, such as popular topics and newsworthy events, in a timely fashion. FluxFlow incorporates advanced machine learning algorithms to detect anomalies, and offers a set of novel visualization designs for presenting the detected threads for deeper analysis. We evaluated FluxFlow with real datasets containing the Twitter feeds captured during significant events such as Hurricane Sandy. Through quantitative measurements of the algorithmic performance and qualitative interviews with domain experts, the results show that the back-end anomaly detection model is effective in identifying anomalous retweeting threads, and its front-end interactive visualizations are intuitive and useful for analysts to discover insights in data and comprehend the underlying analytical model.
---
paper_title: Scalable and Interactive Visual Analysis of Financial Wire Transactions for Fraud Detection

paper_content:

Large financial institutions such as Bank of America handle hundreds of thousands of wire transactions per day. Although most transactions are legitimate, these institutions have legal and financial obligations to discover those that are suspicious. With the methods of fraudulent activities ever changing, searching on predefined patterns is often insufficient in detecting previously undiscovered methods. In this paper, we present a set of coordinated visualizations based on identifying specific keywords within the wire transactions. The different views used in our system depict relationships among keywords and accounts over time. Furthermore, we introduce a search-by-example technique, which extracts accounts that show similar transaction patterns. Our system can be connected to a database to handle millions of transactions and still preserve high interactivity. In collaboration with the Anti-Money Laundering division at Bank of America, we demonstrate that using our tool, investigators are able to detect accounts and transactions that exhibit suspicious behaviors.
---
paper_title: WireVis: Visualization of Categorical, Time-Varying Data From Financial Transactions

paper_content:

Large financial institutions such as Bank of America handle hundreds of thousands of wire transactions per day. Although most transactions are legitimate, these institutions have legal and financial obligations in discovering those that are suspicious. With the methods of fraudulent activities ever changing, searching on predefined patterns is often insufficient in detecting previously undiscovered methods. In this paper, we present a set of coordinated visualizations based on identifying specific keywords within the wire transactions. The different views used in our system depict relationships among keywords and accounts over time. Furthermore, we introduce a search-by-example technique which extracts accounts that show similar transaction patterns. In collaboration with the Anti-Money Laundering division at Bank of America, we demonstrate that using our tool, investigators are able to detect accounts and transactions that exhibit suspicious behaviors.
---
paper_title: VisTracer: a visual analytics tool to investigate routing anomalies in traceroutes

paper_content:

Routing in the Internet is vulnerable to attacks due to the insecure design of the border gateway protocol (BGP). One possible exploitation of this insecure design is the hijacking of IP blocks. Such hijacked IP blocks can then be used to conduct malicious activities from seemingly legitimate IP addresses. In this study we actively trace and monitor the routes to spam sources over several consecutive days after having received a spam message from such a source. However, the real challenge is to distinguish between legitimate routing changes and those ones that are related to systematic misuse in so-called spam campaigns. To combine the strengths of human judgement and computational efficiency, we thus present a novel visual analytics tool named Vistracer in this paper. This tool represents analysis results of our anomaly detection algorithms on large traceroute data sets with the help of several scalable representations to support the analyst to explore, identify and analyze suspicious events and their relations to malicious activities. In particular, pixel-based visualization techniques, novel glyph-based summary representations and a combination of temporal glyphs in a graph representation are used to give an overview of route changes to specific destinations over time. To evaluate our tool, real-world case studies demonstrate the usage of Vistracer in practice on large-scale data sets.
---
paper_title: VisFlowConnect: netflow visualizations of link relationships for security situational awareness

paper_content:

We present a visualization design to enhance the ability of an administrator to detect and investigate anomalous traffic between a local network and external domains. Central to the design is a parallel axes view which displays NetFlow records as links between two machines or domains while employing a variety of visual cues to assist the user. We describe several filtering options that can be employed to hide uninteresting or innocuous traffic such that the user can focus his or her attention on the more unusual network flows. This design is implemented in the form of VisFlowConnect, a prototype application which we used to study the effectiveness of our visualization approach. Using VisFlowConnect, we were able to discover a variety of interesting network traffic patterns. Some of these were harmless, normal behavior, but some were malicious attacks against machines on the network.
---
paper_title: CloudLines: Compact Display of Event Episodes in Multiple Time-Series

paper_content:

We propose incremental logarithmic time-series technique as a way to deal with time-based representations of large and dynamic event data sets in limited space. Modern data visualization problems in the domains of news analysis, network security and financial applications, require visual analysis of incremental data, which poses specific challenges that are normally not solved by static visualizations. The incremental nature of the data implies that visualizations have to necessarily change their content and still provide comprehensible representations. In particular, in this paper we deal with the need to keep an eye on recent events together with providing a context on the past and to make relevant patterns accessible at any scale. Our technique adapts to the incoming data by taking care of the rate at which data items occur and by using a decay function to let the items fade away according to their relevance. Since access to details is also important, we also provide a novel distortion magnifying lens technique which takes into account the distortions introduced by the logarithmic time scale to augment readability in selected areas of interest. We demonstrate the validity of our techniques by applying them on incremental data coming from online news streams in different time frames.
---
paper_title: Voila: Visual Anomaly Detection and Monitoring with Streaming Spatiotemporal Data

paper_content:

The increasing availability of spatiotemporal data continuously collected from various sources provides new opportunities for a timely understanding of the data in their spatial and temporal context. Finding abnormal patterns in such data poses significant challenges. Given that there is often no clear boundary between normal and abnormal patterns, existing solutions are limited in their capacity of identifying anomalies in large, dynamic and heterogeneous data, interpreting anomalies in their multifaceted, spatiotemporal context, and allowing users to provide feedback in the analysis loop. In this work, we introduce a unified visual interactive system and framework, Voila, for interactively detecting anomalies in spatiotemporal data collected from a streaming data source. The system is designed to meet two requirements in real-world applications, i.e., online monitoring and interactivity. We propose a novel tensor-based anomaly analysis algorithm with visualization and interaction design that dynamically produces contextualized, interpretable data summaries and allows for interactively ranking anomalous patterns based on user input. Using the “smart city” as an example scenario, we demonstrate the effectiveness of the proposed framework through quantitative evaluation and qualitative case studies.
---
paper_title: Combining visual and automated data mining for near-real-time anomaly detection and analysis in BGP

paper_content:

The security of Internet routing is a major concern because attacks and errors can result in data packets not reaching their intended destination and/or falling into the wrong hands. A key step in improving routing security is to analyze and understand it. In the past, we and other researchers have presented various visual-based, statistical-based, and signature-based methods of analyzing Internet routing data. In this paper, we describe an integration of visual and automated data mining methods for discovering and investigating anomalies in Internet routing. We show how these different components are combined in such a way as to complement each other, creating a very effective and useful analysis tool. In addition to performing analysis on archived data, our system is able to collect, process and visualize data in near-real-time.
---
paper_title: Reordering Massive Sequence Views: Enabling temporal and structural analysis of dynamic networks

paper_content:

Networks are present in many fields such as finance, sociology, and transportation. Often these networks are dynamic: they have a structural as well as a temporal aspect. We present a technique that extends the Massive Sequence View (MSV) for the analysis of the temporal and structural aspects of dynamic networks. Using features in the data as well as in the visualization based on the Gestalt principles closure, proximity, and similarity, we developed node reordering strategies for the MSV to make these features stand out. This enables users to find temporal properties such as trends, counter trends, periodicity, temporal shifts, and anomalies in the network as well as structural properties such as communities and stars. We show the effectiveness of the reordering methods on both synthetic and real-world transaction data sets.
---
paper_title: VisImpact: business impact visualization

paper_content:

Business Intelligence (BI) deals with transforming raw business data into valuable information for making decisions. The goal is to improve the operation and use of large-scale, complex information systems. A number of automated BI techniques are available. These methods, however, have to be supported by user interaction to make successful business decisions. In this paper, we present a new technique for interactive business intelligence based on visualization technology, called VisImpact. The basic idea of the VisImpact technique is to visually display the relationships between the important business operation parameters and the distribution of the process flow. We have applied VisImpact in the areas of business contract analysis, business operation analysis, and fraud analysis, to show the power of the VisImpact technique for finding process flows, patterns, and trends, and for a quick identification of exceptions (outliers). Our interactive VisImpact system provides the means for an instant drilldown to a transaction record level which allows observing the evolution of business dynamics.
---
paper_title: Detecting flaws and intruders with visual data analysis

paper_content:

The task of sifting through large amounts of data to find useful information spawned the field of data mining. Most data mining approaches are based on machine-learning techniques, numerical analysis, or statistical modeling. They use human interaction and visualization only minimally. Such automatic methods can miss some important features of the data. Incorporating human perception into the data mining process through interactive visualization can help us better understand the complex behaviors of computer network systems. This article describes visual-analytics-based solutions and outlines a visual exploration process for log analysis. Three log-file analysis applications demonstrate our approach's effectiveness in discovering flaws and intruders in network systems.
---
paper_title: FraudVis: Understanding Unsupervised Fraud Detection Algorithms

paper_content:

Discovering fraud user behaviors is vital to keeping online websites healthy. Fraudsters usually exhibit grouping behaviors, and researchers have effectively leveraged this behavior to design unsupervised algorithms to detect fraud user groups. In this work, we propose a visualization system, FraudVis, to visually analyze the unsupervised fraud detection algorithms from temporal, intra-group correlation, inter-group correlation, feature selection, and the individual user perspectives. FraudVis helps domain experts better understand the algorithm output and the detected fraud behaviors. Meanwhile, FraudVis also helps algorithm experts to fine-tune the algorithm design through the visual comparison. By using the visualization system, we solve two real-world cases of fraud detection, one for a social video website and another for an e-commerce website. The results on both cases demonstrate the effectiveness of FraudVis in understanding unsupervised fraud detection algorithms.
---
paper_title: Visualizing the insider threat: challenges and tools for identifying malicious user activity

paper_content:

One of the greatest challenges for managing organisational cyber security is the threat that comes from those who operate within the organisation. With entitled access and knowledge of organisational processes, insiders who choose to attack have the potential to cause serious impact, such as financial loss, reputational damage, and in severe cases, could even threaten the existence of the organisation. Security analysts therefore require sophisticated tools that allow them to explore and identify user activity that could be indicative of an imminent threat to the organisation. In this work, we discuss the challenges associated with identifying insider threat activity, along with the tools that can help to combat this problem. We present a visual analytics approach that incorporates multiple views, including a user selection tool that indicates anomalous behaviour, an interactive Principal Component Analysis (iPCA) tool that aids the analyst to assess the reasoning behind the anomaly detection results, and an activity plot that visualizes user and role activity over time. We demonstrate our approach using the Carnegie Mellon University CERT Insider Threat Dataset to show how the visual analytics workflow supports the Information-Seeking mantra.
---
paper_title: Visual correlation of network alerts

paper_content:

The VisAlert visual correlation tool facilitates situational awareness in complex network environments by providing a holistic view of network security to help detect malicious activities. Information visualization techniques and methods in many applications have effectively increased operators' situational awareness, letting them more effectively detect, diagnose, and treat anomalous conditions. Visualization elevates information comprehension by fostering rapid correlation and perceived associations. Our visualization technique integrates the information in log and alert files into an intuitive, flexible, extensible, and scalable visualization tool - VisAlert - that presents critical information concerning network activity in an integrated manner, increasing the user's situational awareness.
---
paper_title: TelCoVis: Visual Exploration of Co-occurrence in Urban Human Mobility Based on Telco Data

paper_content:

Understanding co-occurrence in urban human mobility (i.e. people from two regions visit an urban place during the same time span) is of great value in a variety of applications, such as urban planning, business intelligence, social behavior analysis, as well as containing contagious diseases. In recent years, the widespread use of mobile phones brings an unprecedented opportunity to capture large-scale and fine-grained data to study co-occurrence in human mobility. However, due to the lack of systematic and efficient methods, it is challenging for analysts to carry out in-depth analyses and extract valuable information. In this paper, we present TelCoVis, an interactive visual analytics system, which helps analysts leverage their domain knowledge to gain insight into the co-occurrence in urban human mobility based on telco data. Our system integrates visualization techniques with new designs and combines them in a novel way to enhance analysts' perception for a comprehensive exploration. In addition, we propose to study the correlations in co-occurrence (i.e. people from multiple regions visit different places during the same time span) by means of biclustering techniques that allow analysts to better explore coordinated relationships among different regions and identify interesting patterns. The case studies based on a real-world dataset and interviews with domain experts have demonstrated the effectiveness of our system in gaining insights into co-occurrence and facilitating various analytical tasks.
---
paper_title: The Event Tunnel: Interactive Visualization of Complex Event Streams for Business Process Pattern Analysis

paper_content:

Event-based systems are gaining increasing popularity for building loosely coupled and distributed systems. Since business processes are becoming more interconnected and event-driven, event-based systems fit well for supporting and monitoring business processes. In this paper, we present an event-based business intelligence tool, the Event Tunnel framework. It provides an interactive visualization of event streams to support business analysts in exploring business incidents. The visualization is based on the metaphor of considering the event stream as a cylindrical tunnel, which is presented to the user from multiple perspectives. The information of single events laid out in the Event Tunnel is encoded in event glyphs that allow for a selective mapping of event attributes to colors, size and position. Different policies for the placement of the events in the tunnel as well as a clustering mechanism generate various views on historical event data. The Event Tunnel is able to display the relationships between events. This facilitates users to discover root causes and causal dependencies of event patterns. Our framework couples the event-tunnel visualization with query tools that allow users to search for relevant events within a data repository. Using query, filler and highlighting operations the analyst can navigate through the Event Tunnel until the required information or event patterns become visible. We demonstrate our approach with use cases from the fraud management and logistics domain.
---
paper_title: Dynamic Network Visualization withExtended Massive Sequence Views

paper_content:

Networks are present in many fields such as finance, sociology, and transportation. Often these networks are dynamic: they have a structural as well as a temporal aspect. In addition to relations occurring over time, node information is frequently present such as hierarchical structure or time-series data. We present a technique that extends the Massive Sequence View ( msv) for the analysis of temporal and structural aspects of dynamic networks. Using features in the data as well as Gestalt principles in the visualization such as closure, proximity, and similarity, we developed node reordering strategies for the msv to make these features stand out that optionally take the hierarchical node structure into account. This enables users to find temporal properties such as trends, counter trends, periodicity, temporal shifts, and anomalies in the network as well as structural properties such as communities and stars. We introduce the circular msv that further reduces visual clutter. In addition, the (circular) msv is extended to also convey time-series data associated with the nodes. This enables users to analyze complex correlations between edge occurrence and node attribute changes. We show the effectiveness of the reordering methods on both synthetic and a rich real-world dynamic network data set.
---
paper_title: Discovery of rating fraud with real-time streaming visual analytics

paper_content:

The rating fraud in online e-commerce stores targets at receiving large revenues through boosting the popularity of selected items with fake ratings. The challenges of detecting rating frauds come from discovering small scale abnormal activities in a large amount of data and detecting frauds in a time-critical manner from online rating streams. This paper presents a real-time visual analytics system that consists of two essential components: a server for automatically handling data streams and a visual analytics interface for performing interactive analysis. Based on the features of rating frauds, we present a detection solution which balances computationally expensive algorithms and interactive analysis between the server and analysts. Specifically, our detection system filters data through performing an initial suspicion level detection on the server, and analysts can combine different statistical analysis of the user / item matrix through a co-mapped singular value decomposition (SVD) diagram, re-ordered matrix representation, and the temporal view. We demonstrate our approach with case studies of different fraud scenarios and show that rating frauds can be effectively detected.
---
paper_title: Visual Analytics for Networked-Guarantee Loans Risk Management

paper_content:

Groups of enterprises can guarantee each other and form complex networks in order to try to obtain loans from banks. Monitoring the financial status of a network, and preventing or reducing systematic risk in case of a crisis, is an area of great concern for the regulatory commission and for the banks. We set the ultimate goal of developing a visual analytic approach and tool for risk dissolving and decision-making. We have consolidated four main analysis tasks conducted by financial experts: i) Multi-faceted Default Risk Visualization, whereby a hybrid representation is devised to predict the default risk and an interface developed to visualize key indicators; ii) Risk Guarantee Patterns Discovery. We follow the Shneiderman mantra guidance for designing interactive visualization applications, whereby an interactive risk guarantee community detection and a motif detection based risk guarantee pattern discovery approach are described; iii) Network Evolution and Retrospective, whereby animation is used to help users to understand the guarantee dynamic; iv) Risk Communication Analysis. The temporal diffusion path analysis can be useful for the government and banks to monitor the spread of the default status. It also provides insight for taking precautionary measures to prevent and dissolve systematic financial risk. We implement the system with case studies using real-world bank loan data. Two financial experts are consulted to endorse the developed tool. To the best of our knowledge, this is the first visual analytics tool developed to explore networked-guarantee loan risks in a systematic manner.
---
paper_title: Spatiotemporal social media analytics for abnormal event detection and examination using seasonal-trend decomposition

paper_content:

Recent advances in technology have enabled social media services to support space-time indexed data, and internet users from all over the world have created a large volume of time-stamped, geo-located data. Such spatiotemporal data has immense value for increasing situational awareness of local events, providing insights for investigations and understanding the extent of incidents, their severity, and consequences, as well as their time-evolving nature. In analyzing social media data, researchers have mainly focused on finding temporal trends according to volume-based importance. Hence, a relatively small volume of relevant messages may easily be obscured by a huge data set indicating normal situations. In this paper, we present a visual analytics approach that provides users with scalable and interactive social media data analysis and visualization including the exploration and examination of abnormal topics and events within various social media data sources, such as Twitter, Flickr and YouTube. In order to find and understand abnormal events, the analyst can first extract major topics from a set of selected messages and rank them probabilistically using Latent Dirichlet Allocation. He can then apply seasonal trend decomposition together with traditional control chart methods to find unusual peaks and outliers within topic time series. Our case studies show that situational awareness can be improved by incorporating the anomaly and trend examination techniques into a highly interactive visual analysis process.
---
paper_title: Discovery, Retrieval, and Analysis of the 'Star Wars' Botnet in Twitter

paper_content:

It is known that many Twitter users are bots, which are accounts controlled and sometimes created by computers. Twitter bots can send spam tweets, manipulate public opinion and be used for online fraud. Here we report the discovery, retrieval, and analysis of the 'Star Wars' botnet in Twitter, which consists of more than 350,000 bots tweeting random quotations exclusively from Star Wars novels. The botnet contains a single type of bot, showing exactly the same properties throughout the botnet. It is unusually large, many times larger than other available datasets. It provides a valuable source of ground truth for research on Twitter bots. We analysed and revealed rich details on how the botnet was designed and created. As of this writing, the Star Wars bots are still alive in Twitter. They have survived since their creation in 2013, despite the increasing efforts in recent years to detect and remove Twitter bots. We also reflect on the 'unconventional' way in which we discovered the Star Wars bots, and discuss the current problems and future challenges of Twitter bot detection.
---
paper_title: TargetVue: Visual Analysis of Anomalous User Behaviors in Online Communication Systems

paper_content:

Users with anomalous behaviors in online communication systems (e.g. email and social medial platforms) are potential threats to society. Automated anomaly detection based on advanced machine learning techniques has been developed to combat this issue; challenges remain, though, due to the difficulty of obtaining proper ground truth for model training and evaluation. Therefore, substantial human judgment on the automated analysis results is often required to better adjust the performance of anomaly detection. Unfortunately, techniques that allow users to understand the analysis results more efficiently, to make a confident judgment about anomalies, and to explore data in their context, are still lacking. In this paper, we propose a novel visual analysis system, TargetVue, which detects anomalous users via an unsupervised learning model and visualizes the behaviors of suspicious users in behavior-rich context through novel visualization designs and multiple coordinated contextual views. Particularly, TargetVue incorporates three new ego-centric glyphs to visually summarize a user's behaviors which effectively present the user's communication activities, features, and social interactions. An efficient layout method is proposed to place these glyphs on a triangle grid, which captures similarities among users and facilitates comparisons of behaviors of different users. We demonstrate the power of TargetVue through its application in a social bot detection challenge using Twitter data, a case study based on email records, and an interview with expert users. Our evaluation shows that TargetVue is beneficial to the detection of users with anomalous communication behaviors.
---
paper_title: NVisionIP: netflow visualizations of system state for security situational awareness

paper_content:

The number of attacks against large computer systems is currently growing at a rapid pace. Despite the best efforts of security analysts, large organizations are having trouble keeping on top of the current state of their networks. In this paper, we describe a tool called NVisionIP that is designed to increase the security analyst's situational awareness. As humans are inherently visual beings, NVisionIP uses a graphical representation of a class-B network to allow analysts to quickly visualize the current state of their network. We present an overview of NVisionIP along with a discussion of various types of security-related scenarios that it can be used to detect.
---
paper_title: Business Process Impact Visualization and Anomaly Detection

paper_content:

Business operations involve many factors and relationships and are modeled as complex business process workflows. The execution of these business processes generates vast volumes of complex data. The operational data are instances of the process flow, taking different paths through the process. The goal is to use the complex information to analyze and improve operations and to optimize the process flow. In this paper, we introduce a new visualization technique, called Vislmpact that turns raw operational business data into valuable information. Vislmpact reduces data complexity by analyzing operational data and abstracting the most critical factors, called impact factors, which influence business operations. The analysis may identify single nodes of the business flow graph as important factors but it may also determine aggregations of nodes to be important. Moreover, the analysis may find that single nodes have certain data values associated with them which have an influence on some business metrics or resource usage parameters. The impact factors are presented as nodes in a symmetric circular graph, providing insight into core business operations and relationships. A cause-effect mechanism is built in to determine 'good' and 'bad' operational behavior and to take action accordingly. We have applied Vislmpact to real-world applications, fraud analysis and service contract analysis, to show the power of Vislmpact for finding relationships among the most important impact factors and for immediate identification of anomalies. The Vislmpact system provides a highly interactive interface including drilldown capabilities down to transaction levels to allow multilevel views of business dynamics.
---
paper_title: Visualizing graph dynamics and similarity for enterprise network security and management

paper_content:

Managing complex enterprise networks requires an understanding at a finer granularity than traditional network monitoring. The ability to correlate and visualize the dynamics and inter-relationships among various network components such as hosts, users, and applications is non-trivial. In this paper, we propose a visualization approach based on the hierarchical structure of similarity/difference visualization in the context of heterogeneous graphs. The concept of hierarchical visualization starts with the evolution of inter-graph states, adapts to the visualization of intra-graph clustering, and concludes with the visualization of similarity between individual nodes. Our visualization tool, ENAVis (Enterprise Network Activities Visualization), quantifies and presents these important changes and dynamics essential to network operators through a visually appealing and highly interactive manner. Through novel graph construction and transformation, such as network connectivity graphs, MDS graphs, bipartite graphs, and similarity graphs, we demonstrate how similarity/dynamics can be effectively visualized to provide insight with regards to network understanding.
---
paper_title: Lessons Learned Developing a Visual Analytics Solution for Investigative Analysis of Scamming Activities

paper_content:

The forensic investigation of communication datasets which contain unstructured text, social network information, and metadata is a complex task that is becoming more important due to the immense amount of data being collected. Currently there are limited approaches that allow an investigator to explore the network, text and metadata in a unified manner. We developed Beagle as a forensic tool for email datasets that allows investigators to flexibly form complex queries in order to discover important information in email data. Beagle was successfully deployed at a security firm which had a large email dataset that was difficult to properly investigate. We discuss our experience developing Beagle as well as the lessons we learned applying visual analytic techniques to a difficult real-world problem.
---
paper_title: A visualization paradigm for network intrusion detection

paper_content:

We present a novel paradigm for visual correlation of network alerts from disparate logs. This paradigm facilitates and promotes situational awareness in complex network environments. Our approach is based on the notion that, by definition, an alert must possess three attributes, namely: what, when, and where. This fundamental premise, which we term w/sup 3/, provides a vehicle for comparing between seemingly disparate events. We propose a concise and scalable representation of these three attributes, that leads to a flexible visualization tool that is also clear and intuitive to use. Within our system, alerts can be grouped and viewed hierarchically with respect to both their type, i.e., the what, and to their where attributes. Further understanding is gained by displaying the temporal distribution of alerts to reveal complex attack trends. Finally, we propose a set of visual metaphor extensions that augment the proposed paradigm and enhance users' situational awareness. These metaphors direct the attention of users to many-to-one correlations within the current display helping them detect abnormal network activity.
---
paper_title: Data Flow Analysis and Visualization for Spatiotemporal Statistical Data without Trajectory Information

paper_content:

Geographic visualization research has focused on a variety of techniques to represent and explore spatiotemporal data. The goal of those techniques is to enable users to explore events and interactions over space and time in order to facilitate the discovery of patterns, anomalies and relationships within the data. However, it is difficult to extract and visualize data flow patterns over time for non-directional statistical data without trajectory information. In this work, we develop a novel flow analysis technique to extract, represent, and analyze flow maps of non-directional spatiotemporal data unaccompanied by trajectory information. We estimate a continuous distribution of these events over space and time, and extract flow fields for spatial and temporal changes utilizing a gravity model. Then, we visualize the spatiotemporal patterns in the data by employing flow visualization techniques. The user is presented with temporal trends of geo-referenced discrete events on a map. As such, overall spatiotemporal data flow patterns help users analyze geo-referenced temporal events, such as disease outbreaks, crime patterns, etc. To validate our model, we discard the trajectory information in an origin-destination dataset and apply our technique to the data and compare the derived trajectories and the original. Finally, we present spatiotemporal trend analysis for statistical datasets including twitter data, maritime search and rescue events, and syndromic surveillance.
---
paper_title: Fraud detection using self-organizing map visualizing the user profiles

paper_content:

We propose a fraud detection method based on the user accounts visualization and threshold-type detection. The visualization technique employed in our approach is the Self-Organizing Map (SOM). Since the SOM technique in its original form visualizes only the vectors, and the user accounts are represented in our work as the matrices storing a collection of records reflecting the user sequential activities, we propose a method of the matrices visualization on the SOM grid, which constitutes the main contribution of this paper. Furthermore, we propose a method of the detection threshold setting on the basis of the SOM U-matrix. The results of the conducted experimental study on real data in three different research fields confirm the advantages and effectiveness of the proposed approach.
---
paper_title: Characterising group-cycling journeys using interactive graphics

paper_content:

The group-cycling behaviours of over 16,000 members of the London Cycle Hire Scheme (LCHS), a large public bikeshare system, are identified and analysed. Group journeys are defined as trips made by two or more cyclists together in space and time. Detailed insights into group-cycling behaviour are generated using specifically designed visualization software. We find that in many respects group-cycle journeys fit an expected pattern of discretionary activity: group journeys are more likely at weekends, late evenings and lunchtimes; they generally take place within more pleasant parts of the city; and between individuals apparently known to each other. A separate set of group activity is found, however, that coincides with commuting peaks and that appears to be imposed onto LCHS users by the scheme’s design. Studying the characteristics of individuals making group journeys, we identify a group of less experienced LCHS cyclists that appear to make more spatially extensive journeys than they would do normally while cycling with others; and that female cyclists are more likely to make late evening journeys when cycling in groups. For 20% of group cyclists, the first journey ever made through the LCHS was a group journey; this is particularly surprising since just 9% of all group cyclists’ journeys are group journeys. Moreover, we find that women are very significantly (p < 0.001) overrepresented amongst these ‘first time group cyclists’. Studying the bikeshare cyclists, or bike share ‘friends’, that individuals make ‘first time group journeys’ with, we find a significantly high incidence (p < 0.001) of group journeys being made with friends of the opposite gender, and for a very large proportion (55%) of members these first ever journeys are made with a friend that shares the same postcode. A substantial insight, then, is that group cycling appears to be a means through which early LCHS usage is initiated.
---
paper_title: Spatiotemporal anomaly detection through visual analysis of geolocated Twitter messages

paper_content:

Analyzing message streams from social blogging services such as Twitter is a challenging task because of the vast number of documents that are produced daily. At the same time, the availability of geolocated, realtime, and manually created status updates are an invaluable data source for situational awareness scenarios. In this work we present an approach that allows for an interactive analysis of location-based microblog messages in realtime by means of scalable aggregation and geolocated text visualization. For this purpose, we use a novel cluster analysis approach and distinguish between local event reports and global media reaction to detect spatiotemporal anomalies automatically. A workbench allows the scalable visual examination and analysis of messages featuring perspective and semantic layers on a world map representation. Our novel techniques can be used by analysts to classify the presented event candidates and examine them on a global scale.
---
paper_title: EVA: Visual Analytics to Identify Fraudulent Events

paper_content:

Financial institutions are interested in ensuring security and quality for their customers. Banks, for instance, need to identify and stop harmful transactions in a timely manner. In order to detect fraudulent operations, data mining techniques and customer profile analysis are commonly used. However, these approaches are not supported by Visual Analytics techniques yet. Visual Analytics techniques have potential to considerably enhance the knowledge discovery process and increase the detection and prediction accuracy of financial fraud detection systems. Thus, we propose EVA, a Visual Analytics approach for supporting fraud investigation, fine-tuning fraud detection algorithms, and thus, reducing false positive alarms.
---
paper_title: Analyzing high-dimensional multivaríate network links with integrated anomaly detection, highlighting and exploration

paper_content:

This paper focuses on the integration of a family of visual analytics techniques for analyzing high-dimensional, multivariate network data that features spatial and temporal information, network connections, and a variety of other categorical and numerical data types. Such data types are commonly encountered in transportation, shipping, and logistics industries. Due to the scale and complexity of the data, it is essential to integrate techniques for data analysis, visualization, and exploration. We present new visual representations, Petal and Thread, to effectively present many-to-many network data including multi-attribute vectors. In addition, we deploy an information-theoretic model for anomaly detection across varying dimensions, displaying highlighted anomalies in a visually consistent manner, as well as supporting a managed process of exploration. Lastly, we evaluate the proposed methodology through data exploration and an empirical study.
---
paper_title: Combining Computational Analyses and Interactive Visualization for Document Exploration and Sensemaking in Jigsaw

paper_content:

Investigators across many disciplines and organizations must sift through large collections of text documents to understand and piece together information. Whether they are fighting crime, curing diseases, deciding what car to buy, or researching a new field, inevitably investigators will encounter text documents. Taking a visual analytics approach, we integrate multiple text analysis algorithms with a suite of interactive visualizations to provide a flexible and powerful environment that allows analysts to explore collections of documents while sensemaking. Our particular focus is on the process of integrating automated analyses with interactive visualizations in a smooth and fluid manner. We illustrate this integration through two example scenarios: An academic researcher examining InfoVis and VAST conference papers and a consumer exploring car reviews while pondering a purchase decision. Finally, we provide lessons learned toward the design and implementation of visual analytics systems for document exploration and understanding.
---
paper_title: A visual analytics process for maritime resource allocation and risk assessment

paper_content:

In this paper, we present our collaborative work with the U.S. Coast Guard's Ninth District and Atlantic Area Commands where we developed a visual analytics system to analyze historic response operations and assess the potential risks in the maritime environment associated with the hypothetical allocation of Coast Guard resources. The system includes linked views and interactive displays that enable the analysis of trends, patterns and anomalies among the U.S. Coast Guard search and rescue (SAR) operations and their associated sorties. Our system allows users to determine the potential change in risks associated with closing certain stations in terms of response time, potential lives and property lost and provides optimal direction as to the nearest available station. We provide maritime risk assessment tools that allow analysts to explore Coast Guard coverage for SAR operations and identify regions of high risk. The system also enables a thorough assessment of all SAR operations conducted by each Coast Guard station in the Great Lakes region. Our system demonstrates the effectiveness of visual analytics in analyzing risk within the maritime domain and is currently being used by analysts at the Coast Guard Atlantic Area.
---
paper_title: MVSec: multi-perspective and deductive visual analytics on heterogeneous network security data

paper_content:

In this article, we present a visual analytics system, MVSec, which helps analysts understand better what information flows under network security datasets. The major contributions of this work include: (1) a data fusion strategy for multiple heterogeneous datasets by using unified event tuple and statistic tuple data structure, which compress large scale datasets and lays the foundation of cooperative visual analysis; (2) multiple coordinated views, which provide analysts with multiple visual perspectives to characterize loud events, dig out subtle events and investigate relations of events in datasets; and (3) a contextual visual analysis with deductive viewpoints, which inspires analysts to explore hypotheses and reason their deductions from visual narratives. In case studies, we demonstrate in detail how the system helps analysts draw an analytical storyline and understand network situations better in VAST Challenge 2013. Additionally, we discuss lessons learned in designing our system and participating in VAST Challenge 2013, which is helpful and applicable not only to similar network security systems but also to other domains facing visual analytics challenges.
---
paper_title: SpiralView: Towards Security Policies Assessment through Visual Correlation of Network Resources with Evolution of Alarms

paper_content:

This article presents SpiralView, a visualization tool for helping system administrators to assess network policies. The tool is meant to be a complementary support to the routine activity of network monitoring, enabling a retrospective view on the alarms generated during and extended period of time. The tool permits to reason about how alarms distribute over time and how they correlate with network resources (e.g., users, IPs, applications, etc.), supporting the analysts in understanding how the network evolves and thus in devising new security policies for the future. The spiral visualization plots alarms in time, and, coupled with interactive bar charts and a users/applications graph view, is used to present network data and perform queries. The user is able to segment the data in meaningful subsets, zoom on specific related information, and inspect for relationships between alarms, users, and applications. In designing the visualizations and their interaction, and through tests with security experts, several ameliorations over the standard techniques have been provided.
---
paper_title: A Visual Analytics Approach for Detecting and Understanding Anomalous Resident Behaviors in Smart Healthcare

paper_content:

With the development of science and technology, it is possible to analyze residents’ daily behaviors for the purpose of smart healthcare in the smart home environment. Many researchers have begun to detect residents’ anomalous behaviors and assess their physical condition, but these approaches used by the researchers are often caught in plight caused by a lack of ground truth, one-sided analysis of behavior, and difficulty of understanding behaviors. In this paper, we put forward a smart home visual analysis system (SHVis) to help analysts detect and comprehend unusual behaviors of residents, and predict the health information intelligently. Firstly, the system classifies daily activities recorded by sensor devices in smart home environment into different categories, and discovers unusual behavior patterns of residents living in this environment by using various characteristics extracted from those activities and appropriate unsupervised anomaly detection algorithm. Secondly, on the basis of figuring out the residents’ anomaly degree of every date, we explore the daily behavior patterns and details with the help of several visualization views, and compare and analyze residents’ activities of various dates to find the reasons why residents act unusually. In the case study of this paper, we analyze residents’ behaviors that happened over two months and find unusual indoor behaviors and give health advice to the residents.
---
paper_title: Visual analysis of people's mobility pattern from mobile phone data

paper_content:

The large amount of phone call records from mobile operators in a city can inform us how many people are present in any given area and how many are entering or leaving. Each phone call record usually contains the caller and callee IDs, date and time, and the base station where the phone calls are made. As mobile phones are widely used in our daily life, many human behaviors can be revealed by analyzing mobile phone data. In this paper, we propose a comprehensive visual analysis system which can be used to analyze the population's mobility patterns from millions of phone call records. Our system consists of three major components: 1) visual analysis of user groups in a base station; 2) visual analysis of the mobility patterns on different user groups making phone calls in certain base stations; 3) visual analysis of handoff phone call records. Some well-established visualization techniques such as parallel coordinates and pixel-based representations have been integrated into our system. We also develop a novel visualization schemes, Voronoi-diagram-based visual encoding to reveal the unique features of mobile phone data. We have applied our system to real mobile phone data collected in a large city and obtained some interesting findings regarding people's mobility pattern.
---
paper_title: Case study: interactive visualization for internet security

paper_content:

Internet connectivity is defined by a set of routing protocols which let the routers that comprise the Internet backbone choose the best route for a packet to reach its destination. One way to improve the security and performance of Internet is to routinely examine the routing data. In this case study, we show how interactive visualization of Border Gateway Protocol (BGP) data helps characterize routing behavior, identify weaknesses in connectivity which could potentially cripple the Internet, as well as detect and explain actual anomalous events.
---
paper_title: Visual Analytics for Fraud Detection: Focusing on Profile Analysis

paper_content:

Financial institutions are always interested in ensuring security and quality for their customers. Banks, for instance, need to identify and avoid harmful transactions. In order to detect fraudulent operations, data mining techniques based on customer profile generation and verification are commonly used. However, these approaches are not supported by Visual Analytics techniques yet. We propose a Visual Analytics approach for supporting and fine-tuning profile analysis and reducing false positive alarms.
---
paper_title: #FluxFlow: Visual Analysis of Anomalous Information Spreading on Social Media

paper_content:

We present FluxFlow, an interactive visual analysis system for revealing and analyzing anomalous information spreading in social media. Everyday, millions of messages are created, commented, and shared by people on social media websites, such as Twitter and Facebook. This provides valuable data for researchers and practitioners in many application domains, such as marketing, to inform decision-making. Distilling valuable social signals from the huge crowd's messages, however, is challenging, due to the heterogeneous and dynamic crowd behaviors. The challenge is rooted in data analysts' capability of discerning the anomalous information behaviors, such as the spreading of rumors or misinformation, from the rest that are more conventional patterns, such as popular topics and newsworthy events, in a timely fashion. FluxFlow incorporates advanced machine learning algorithms to detect anomalies, and offers a set of novel visualization designs for presenting the detected threads for deeper analysis. We evaluated FluxFlow with real datasets containing the Twitter feeds captured during significant events such as Hurricane Sandy. Through quantitative measurements of the algorithmic performance and qualitative interviews with domain experts, the results show that the back-end anomaly detection model is effective in identifying anomalous retweeting threads, and its front-end interactive visualizations are intuitive and useful for analysts to discover insights in data and comprehend the underlying analytical model.
---
paper_title: An advanced network visualization system for financial crime detection

paper_content:

We present a new system, VISFAN, for the visual analysis of financial activity networks. It supports the analyst with effective tools to discover financial crimes, like money laundering and frauds. If compared with other existing systems and methodologies for the analysis of criminal networks, VISFAN presents the following main novelties: (i) It combines bottom-up and top-down interaction paradigms for the visual exploration of complex networks; (ii) It makes it possible to mix automatic and manual clustering; (iii) It allows the analyst to interactively customize the dimensions of each cluster region and to apply different geometric constraints on the layout. VISFAN also implements several tools for social network analysis other than clustering. For example, it computes several indices to measure the centrality of each actor in the network.
---
paper_title: Visual pattern discovery in timed event data

paper_content:

and trigger internal processes. Strict requirements on interval-scaled temporal patterns, which are common in time series, are thereby released through the ordinal character of such events. It is this additional degree of freedom that opens unexplored possibilities for visualizing event data. In this paper, we present a
---
paper_title: Scalable and Interactive Visual Analysis of Financial Wire Transactions for Fraud Detection

paper_content:

Large financial institutions such as Bank of America handle hundreds of thousands of wire transactions per day. Although most transactions are legitimate, these institutions have legal and financial obligations to discover those that are suspicious. With the methods of fraudulent activities ever changing, searching on predefined patterns is often insufficient in detecting previously undiscovered methods. In this paper, we present a set of coordinated visualizations based on identifying specific keywords within the wire transactions. The different views used in our system depict relationships among keywords and accounts over time. Furthermore, we introduce a search-by-example technique, which extracts accounts that show similar transaction patterns. Our system can be connected to a database to handle millions of transactions and still preserve high interactivity. In collaboration with the Anti-Money Laundering division at Bank of America, we demonstrate that using our tool, investigators are able to detect accounts and transactions that exhibit suspicious behaviors.
---
paper_title: Network analysis of collaboration structure in Wikipedia

paper_content:

In this paper we give models and algorithms to describe and analyze the collaboration among authors of Wikipedia from a network analytical perspective. The edit network encodes who interacts how with whom when editing an article; it significantly extends previous network models that code author communities in Wikipedia. Several characteristics summarizing some aspects of the organization process and allowing the analyst to identify certain types of authors can be obtained from the edit network. Moreover, we propose several indicators characterizing the global network structure and methods to visualize edit networks. It is shown that the structural network indicators are correlated with quality labels of the associated Wikipedia articles.
---
paper_title: WireVis: Visualization of Categorical, Time-Varying Data From Financial Transactions

paper_content:

Large financial institutions such as Bank of America handle hundreds of thousands of wire transactions per day. Although most transactions are legitimate, these institutions have legal and financial obligations in discovering those that are suspicious. With the methods of fraudulent activities ever changing, searching on predefined patterns is often insufficient in detecting previously undiscovered methods. In this paper, we present a set of coordinated visualizations based on identifying specific keywords within the wire transactions. The different views used in our system depict relationships among keywords and accounts over time. Furthermore, we introduce a search-by-example technique which extracts accounts that show similar transaction patterns. In collaboration with the Anti-Money Laundering division at Bank of America, we demonstrate that using our tool, investigators are able to detect accounts and transactions that exhibit suspicious behaviors.
---
paper_title: VisTracer: a visual analytics tool to investigate routing anomalies in traceroutes

paper_content:

Routing in the Internet is vulnerable to attacks due to the insecure design of the border gateway protocol (BGP). One possible exploitation of this insecure design is the hijacking of IP blocks. Such hijacked IP blocks can then be used to conduct malicious activities from seemingly legitimate IP addresses. In this study we actively trace and monitor the routes to spam sources over several consecutive days after having received a spam message from such a source. However, the real challenge is to distinguish between legitimate routing changes and those ones that are related to systematic misuse in so-called spam campaigns. To combine the strengths of human judgement and computational efficiency, we thus present a novel visual analytics tool named Vistracer in this paper. This tool represents analysis results of our anomaly detection algorithms on large traceroute data sets with the help of several scalable representations to support the analyst to explore, identify and analyze suspicious events and their relations to malicious activities. In particular, pixel-based visualization techniques, novel glyph-based summary representations and a combination of temporal glyphs in a graph representation are used to give an overview of route changes to specific destinations over time. To evaluate our tool, real-world case studies demonstrate the usage of Vistracer in practice on large-scale data sets.
---
paper_title: TVi: a visual querying system for network monitoring and anomaly detection

paper_content:

Monitoring, anomaly detection and forensics are essential tasks that must be carried out routinely for every computer network. The sheer volume of data generated by conventional anomaly detection tools such as Snort often makes it difficult to explain the nature of an attack and track down its source. In this paper we present TVi, a tool that combines multiple visual representations of network traces carefully designed and tightly coupled to support different levels of visual-based querying and reasoning required for making sense of complex traffic data. TVi allows analysts to visualize data starting at a high level, providing information related to the entire network, and easily move all the way down to a very low level, providing detailed information about selected hosts, anomalies and attack paths. We designed TVi with scalability and extensibility in mind: its DBMS foundations make it scalable with virtually no limitations, and other state-of-the-art IDS, like Snort or Bro, can be easily integrated in our tool. We demonstrate with two case studies, a synthetic dataset (DARPA 1999) and a real one (University of Brescia, UniBS, 2009), how TVi can enhance a network administrator's ability to reveal hidden patterns in network traces and link their key information so as to easily reveal details that by merely observing Snort's output would go unnoticed. We make TVi's source code available to the community under an Open Source license.
---
paper_title: Predictive visual analytics of event evolution for user-created context

paper_content:

AbstractDigital big data provide the vast potential of increasing effectiveness and efficiency for decision making. Since the volume of the data is enormous, the data analysis requires large amount of time and effort. It is more problematic when predictive analysis is necessary for futuristic decision making. For predictive analysis, there have been many studies to forecast future trends spatio-temporally. However, most of studies provide just future tendency per event using graphs or maps without contextual compositive analysis. In this paper, we present a predictive visual analytics system to provide predictive event patterns. We infer the future event evolution by combining contextually similar cases occurring in the past. We utilize social media data to detect interesting abnormal events and match the detected abnormal events within the past news media data to retrieve similar event patterns. Then, we extract future event patterns through compositing contextual relationship among topics included in the similar past patterns. To evaluate our VA system, we demonstrate three use cases in this paper and validate our system with possible predictive story lines. In addition, we present an informal user study and feedback to validate the effectiveness of our system and improve the system in the future.Graphical AbstractGraphical Abstract text
---
paper_title: CloudLines: Compact Display of Event Episodes in Multiple Time-Series

paper_content:

We propose incremental logarithmic time-series technique as a way to deal with time-based representations of large and dynamic event data sets in limited space. Modern data visualization problems in the domains of news analysis, network security and financial applications, require visual analysis of incremental data, which poses specific challenges that are normally not solved by static visualizations. The incremental nature of the data implies that visualizations have to necessarily change their content and still provide comprehensible representations. In particular, in this paper we deal with the need to keep an eye on recent events together with providing a context on the past and to make relevant patterns accessible at any scale. Our technique adapts to the incoming data by taking care of the rate at which data items occur and by using a decay function to let the items fade away according to their relevance. Since access to details is also important, we also provide a novel distortion magnifying lens technique which takes into account the distortions introduced by the logarithmic time scale to augment readability in selected areas of interest. We demonstrate the validity of our techniques by applying them on incremental data coming from online news streams in different time frames.
---
paper_title: Network Explorer: Design, Implementation, and Real World Deployment of a Large Network Visualization Tool

paper_content:

This paper describes the process of design, implementation, and real world deployment of a web-based network exploration tool called Network Explorer. We designed Network Explorer based on the expressed needs of our clients and later deployed it as part of a larger system for fraud detection in health care. Our implementation of Network Explorer provides visual interactive access to large-scale network data. As part of the Network Explorer tool we contribute a dynamic group-in-a-box implementation for laying out clusters, and a node navigator widget that aids in the exploration of large networks. We are also contributing two open source components of the Network Explorer for the community to reuse: an in-browser clustering library, and the dynamic group-in-a-box algorithm. We have evaluated the network explorer tool in multiple real-world environments including the fraud detection setting above.
---
paper_title: Interactive Visualization of Normal Behavioral Models and Expert Rules for Maritime Anomaly Detection

paper_content:

Maritime surveillance systems analyze vast amounts of heterogeneous sensor data from a large number of objects. In order to support the operator while monitoring such systems, the identification of anomalous vessels or situations that might need further investigation may reduce the operator's cognitive load. While it is worth acknowledging that many existing mining applications support identification of anomalous behavior, autonomous anomaly detection systems are rarely used in the real world, since the detection of anomalous behavior is normally not a well-defined problem and therefore, human expert knowledge is needed. This calls for the development of interaction components that can support the user in the detection process. In order to support the comprehension of the knowledge embedded in the system, we propose an interactive way of visualizing expert rules and normal behavioral models built from the data. The overall goal is to facilitate the validation and update of these models and signatures, supporting the insertion of human expert knowledge while improving confidence and trust in the system.
---
paper_title: Visualizing and Discovering Non-Trivial Patterns in Large Time Series Databases

paper_content:

Data visualization techniques are very important for data analysis, since the human eye has been frequently advocated as the ultimate data-mining tool. However, there has been surprisingly little work on visualizing massive time series data sets. To this end, we developed VizTree, a time series pattern discovery and visualization system based on augmenting suffix trees. VizTree visually summarizes both the global and local structures of time series data at the same time. In addition, it provides novel interactive solutions to many pattern discovery problems, including the discovery of frequently occurring patterns (motif discovery), surprising patterns (anomaly detection), and query by content. VizTree works by transforming the time series into a symbolic representation, and encoding the data in a modified suffix tree in which the frequency and other properties of patterns are mapped onto colors and other visual properties. We demonstrate the utility of our system by comparing it with state-of-the-art batch algorithms on several real and synthetic data sets. Based on the tree structure, we further device a coefficient which measures the dissimilarity between any two time series. This coefficient is shown to be competitive with the well-known Euclidean distance.
---
paper_title: MobiVis: A Visualization System for Exploring Mobile Data

paper_content:

The widespread use of mobile devices brings opportunities to capture large-scale, continuous information about human behavior. Mobile data has tremendous value, leading to business opportunities, market strategies, security concerns, etc. Visual analytics systems that support interactive exploration and discovery are needed to extracting insight from the data. However, visual analysis of complex social-spatial-temporal mobile data presents several challenges. We have created MobiVis, a visual analytics tool, which incorporates the idea of presenting social and spatial information in one heterogeneous network. The system supports temporal and semantic filtering through an interactive time chart and ontology graph, respectively, such that data subsets of interest can be isolated for close-up investigation. "Behavior rings," a compact radial representation of individual and group behaviors, is introduced to allow easy comparison of behavior patterns. We demonstrate the capability of MobiVis with the results obtained from analyzing the MIT Reality Mining dataset.
---
paper_title: Measuring geographical regularities of crowd behaviors for Twitter-based geo-social event detection

paper_content:

Recently, microblogging sites such as Twitter have garnered a great deal of attention as an advanced form of location-aware social network services, whereby individuals can easily and instantly share their most recent updates from any place. In this study, we aim to develop a geo-social event detection system by monitoring crowd behaviors indirectly via Twitter. In particular, we attempt to find out the occurrence of local events such as local festivals; a considerable number of Twitter users probably write many posts about these events. To detect such unusual geo-social events, we depend on geographical regularities deduced from the usual behavior patterns of crowds with geo-tagged microblogs. By comparing these regularities with the estimated ones, we decide whether there are any unusual events happening in the monitored geographical area. Finally, we describe the experimental results to evaluate the proposed unusuality detection method on the basis of geographical regularities obtained from a large number of geo-tagged tweets around Japan via Twitter.
---
paper_title: Combining visual and automated data mining for near-real-time anomaly detection and analysis in BGP

paper_content:

The security of Internet routing is a major concern because attacks and errors can result in data packets not reaching their intended destination and/or falling into the wrong hands. A key step in improving routing security is to analyze and understand it. In the past, we and other researchers have presented various visual-based, statistical-based, and signature-based methods of analyzing Internet routing data. In this paper, we describe an integration of visual and automated data mining methods for discovering and investigating anomalies in Internet routing. We show how these different components are combined in such a way as to complement each other, creating a very effective and useful analysis tool. In addition to performing analysis on archived data, our system is able to collect, process and visualize data in near-real-time.
---
paper_title: EventRiver: Visually Exploring Text Collections with Temporal References

paper_content:

Many text collections with temporal references, such as news corpora and weblogs, are generated to report and discuss real life events. Thus, event-related tasks, such as detecting real life events that drive the generation of the text documents, tracking event evolutions, and investigating reports and commentaries about events of interest, are important when exploring such text collections. To incorporate and leverage human efforts in conducting such tasks, we propose a novel visual analytics approach named EventRiver. EventRiver integrates event-based automated text analysis and visualization to reveal the events motivating the text generation and the long term stories they construct. On the visualization, users can interactively conduct tasks such as event browsing, tracking, association, and investigation. A working prototype of EventRiver has been implemented for exploring news corpora. A set of case studies, experiments, and a preliminary user test have been conducted to evaluate its effectiveness and efficiency.
---
paper_title: Detecting flaws and intruders with visual data analysis

paper_content:

The task of sifting through large amounts of data to find useful information spawned the field of data mining. Most data mining approaches are based on machine-learning techniques, numerical analysis, or statistical modeling. They use human interaction and visualization only minimally. Such automatic methods can miss some important features of the data. Incorporating human perception into the data mining process through interactive visualization can help us better understand the complex behaviors of computer network systems. This article describes visual-analytics-based solutions and outlines a visual exploration process for log analysis. Three log-file analysis applications demonstrate our approach's effectiveness in discovering flaws and intruders in network systems.
---
paper_title: FraudVis: Understanding Unsupervised Fraud Detection Algorithms

paper_content:

Discovering fraud user behaviors is vital to keeping online websites healthy. Fraudsters usually exhibit grouping behaviors, and researchers have effectively leveraged this behavior to design unsupervised algorithms to detect fraud user groups. In this work, we propose a visualization system, FraudVis, to visually analyze the unsupervised fraud detection algorithms from temporal, intra-group correlation, inter-group correlation, feature selection, and the individual user perspectives. FraudVis helps domain experts better understand the algorithm output and the detected fraud behaviors. Meanwhile, FraudVis also helps algorithm experts to fine-tune the algorithm design through the visual comparison. By using the visualization system, we solve two real-world cases of fraud detection, one for a social video website and another for an e-commerce website. The results on both cases demonstrate the effectiveness of FraudVis in understanding unsupervised fraud detection algorithms.
---
paper_title: A Visual Analytics Approach to Understanding Spatiotemporal Hotspots

paper_content:

As data sources become larger and more complex, the ability to effectively explore and analyze patterns among varying sources becomes a critical bottleneck in analytic reasoning. Incoming data contain multiple variables, high signal-to-noise ratio, and a degree of uncertainty, all of which hinder exploration, hypothesis generation/exploration, and decision making. To facilitate the exploration of such data, advanced tool sets are needed that allow the user to interact with their data in a visual environment that provides direct analytic capability for finding data aberrations or hotspots. In this paper, we present a suite of tools designed to facilitate the exploration of spatiotemporal data sets. Our system allows users to search for hotspots in both space and time, combining linked views and interactive filtering to provide users with contextual information about their data and allow the user to develop and explore their hypotheses. Statistical data models and alert detection algorithms are provided to help draw user attention to critical areas. Demographic filtering can then be further applied as hypotheses generated become fine tuned. This paper demonstrates the use of such tools on multiple geospatiotemporal data sets.
---
paper_title: NStreamAware: real-time visual analytics for data streams to enhance situational awareness

paper_content:

The analysis of data streams is important in many security-related domains to gain situational awareness. To provide monitoring and visual analysis of such data streams, we propose a system, called NStreamAware, that uses modern distributed processing technologies to analyze streams using stream slices, which are presented to analysts in a web-based visual analytics application, called NVisAware. Furthermore, we visually guide the user in the feature selection process to summarize the slices to focus on the most interesting parts of the stream based on introduced expert knowledge of the analyst. We show through case studies, how the system can be used to gain situational awareness and eventually enhance network security. Furthermore, we apply the system to a social media data stream to compete in an international challenge to evaluate the applicability of our approach to other domains.
---
paper_title: Visualizing the insider threat: challenges and tools for identifying malicious user activity

paper_content:

One of the greatest challenges for managing organisational cyber security is the threat that comes from those who operate within the organisation. With entitled access and knowledge of organisational processes, insiders who choose to attack have the potential to cause serious impact, such as financial loss, reputational damage, and in severe cases, could even threaten the existence of the organisation. Security analysts therefore require sophisticated tools that allow them to explore and identify user activity that could be indicative of an imminent threat to the organisation. In this work, we discuss the challenges associated with identifying insider threat activity, along with the tools that can help to combat this problem. We present a visual analytics approach that incorporates multiple views, including a user selection tool that indicates anomalous behaviour, an interactive Principal Component Analysis (iPCA) tool that aids the analyst to assess the reasoning behind the anomaly detection results, and an activity plot that visualizes user and role activity over time. We demonstrate our approach using the Carnegie Mellon University CERT Insider Threat Dataset to show how the visual analytics workflow supports the Information-Seeking mantra.
---
paper_title: TelCoVis: Visual Exploration of Co-occurrence in Urban Human Mobility Based on Telco Data

paper_content:

Understanding co-occurrence in urban human mobility (i.e. people from two regions visit an urban place during the same time span) is of great value in a variety of applications, such as urban planning, business intelligence, social behavior analysis, as well as containing contagious diseases. In recent years, the widespread use of mobile phones brings an unprecedented opportunity to capture large-scale and fine-grained data to study co-occurrence in human mobility. However, due to the lack of systematic and efficient methods, it is challenging for analysts to carry out in-depth analyses and extract valuable information. In this paper, we present TelCoVis, an interactive visual analytics system, which helps analysts leverage their domain knowledge to gain insight into the co-occurrence in urban human mobility based on telco data. Our system integrates visualization techniques with new designs and combines them in a novel way to enhance analysts' perception for a comprehensive exploration. In addition, we propose to study the correlations in co-occurrence (i.e. people from multiple regions visit different places during the same time span) by means of biclustering techniques that allow analysts to better explore coordinated relationships among different regions and identify interesting patterns. The case studies based on a real-world dataset and interviews with domain experts have demonstrated the effectiveness of our system in gaining insights into co-occurrence and facilitating various analytical tasks.
---
paper_title: An overview of anomaly detection techniques: Existing solutions and latest technological trends

paper_content:

As advances in networking technology help to connect the distant corners of the globe and as the Internet continues to expand its influence as a medium for communications and commerce, the threat from spammers, attackers and criminal enterprises has also grown accordingly. It is the prevalence of such threats that has made intrusion detection systems-the cyberspace's equivalent to the burglar alarm-join ranks with firewalls as one of the fundamental technologies for network security. However, today's commercially available intrusion detection systems are predominantly signature-based intrusion detection systems that are designed to detect known attacks by utilizing the signatures of those attacks. Such systems require frequent rule-base updates and signature updates, and are not capable of detecting unknown attacks. In contrast, anomaly detection systems, a subset of intrusion detection systems, model the normal system/network behavior which enables them to be extremely effective in finding and foiling both known as well as unknown or ''zero day'' attacks. While anomaly detection systems are attractive conceptually, a host of technological problems need to be overcome before they can be widely adopted. These problems include: high false alarm rate, failure to scale to gigabit speeds, etc. In this paper, we provide a comprehensive survey of anomaly detection systems and hybrid intrusion detection systems of the recent past and present. We also discuss recent technological trends in anomaly detection and identify open problems and challenges in this area.
---
paper_title: Visualization of Communication Patterns in Collaborative Innovation Networks - Analysis of Some W3C Working Groups

paper_content:

Collaborative Innovation Networks (COINs) are groups of self-motivated individuals from various parts of an organization or from multiple organizations, empowered by the Internet, who work together on a new idea, driven by a common vision. In this paper we report first results of a project that examines innovation networks by analyzing the e-mail archives of some W3C (WWW consortium) working groups. These groups exhibit ideal characteristics for our purpose, as they form truly global networks working together over the Internet to develop next generation technologies. We first describe the software tools we developed to visualize the temporal communication flow, which represent communication patterns as directed acyclic graphs, We then show initial results, which revealed significant variations between the communication patterns and network structures of the different groups., We were also able to identify distinctive communication patterns among group leaders, both those who were officially appointed and other who were assuming unofficial coordinating roles.
---
paper_title: Discovery of rating fraud with real-time streaming visual analytics

paper_content:

The rating fraud in online e-commerce stores targets at receiving large revenues through boosting the popularity of selected items with fake ratings. The challenges of detecting rating frauds come from discovering small scale abnormal activities in a large amount of data and detecting frauds in a time-critical manner from online rating streams. This paper presents a real-time visual analytics system that consists of two essential components: a server for automatically handling data streams and a visual analytics interface for performing interactive analysis. Based on the features of rating frauds, we present a detection solution which balances computationally expensive algorithms and interactive analysis between the server and analysts. Specifically, our detection system filters data through performing an initial suspicion level detection on the server, and analysts can combine different statistical analysis of the user / item matrix through a co-mapped singular value decomposition (SVD) diagram, re-ordered matrix representation, and the temporal view. We demonstrate our approach with case studies of different fraud scenarios and show that rating frauds can be effectively detected.
---
paper_title: Visual Analytics for Networked-Guarantee Loans Risk Management

paper_content:

Groups of enterprises can guarantee each other and form complex networks in order to try to obtain loans from banks. Monitoring the financial status of a network, and preventing or reducing systematic risk in case of a crisis, is an area of great concern for the regulatory commission and for the banks. We set the ultimate goal of developing a visual analytic approach and tool for risk dissolving and decision-making. We have consolidated four main analysis tasks conducted by financial experts: i) Multi-faceted Default Risk Visualization, whereby a hybrid representation is devised to predict the default risk and an interface developed to visualize key indicators; ii) Risk Guarantee Patterns Discovery. We follow the Shneiderman mantra guidance for designing interactive visualization applications, whereby an interactive risk guarantee community detection and a motif detection based risk guarantee pattern discovery approach are described; iii) Network Evolution and Retrospective, whereby animation is used to help users to understand the guarantee dynamic; iv) Risk Communication Analysis. The temporal diffusion path analysis can be useful for the government and banks to monitor the spread of the default status. It also provides insight for taking precautionary measures to prevent and dissolve systematic financial risk. We implement the system with case studies using real-world bank loan data. Two financial experts are consulted to endorse the developed tool. To the best of our knowledge, this is the first visual analytics tool developed to explore networked-guarantee loan risks in a systematic manner.
---
paper_title: Spatiotemporal social media analytics for abnormal event detection and examination using seasonal-trend decomposition

paper_content:

Recent advances in technology have enabled social media services to support space-time indexed data, and internet users from all over the world have created a large volume of time-stamped, geo-located data. Such spatiotemporal data has immense value for increasing situational awareness of local events, providing insights for investigations and understanding the extent of incidents, their severity, and consequences, as well as their time-evolving nature. In analyzing social media data, researchers have mainly focused on finding temporal trends according to volume-based importance. Hence, a relatively small volume of relevant messages may easily be obscured by a huge data set indicating normal situations. In this paper, we present a visual analytics approach that provides users with scalable and interactive social media data analysis and visualization including the exploration and examination of abnormal topics and events within various social media data sources, such as Twitter, Flickr and YouTube. In order to find and understand abnormal events, the analyst can first extract major topics from a set of selected messages and rank them probabilistically using Latent Dirichlet Allocation. He can then apply seasonal trend decomposition together with traditional control chart methods to find unusual peaks and outliers within topic time series. Our case studies show that situational awareness can be improved by incorporating the anomaly and trend examination techniques into a highly interactive visual analysis process.
---
paper_title: A visual analytics system to support tax evasion discovery

paper_content:

Abstract This paper describes TaxNet , a decision support system for tax evasion discovery, based on a powerful visual language and on advanced network visualization techniques. It has been developed in cooperation with the Italian Revenue Agency, where it is currently used. TaxNet allows users to visually define classes of suspicious patterns, it exploits effective graph pattern matching technologies to rapidly extract subgraphs that correspond to one or more patterns, it provides facilities to conveniently merge the results, and it implements new ad-hoc centrality indexes to rank taxpayers based on their fiscal risk. Moreover, it offers a visual interface to analyze and interact with those networks that match a desired pattern. The paper discusses the results of an experimental study and some use cases conducted with expert officers on real data and in a real working environment. The experiments give evidence of the effectiveness of our system.
---
paper_title: Discovery, Retrieval, and Analysis of the 'Star Wars' Botnet in Twitter

paper_content:

It is known that many Twitter users are bots, which are accounts controlled and sometimes created by computers. Twitter bots can send spam tweets, manipulate public opinion and be used for online fraud. Here we report the discovery, retrieval, and analysis of the 'Star Wars' botnet in Twitter, which consists of more than 350,000 bots tweeting random quotations exclusively from Star Wars novels. The botnet contains a single type of bot, showing exactly the same properties throughout the botnet. It is unusually large, many times larger than other available datasets. It provides a valuable source of ground truth for research on Twitter bots. We analysed and revealed rich details on how the botnet was designed and created. As of this writing, the Star Wars bots are still alive in Twitter. They have survived since their creation in 2013, despite the increasing efforts in recent years to detect and remove Twitter bots. We also reflect on the 'unconventional' way in which we discovered the Star Wars bots, and discuss the current problems and future challenges of Twitter bot detection.
---
paper_title: Space-time dynamics of topics in streaming text

paper_content:

Human-generated textual data streams from services such as Twitter increasingly become geo-referenced. The spatial resolution of their coverage improves quickly, making them a promising instrument for sensing various aspects of evolution and dynamics of social systems. This work explores spacetime structures of the topical content of short textual messages in a stream available from Twitter in Ireland. It uses a streaming Latent Dirichlet Allocation topic model trained with an incremental variational Bayes method. The posterior probabilities of the discovered topics are post-processed with a spatial kernel density and subjected to comparative analysis. The identified prevailing topics are often found to be spatially contiguous. We apply Markov-modulated non-homogeneous Poisson processes to quantify a proportion of novelty in the observed abnormal patterns. A combined use of these techniques allows for real-time analysis of the temporal evolution and spatial variability of population's response to various stimuli such as large scale sportive, political or cultural events.
---
paper_title: Visual Analysis of Collective Anomalies Through High-Order Correlation Graph

paper_content:

Detecting, analyzing and reasoning collective anomalies is important for many real-life application domains such as facility monitoring, software analysis and security. The main challenges include the overwhelming number of low-risk events and their multifaceted relationships which form the collective anomaly, the diversity in various data and anomaly types, and the difficulty to incorporate domain knowledge in the anomaly analysis process. In this paper, we propose a novel concept of high-order correlation graph (HOCG). Compared with the previous correlation graph definition, HOCG achieves better user interactivity, computational scalability, and domain generality through synthesizing heterogeneous types of nodes, attributes, and multifaceted relationships in a single graph. We design elaborate visual metaphors, interaction models, and the coordinated multiple view based interface to allow users to fully unleash the visual analytics power over HOCG. We conduct case studies in two real-life application domains, i.e., facility monitoring and software analysis. The results demonstrate the effectiveness of HOCG in the overview of point anomalies, detection of collective anomalies, and reasoning process of root cause analysis.
---
paper_title: TargetVue: Visual Analysis of Anomalous User Behaviors in Online Communication Systems

paper_content:

Users with anomalous behaviors in online communication systems (e.g. email and social medial platforms) are potential threats to society. Automated anomaly detection based on advanced machine learning techniques has been developed to combat this issue; challenges remain, though, due to the difficulty of obtaining proper ground truth for model training and evaluation. Therefore, substantial human judgment on the automated analysis results is often required to better adjust the performance of anomaly detection. Unfortunately, techniques that allow users to understand the analysis results more efficiently, to make a confident judgment about anomalies, and to explore data in their context, are still lacking. In this paper, we propose a novel visual analysis system, TargetVue, which detects anomalous users via an unsupervised learning model and visualizes the behaviors of suspicious users in behavior-rich context through novel visualization designs and multiple coordinated contextual views. Particularly, TargetVue incorporates three new ego-centric glyphs to visually summarize a user's behaviors which effectively present the user's communication activities, features, and social interactions. An efficient layout method is proposed to place these glyphs on a triangle grid, which captures similarities among users and facilitates comparisons of behaviors of different users. We demonstrate the power of TargetVue through its application in a social bot detection challenge using Twitter data, a case study based on email records, and an interview with expert users. Our evaluation shows that TargetVue is beneficial to the detection of users with anomalous communication behaviors.
---
paper_title: Episogram: Visual Summarization of Egocentric Social Interactions

paper_content:

The key challenges of visualizing social interaction data include the difficulties of understanding the general structure of social interactions and representing the data in the context of various user activities to reveal different behavior patterns. The design of the proposed interactive visualization tool Episogram is based on an anatomy of social interaction process in which the actors and objects involved can be formally represented as a time-varying tripartite network. The authors show the effectiveness of the proposed technique using real-world datasets and user studies.
---
paper_title: Visualizing graph dynamics and similarity for enterprise network security and management

paper_content:

Managing complex enterprise networks requires an understanding at a finer granularity than traditional network monitoring. The ability to correlate and visualize the dynamics and inter-relationships among various network components such as hosts, users, and applications is non-trivial. In this paper, we propose a visualization approach based on the hierarchical structure of similarity/difference visualization in the context of heterogeneous graphs. The concept of hierarchical visualization starts with the evolution of inter-graph states, adapts to the visualization of intra-graph clustering, and concludes with the visualization of similarity between individual nodes. Our visualization tool, ENAVis (Enterprise Network Activities Visualization), quantifies and presents these important changes and dynamics essential to network operators through a visually appealing and highly interactive manner. Through novel graph construction and transformation, such as network connectivity graphs, MDS graphs, bipartite graphs, and similarity graphs, we demonstrate how similarity/dynamics can be effectively visualized to provide insight with regards to network understanding.
---
paper_title: The spread of low-credibility content by social bots

paper_content:

The massive spread of digital misinformation has been identified as a major threat to democracies. Communication, cognitive, social, and computer scientists are studying the complex causes for the viral diffusion of misinformation, while online platforms are beginning to deploy countermeasures. Little systematic, data-based evidence has been published to guide these efforts. Here we analyze 14 million messages spreading 400 thousand articles on Twitter during ten months in 2016 and 2017. We find evidence that social bots played a disproportionate role in spreading articles from low-credibility sources. Bots amplify such content in the early spreading moments, before an article goes viral. They also target users with many followers through replies and mentions. Humans are vulnerable to this manipulation, resharing content posted by bots. Successful low-credibility sources are heavily supported by social bots. These results suggest that curbing social bots may be an effective strategy for mitigating the spread of online misinformation.Online misinformation is a threat to a well-informed electorate and undermines democracy. Here, the authors analyse the spread of articles on Twitter, find that bots play a major role in the spread of low-credibility content and suggest control measures for limiting the spread of misinformation.
---
paper_title: Data Flow Analysis and Visualization for Spatiotemporal Statistical Data without Trajectory Information

paper_content:

Geographic visualization research has focused on a variety of techniques to represent and explore spatiotemporal data. The goal of those techniques is to enable users to explore events and interactions over space and time in order to facilitate the discovery of patterns, anomalies and relationships within the data. However, it is difficult to extract and visualize data flow patterns over time for non-directional statistical data without trajectory information. In this work, we develop a novel flow analysis technique to extract, represent, and analyze flow maps of non-directional spatiotemporal data unaccompanied by trajectory information. We estimate a continuous distribution of these events over space and time, and extract flow fields for spatial and temporal changes utilizing a gravity model. Then, we visualize the spatiotemporal patterns in the data by employing flow visualization techniques. The user is presented with temporal trends of geo-referenced discrete events on a map. As such, overall spatiotemporal data flow patterns help users analyze geo-referenced temporal events, such as disease outbreaks, crime patterns, etc. To validate our model, we discard the trajectory information in an origin-destination dataset and apply our technique to the data and compare the derived trajectories and the original. Finally, we present spatiotemporal trend analysis for statistical datasets including twitter data, maritime search and rescue events, and syndromic surveillance.
---
paper_title: Twitinfo: aggregating and visualizing microblogs for event exploration

paper_content:

Microblogs are a tremendous repository of user-generated content about world events. However, for people trying to understand events by querying services like Twitter, a chronological log of posts makes it very difficult to get a detailed understanding of an event. In this paper, we present TwitInfo, a system for visualizing and summarizing events on Twitter. TwitInfo allows users to browse a large collection of tweets using a timeline-based display that highlights peaks of high tweet activity. A novel streaming algorithm automatically discovers these peaks and labels them meaningfully using text from the tweets. Users can drill down to subevents, and explore further via geolocation, sentiment, and popular URLs. We contribute a recall-normalized aggregate sentiment visualization to produce more honest sentiment overviews. An evaluation of the system revealed that users were able to reconstruct meaningful summaries of events in a small amount of time. An interview with a Pulitzer Prize-winning journalist suggested that the system would be especially useful for understanding a long-running event and for identifying eyewitnesses. Quantitatively, our system can identify 80-100% of manually labeled peaks, facilitating a relatively complete view of each event studied.
---
paper_title: Fraud detection using self-organizing map visualizing the user profiles

paper_content:

We propose a fraud detection method based on the user accounts visualization and threshold-type detection. The visualization technique employed in our approach is the Self-Organizing Map (SOM). Since the SOM technique in its original form visualizes only the vectors, and the user accounts are represented in our work as the matrices storing a collection of records reflecting the user sequential activities, we propose a method of the matrices visualization on the SOM grid, which constitutes the main contribution of this paper. Furthermore, we propose a method of the detection threshold setting on the basis of the SOM U-matrix. The results of the conducted experimental study on real data in three different research fields confirm the advantages and effectiveness of the proposed approach.
---
paper_title: Characterising group-cycling journeys using interactive graphics

paper_content:

The group-cycling behaviours of over 16,000 members of the London Cycle Hire Scheme (LCHS), a large public bikeshare system, are identified and analysed. Group journeys are defined as trips made by two or more cyclists together in space and time. Detailed insights into group-cycling behaviour are generated using specifically designed visualization software. We find that in many respects group-cycle journeys fit an expected pattern of discretionary activity: group journeys are more likely at weekends, late evenings and lunchtimes; they generally take place within more pleasant parts of the city; and between individuals apparently known to each other. A separate set of group activity is found, however, that coincides with commuting peaks and that appears to be imposed onto LCHS users by the scheme’s design. Studying the characteristics of individuals making group journeys, we identify a group of less experienced LCHS cyclists that appear to make more spatially extensive journeys than they would do normally while cycling with others; and that female cyclists are more likely to make late evening journeys when cycling in groups. For 20% of group cyclists, the first journey ever made through the LCHS was a group journey; this is particularly surprising since just 9% of all group cyclists’ journeys are group journeys. Moreover, we find that women are very significantly (p < 0.001) overrepresented amongst these ‘first time group cyclists’. Studying the bikeshare cyclists, or bike share ‘friends’, that individuals make ‘first time group journeys’ with, we find a significantly high incidence (p < 0.001) of group journeys being made with friends of the opposite gender, and for a very large proportion (55%) of members these first ever journeys are made with a friend that shares the same postcode. A substantial insight, then, is that group cycling appears to be a means through which early LCHS usage is initiated.
---
paper_title: Spatiotemporal anomaly detection through visual analysis of geolocated Twitter messages

paper_content:

Analyzing message streams from social blogging services such as Twitter is a challenging task because of the vast number of documents that are produced daily. At the same time, the availability of geolocated, realtime, and manually created status updates are an invaluable data source for situational awareness scenarios. In this work we present an approach that allows for an interactive analysis of location-based microblog messages in realtime by means of scalable aggregation and geolocated text visualization. For this purpose, we use a novel cluster analysis approach and distinguish between local event reports and global media reaction to detect spatiotemporal anomalies automatically. A workbench allows the scalable visual examination and analysis of messages featuring perspective and semantic layers on a world map representation. Our novel techniques can be used by analysts to classify the presented event candidates and examine them on a global scale.
---
paper_title: Visual Discovery in Computer Network Defense

paper_content:

Computer network defense (CND) requires analysts to detect both known and novel forms of attacks in massive volumes of network data. It's through discovering the unexpected that CND analysts detect new versions of mal ware (such as viruses and Trojan horses) that have passed through their antivirus products, new methods of intrusion that have breached their firewalls and intrusion detection systems (IDSs), and new groups of cyber-criminals pressing the attack. This paper presents visual assistant for information assurance analysis. VIAssist is a visualization framework based on a comprehensive cognitive task analysis of CND analysts, and so fits their work practices and operational environment.
---
paper_title: EVA: Visual Analytics to Identify Fraudulent Events

paper_content:

Financial institutions are interested in ensuring security and quality for their customers. Banks, for instance, need to identify and stop harmful transactions in a timely manner. In order to detect fraudulent operations, data mining techniques and customer profile analysis are commonly used. However, these approaches are not supported by Visual Analytics techniques yet. Visual Analytics techniques have potential to considerably enhance the knowledge discovery process and increase the detection and prediction accuracy of financial fraud detection systems. Thus, we propose EVA, a Visual Analytics approach for supporting fraud investigation, fine-tuning fraud detection algorithms, and thus, reducing false positive alarms.
---
paper_title: ScatterBlogs2: Real-Time Monitoring of Microblog Messages through User-Guided Filtering

paper_content:

The number of microblog posts published daily has reached a level that hampers the effective retrieval of relevant messages, and the amount of information conveyed through services such as Twitter is still increasing. Analysts require new methods for monitoring their topic of interest, dealing with the data volume and its dynamic nature. It is of particular importance to provide situational awareness for decision making in time-critical tasks. Current tools for monitoring microblogs typically filter messages based on user-defined keyword queries and metadata restrictions. Used on their own, such methods can have drawbacks with respect to filter accuracy and adaptability to changes in trends and topic structure. We suggest ScatterBlogs2, a new approach to let analysts build task-tailored message filters in an interactive and visual manner based on recorded messages of well-understood previous events. These message filters include supervised classification and query creation backed by the statistical distribution of terms and their co-occurrences. The created filter methods can be orchestrated and adapted afterwards for interactive, visual real-time monitoring and analysis of microblog feeds. We demonstrate the feasibility of our approach for analyzing the Twitter stream in emergency management scenarios.
---
paper_title: A light-weight distributed scheme for detecting ip prefix hijacks in real-time

paper_content:

As more and more Internet IP prefix hijacking incidents are being reported, the value of hijacking detection services has become evident. Most of the current hijacking detection approaches monitor IP prefixes on the control plane and detect inconsistencies in route advertisements and route qualities. We propose a different approach that utilizes information collected mostly from the data plane. Our method is motivated by two key observations: when a prefix is not hijacked, 1) the hop count of the path from a source to this prefix is generally stable; and 2) the path from a source to this prefix is almost always a super-path of the path from the same source to a reference point along the previous path, as long as the reference point is topologically close to the prefix. By carefully selecting multiple vantage points and monitoring from these vantage points for any departure from these two observations, our method is able to detect prefix hijacking with high accuracy in a light-weight, distributed, and real-time fashion. Through simulations constructed based on real Internet measurement traces, we demonstrate that our scheme is accurate with both false positive and false negative ratios below 0.5%.
---
paper_title: A visual analytics process for maritime resource allocation and risk assessment

paper_content:

In this paper, we present our collaborative work with the U.S. Coast Guard's Ninth District and Atlantic Area Commands where we developed a visual analytics system to analyze historic response operations and assess the potential risks in the maritime environment associated with the hypothetical allocation of Coast Guard resources. The system includes linked views and interactive displays that enable the analysis of trends, patterns and anomalies among the U.S. Coast Guard search and rescue (SAR) operations and their associated sorties. Our system allows users to determine the potential change in risks associated with closing certain stations in terms of response time, potential lives and property lost and provides optimal direction as to the nearest available station. We provide maritime risk assessment tools that allow analysts to explore Coast Guard coverage for SAR operations and identify regions of high risk. The system also enables a thorough assessment of all SAR operations conducted by each Coast Guard station in the Great Lakes region. Our system demonstrates the effectiveness of visual analytics in analyzing risk within the maritime domain and is currently being used by analysts at the Coast Guard Atlantic Area.
---
paper_title: A visual analytics framework for spatio-temporal analysis and modelling

paper_content:

To support analysis and modelling of large amounts of spatio-temporal data having the form of spatially referenced time series (TS) of numeric values, we combine interactive visual techniques with computational methods from machine learning and statistics. Clustering methods and interactive techniques are used to group TS by similarity. Statistical methods for TS modelling are then applied to representative TS derived from the groups of similar TS. The framework includes interactive visual interfaces to a library of modelling methods supporting the selection of a suitable method, adjustment of model parameters, and evaluation of the models obtained. The models can be externally stored, communicated, and used for prediction and in further computational analyses. From the visual analytics perspective, the framework suggests a way to externalize spatio-temporal patterns emerging in the mind of the analyst as a result of interactive visual analysis: the patterns are represented in the form of computer-processable and reusable models. From the statistical analysis perspective, the framework demonstrates how TS analysis and modelling can be supported by interactive visual interfaces, particularly, in a case of numerous TS that are hard to analyse individually. From the application perspective, the framework suggests a way to analyse large numbers of spatial TS with the use of well-established statistical methods for TS analysis.
---
paper_title: MVSec: multi-perspective and deductive visual analytics on heterogeneous network security data

paper_content:

In this article, we present a visual analytics system, MVSec, which helps analysts understand better what information flows under network security datasets. The major contributions of this work include: (1) a data fusion strategy for multiple heterogeneous datasets by using unified event tuple and statistic tuple data structure, which compress large scale datasets and lays the foundation of cooperative visual analysis; (2) multiple coordinated views, which provide analysts with multiple visual perspectives to characterize loud events, dig out subtle events and investigate relations of events in datasets; and (3) a contextual visual analysis with deductive viewpoints, which inspires analysts to explore hypotheses and reason their deductions from visual narratives. In case studies, we demonstrate in detail how the system helps analysts draw an analytical storyline and understand network situations better in VAST Challenge 2013. Additionally, we discuss lessons learned in designing our system and participating in VAST Challenge 2013, which is helpful and applicable not only to similar network security systems but also to other domains facing visual analytics challenges.
---
paper_title: LongLine: Visual Analytics System for Large-scale Audit Logs

paper_content:

Abstract Audit logs are different from other software logs in that they record the most primitive events (i.e., system calls) in modern operating systems. Audit logs contain a detailed trace of an operating system, and thus have received great attention from security experts and system administrators. However, the complexity and size of audit logs, which increase in real time, have hindered analysts from understanding and analyzing them. In this paper, we present a novel visual analytics system, LongLine, which enables interactive visual analyses of large-scale audit logs. LongLine lowers the interpretation barrier of audit logs by employing human-understandable representations (e.g., file paths and commands) instead of abstract indicators of operating systems (e.g., file descriptors) as well as revealing the temporal patterns of the logs in a multi-scale fashion with meaningful granularity of time in mind (e.g., hourly, daily, and weekly). LongLine also streamlines comparative analysis between interesting subsets of logs, which is essential in detecting anomalous behaviors of systems. In addition, LongLine allows analysts to monitor the system state in a streaming fashion, keeping the latency between log creation and visualization less than one minute. Finally, we evaluate our system through a case study and a scenario analysis with security experts.
---
paper_title: ReQ-ReC: high recall retrieval with query pooling and interactive classification

paper_content:

We consider a scenario where a searcher requires both high precision and high recall from an interactive retrieval process. Such scenarios are very common in real life, exemplified by medical search, legal search, market research, and literature review. When access to the entire data set is available, an active learning loop could be used to ask for additional relevance feedback labels in order to refine a classifier. When data is accessed via search services, however, only limited subsets of the corpus can be considered, subsets defined by queries. In that setting, relevance feedback has been used in a query enhancement loop that updates a query. We describe and demonstrate the effectiveness of ReQ-ReC (ReQuery-ReClassify), a double-loop retrieval system that combines iterative expansion of a query set with iterative refinements of a classifier. This permits a separation of concerns, where the query selector's job is to enhance recall while the classifier's job is to maximize precision on the items that have been retrieved by any of the queries so far. The overall process alternates between the query enhancement loop, to increase recall, and the classifier refinement loop, to increase precision. The separation allows the query enhancement process to explore larger parts of the query space. Our experiments show that this distribution of work significantly outperforms previous relevance feedback methods that rely on a single ranking function to balance precision and recall.
---
paper_title: SpiralView: Towards Security Policies Assessment through Visual Correlation of Network Resources with Evolution of Alarms

paper_content:

This article presents SpiralView, a visualization tool for helping system administrators to assess network policies. The tool is meant to be a complementary support to the routine activity of network monitoring, enabling a retrospective view on the alarms generated during and extended period of time. The tool permits to reason about how alarms distribute over time and how they correlate with network resources (e.g., users, IPs, applications, etc.), supporting the analysts in understanding how the network evolves and thus in devising new security policies for the future. The spiral visualization plots alarms in time, and, coupled with interactive bar charts and a users/applications graph view, is used to present network data and perform queries. The user is able to segment the data in meaningful subsets, zoom on specific related information, and inspect for relationships between alarms, users, and applications. In designing the visualizations and their interaction, and through tests with security experts, several ameliorations over the standard techniques have been provided.
---
paper_title: LeadLine: Interactive visual analysis of text data through event identification and exploration

paper_content:

Text data such as online news and microblogs bear valuable insights regarding important events and responses to such events. Events are inherently temporal, evolving over time. Existing visual text analysis systems have provided temporal views of changes based on topical themes extracted from text data. But few have associated topical themes with events that cause the changes. In this paper, we propose an interactive visual analytics system, LeadLine, to automatically identify meaningful events in news and social media data and support exploration of the events. To characterize events, LeadLine integrates topic modeling, event detection, and named entity recognition techniques to automatically extract information regarding the investigative 4 Ws: who, what, when, and where for each event. To further support analysis of the text corpora through events, LeadLine allows users to interactively examine meaningful events using the 4 Ws to develop an understanding of how and why. Through representing large-scale text corpora in the form of meaningful events, LeadLine provides a concise summary of the corpora. LeadLine also supports the construction of simple narratives through the exploration of events. To demonstrate the efficacy of LeadLine in identifying events and supporting exploration, two case studies were conducted using news and social media data.
---
paper_title: Visual analytics methods for categoric spatio-temporal data

paper_content:

We focus on visual analysis of space- and time-referenced categorical data, which describe possible states of spatial (geographical) objects or locations and their changes over time. The analysis of these data is difficult as there are only limited possibilities to analyze the three aspects (location, time and category) simultaneously. We present a new approach which interactively combines (a) visualization of categorical changes over time; (b) various spatial data displays; (c) computational techniques for task-oriented selection of time steps. They provide an expressive visualization with regard to either the overall evolution over time or unusual changes. We apply our approach on two use cases demonstrating its usefulness for a wide variety of tasks. We analyze data from movement tracking and meteorologic areas. Using our approach, expected events could be detected and new insights were gained.
---
paper_title: Visual analysis of people's mobility pattern from mobile phone data

paper_content:

The large amount of phone call records from mobile operators in a city can inform us how many people are present in any given area and how many are entering or leaving. Each phone call record usually contains the caller and callee IDs, date and time, and the base station where the phone calls are made. As mobile phones are widely used in our daily life, many human behaviors can be revealed by analyzing mobile phone data. In this paper, we propose a comprehensive visual analysis system which can be used to analyze the population's mobility patterns from millions of phone call records. Our system consists of three major components: 1) visual analysis of user groups in a base station; 2) visual analysis of the mobility patterns on different user groups making phone calls in certain base stations; 3) visual analysis of handoff phone call records. Some well-established visualization techniques such as parallel coordinates and pixel-based representations have been integrated into our system. We also develop a novel visualization schemes, Voronoi-diagram-based visual encoding to reveal the unique features of mobile phone data. We have applied our system to real mobile phone data collected in a large city and obtained some interesting findings regarding people's mobility pattern.
---
paper_title: A fraud detection visualization system utilizing radial drawings and heat-maps

paper_content:

We present a prototype system developed in cooperation with a business organization that combines information visualization and pattern-matching techniques to detect fraudulent activity by employees. The system is built upon common fraud patterns searched while trying to detect occupational fraud suggested by internal auditors of a business company. The main visualization of the system consists of a multi-layer radial drawing that represents the activity of the employees and clients. Each layer represents a different examined pattern whereas heat-maps indicating suspicious activity are incorporated in the visualization. The data are first preprocessed based on a decision tree generated by the examined patterns and each employee is assigned a value indicating whether or not there exist indications of fraud. The visualization is presented as an animation and the employees are visualized one by one according to their severity values together with their related clients.
---
paper_title: Visual Analytics for Fraud Detection: Focusing on Profile Analysis

paper_content:

Financial institutions are always interested in ensuring security and quality for their customers. Banks, for instance, need to identify and avoid harmful transactions. In order to detect fraudulent operations, data mining techniques based on customer profile generation and verification are commonly used. However, these approaches are not supported by Visual Analytics techniques yet. We propose a Visual Analytics approach for supporting and fine-tuning profile analysis and reducing false positive alarms.
---
paper_title: #FluxFlow: Visual Analysis of Anomalous Information Spreading on Social Media

paper_content:

We present FluxFlow, an interactive visual analysis system for revealing and analyzing anomalous information spreading in social media. Everyday, millions of messages are created, commented, and shared by people on social media websites, such as Twitter and Facebook. This provides valuable data for researchers and practitioners in many application domains, such as marketing, to inform decision-making. Distilling valuable social signals from the huge crowd's messages, however, is challenging, due to the heterogeneous and dynamic crowd behaviors. The challenge is rooted in data analysts' capability of discerning the anomalous information behaviors, such as the spreading of rumors or misinformation, from the rest that are more conventional patterns, such as popular topics and newsworthy events, in a timely fashion. FluxFlow incorporates advanced machine learning algorithms to detect anomalies, and offers a set of novel visualization designs for presenting the detected threads for deeper analysis. We evaluated FluxFlow with real datasets containing the Twitter feeds captured during significant events such as Hurricane Sandy. Through quantitative measurements of the algorithmic performance and qualitative interviews with domain experts, the results show that the back-end anomaly detection model is effective in identifying anomalous retweeting threads, and its front-end interactive visualizations are intuitive and useful for analysts to discover insights in data and comprehend the underlying analytical model.
---
paper_title: An advanced network visualization system for financial crime detection

paper_content:

We present a new system, VISFAN, for the visual analysis of financial activity networks. It supports the analyst with effective tools to discover financial crimes, like money laundering and frauds. If compared with other existing systems and methodologies for the analysis of criminal networks, VISFAN presents the following main novelties: (i) It combines bottom-up and top-down interaction paradigms for the visual exploration of complex networks; (ii) It makes it possible to mix automatic and manual clustering; (iii) It allows the analyst to interactively customize the dimensions of each cluster region and to apply different geometric constraints on the layout. VISFAN also implements several tools for social network analysis other than clustering. For example, it computes several indices to measure the centrality of each actor in the network.
---
paper_title: Digital artifacts for remembering and storytelling: posthistory and social network fragments

paper_content:

As part of a long-term investigation into visualizing email, we have created two visualizations of email archives. One highlights social networks while the other depicts the temporal rhythms of interactions with individuals. While interviewing users of these systems, it became clear that the applications triggered recall of many personal events. One of the most striking and not entirely expected outcomes was that the visualizations motivated retelling stories from the users' pasts to others. In this paper, we discuss the motivation and design of these projects and analyze their use as catalysts for personal narrative and recall.
---
paper_title: Visual Exploration and Analysis of Historic Hotel Visits

paper_content:

Understanding the spatial and temporal characteristics of individual and group behavior in social networks is a critical component of visual tools for intelligence analysis, emergency management, consumer analysis, and human geography. Identification and analysis of patterns of recurring events is an essential feature of such tools. In this paper, we describe an interactive visual tool for exploring the visitation patterns of guests at two hotels in central Pennsylvania from 1894 to 1900. The centerpiece of the tool is a wrapping spreadsheet technique, called reruns, that reveals regular and irregular periodic patterns of events in multiple overlapping artificial and natural calendars. Implemented as a coordinated multiple view visualization in Improvise, the tool is in ongoing development through an iterative process of data collection, transcription, hypothesis, design, discovery, analysis, and evaluation in close collaboration with historical geographers. Numerous discoveries have driven additional data collection from archival newspaper and census sources, as well as plans to enhance analysis of spatial patterns using historic weather records and railroad schedules. Distributed online evaluations of usability and usefulness have resulted in feature and design recommendations that are being incorporated into the tool.
---
paper_title: Visual Exploration of Big Spatio-Temporal Urban Data: A Study of New York City Taxi Trips

paper_content:

As increasing volumes of urban data are captured and become available, new opportunities arise for data-driven analysis that can lead to improvements in the lives of citizens through evidence-based decision making and policies. In this paper, we focus on a particularly important urban data set: taxi trips. Taxis are valuable sensors and information associated with taxi trips can provide unprecedented insight into many different aspects of city life, from economic activity and human behavior to mobility patterns. But analyzing these data presents many challenges. The data are complex, containing geographical and temporal components in addition to multiple variables associated with each trip. Consequently, it is hard to specify exploratory queries and to perform comparative analyses (e.g., compare different regions over time). This problem is compounded due to the size of the data-there are on average 500,000 taxi trips each day in NYC. We propose a new model that allows users to visually query taxi trips. Besides standard analytics queries, the model supports origin-destination queries that enable the study of mobility across the city. We show that this model is able to express a wide range of spatio-temporal queries, and it is also flexible in that not only can queries be composed but also different aggregations and visual representations can be applied, allowing users to explore and compare results. We have built a scalable system that implements this model which supports interactive response times; makes use of an adaptive level-of-detail rendering strategy to generate clutter-free visualization for large results; and shows hidden details to the users in a summary through the use of overlay heat maps. We present a series of case studies motivated by traffic engineers and economists that show how our model and system enable domain experts to perform tasks that were previously unattainable for them.
---
paper_title: CloudLines: Compact Display of Event Episodes in Multiple Time-Series

paper_content:

We propose incremental logarithmic time-series technique as a way to deal with time-based representations of large and dynamic event data sets in limited space. Modern data visualization problems in the domains of news analysis, network security and financial applications, require visual analysis of incremental data, which poses specific challenges that are normally not solved by static visualizations. The incremental nature of the data implies that visualizations have to necessarily change their content and still provide comprehensible representations. In particular, in this paper we deal with the need to keep an eye on recent events together with providing a context on the past and to make relevant patterns accessible at any scale. Our technique adapts to the incoming data by taking care of the rate at which data items occur and by using a decay function to let the items fade away according to their relevance. Since access to details is also important, we also provide a novel distortion magnifying lens technique which takes into account the distortions introduced by the logarithmic time scale to augment readability in selected areas of interest. We demonstrate the validity of our techniques by applying them on incremental data coming from online news streams in different time frames.
---
paper_title: Voila: Visual Anomaly Detection and Monitoring with Streaming Spatiotemporal Data

paper_content:

The increasing availability of spatiotemporal data continuously collected from various sources provides new opportunities for a timely understanding of the data in their spatial and temporal context. Finding abnormal patterns in such data poses significant challenges. Given that there is often no clear boundary between normal and abnormal patterns, existing solutions are limited in their capacity of identifying anomalies in large, dynamic and heterogeneous data, interpreting anomalies in their multifaceted, spatiotemporal context, and allowing users to provide feedback in the analysis loop. In this work, we introduce a unified visual interactive system and framework, Voila, for interactively detecting anomalies in spatiotemporal data collected from a streaming data source. The system is designed to meet two requirements in real-world applications, i.e., online monitoring and interactivity. We propose a novel tensor-based anomaly analysis algorithm with visualization and interaction design that dynamically produces contextualized, interpretable data summaries and allows for interactively ranking anomalous patterns based on user input. Using the “smart city” as an example scenario, we demonstrate the effectiveness of the proposed framework through quantitative evaluation and qualitative case studies.
---
paper_title: Visualizing and Discovering Non-Trivial Patterns in Large Time Series Databases

paper_content:

Data visualization techniques are very important for data analysis, since the human eye has been frequently advocated as the ultimate data-mining tool. However, there has been surprisingly little work on visualizing massive time series data sets. To this end, we developed VizTree, a time series pattern discovery and visualization system based on augmenting suffix trees. VizTree visually summarizes both the global and local structures of time series data at the same time. In addition, it provides novel interactive solutions to many pattern discovery problems, including the discovery of frequently occurring patterns (motif discovery), surprising patterns (anomaly detection), and query by content. VizTree works by transforming the time series into a symbolic representation, and encoding the data in a modified suffix tree in which the frequency and other properties of patterns are mapped onto colors and other visual properties. We demonstrate the utility of our system by comparing it with state-of-the-art batch algorithms on several real and synthetic data sets. Based on the tree structure, we further device a coefficient which measures the dissimilarity between any two time series. This coefficient is shown to be competitive with the well-known Euclidean distance.
---
paper_title: MobiVis: A Visualization System for Exploring Mobile Data

paper_content:

The widespread use of mobile devices brings opportunities to capture large-scale, continuous information about human behavior. Mobile data has tremendous value, leading to business opportunities, market strategies, security concerns, etc. Visual analytics systems that support interactive exploration and discovery are needed to extracting insight from the data. However, visual analysis of complex social-spatial-temporal mobile data presents several challenges. We have created MobiVis, a visual analytics tool, which incorporates the idea of presenting social and spatial information in one heterogeneous network. The system supports temporal and semantic filtering through an interactive time chart and ontology graph, respectively, such that data subsets of interest can be isolated for close-up investigation. "Behavior rings," a compact radial representation of individual and group behaviors, is introduced to allow easy comparison of behavior patterns. We demonstrate the capability of MobiVis with the results obtained from analyzing the MIT Reality Mining dataset.
---
paper_title: Measuring geographical regularities of crowd behaviors for Twitter-based geo-social event detection

paper_content:

Recently, microblogging sites such as Twitter have garnered a great deal of attention as an advanced form of location-aware social network services, whereby individuals can easily and instantly share their most recent updates from any place. In this study, we aim to develop a geo-social event detection system by monitoring crowd behaviors indirectly via Twitter. In particular, we attempt to find out the occurrence of local events such as local festivals; a considerable number of Twitter users probably write many posts about these events. To detect such unusual geo-social events, we depend on geographical regularities deduced from the usual behavior patterns of crowds with geo-tagged microblogs. By comparing these regularities with the estimated ones, we decide whether there are any unusual events happening in the monitored geographical area. Finally, we describe the experimental results to evaluate the proposed unusuality detection method on the basis of geographical regularities obtained from a large number of geo-tagged tweets around Japan via Twitter.
---
paper_title: Reordering Massive Sequence Views: Enabling temporal and structural analysis of dynamic networks

paper_content:

Networks are present in many fields such as finance, sociology, and transportation. Often these networks are dynamic: they have a structural as well as a temporal aspect. We present a technique that extends the Massive Sequence View (MSV) for the analysis of the temporal and structural aspects of dynamic networks. Using features in the data as well as in the visualization based on the Gestalt principles closure, proximity, and similarity, we developed node reordering strategies for the MSV to make these features stand out. This enables users to find temporal properties such as trends, counter trends, periodicity, temporal shifts, and anomalies in the network as well as structural properties such as communities and stars. We show the effectiveness of the reordering methods on both synthetic and real-world transaction data sets.
---
paper_title: EventRiver: Visually Exploring Text Collections with Temporal References

paper_content:

Many text collections with temporal references, such as news corpora and weblogs, are generated to report and discuss real life events. Thus, event-related tasks, such as detecting real life events that drive the generation of the text documents, tracking event evolutions, and investigating reports and commentaries about events of interest, are important when exploring such text collections. To incorporate and leverage human efforts in conducting such tasks, we propose a novel visual analytics approach named EventRiver. EventRiver integrates event-based automated text analysis and visualization to reveal the events motivating the text generation and the long term stories they construct. On the visualization, users can interactively conduct tasks such as event browsing, tracking, association, and investigation. A working prototype of EventRiver has been implemented for exploring news corpora. A set of case studies, experiments, and a preliminary user test have been conducted to evaluate its effectiveness and efficiency.
---
paper_title: A Visual Analytics Approach to Understanding Spatiotemporal Hotspots

paper_content:

As data sources become larger and more complex, the ability to effectively explore and analyze patterns among varying sources becomes a critical bottleneck in analytic reasoning. Incoming data contain multiple variables, high signal-to-noise ratio, and a degree of uncertainty, all of which hinder exploration, hypothesis generation/exploration, and decision making. To facilitate the exploration of such data, advanced tool sets are needed that allow the user to interact with their data in a visual environment that provides direct analytic capability for finding data aberrations or hotspots. In this paper, we present a suite of tools designed to facilitate the exploration of spatiotemporal data sets. Our system allows users to search for hotspots in both space and time, combining linked views and interactive filtering to provide users with contextual information about their data and allow the user to develop and explore their hypotheses. Statistical data models and alert detection algorithms are provided to help draw user attention to critical areas. Demographic filtering can then be further applied as hypotheses generated become fine tuned. This paper demonstrates the use of such tools on multiple geospatiotemporal data sets.
---
paper_title: TelCoVis: Visual Exploration of Co-occurrence in Urban Human Mobility Based on Telco Data

paper_content:

Understanding co-occurrence in urban human mobility (i.e. people from two regions visit an urban place during the same time span) is of great value in a variety of applications, such as urban planning, business intelligence, social behavior analysis, as well as containing contagious diseases. In recent years, the widespread use of mobile phones brings an unprecedented opportunity to capture large-scale and fine-grained data to study co-occurrence in human mobility. However, due to the lack of systematic and efficient methods, it is challenging for analysts to carry out in-depth analyses and extract valuable information. In this paper, we present TelCoVis, an interactive visual analytics system, which helps analysts leverage their domain knowledge to gain insight into the co-occurrence in urban human mobility based on telco data. Our system integrates visualization techniques with new designs and combines them in a novel way to enhance analysts' perception for a comprehensive exploration. In addition, we propose to study the correlations in co-occurrence (i.e. people from multiple regions visit different places during the same time span) by means of biclustering techniques that allow analysts to better explore coordinated relationships among different regions and identify interesting patterns. The case studies based on a real-world dataset and interviews with domain experts have demonstrated the effectiveness of our system in gaining insights into co-occurrence and facilitating various analytical tasks.
---
paper_title: Visualizing email content: portraying relationships from conversational histories

paper_content:

We present Themail, a visualization that portrays relationships using the interaction histories preserved in email archives. Using the content of exchanged messages, it shows the words that characterize one's correspondence with an individual and how they change over the period of the relationship.This paper describes the interface and content-parsing algorithms in Themail. It also presents the results from a user study where two main interaction modes with the visualization emerged: exploration of "big picture" trends and themes in email (haystack mode) and more detail-oriented exploration (needle mode). Finally, the paper discusses the limitations of the content parsing approach in Themail and the implications for further research on email content visualization.
---
paper_title: Visualization of Communication Patterns in Collaborative Innovation Networks - Analysis of Some W3C Working Groups

paper_content:

Collaborative Innovation Networks (COINs) are groups of self-motivated individuals from various parts of an organization or from multiple organizations, empowered by the Internet, who work together on a new idea, driven by a common vision. In this paper we report first results of a project that examines innovation networks by analyzing the e-mail archives of some W3C (WWW consortium) working groups. These groups exhibit ideal characteristics for our purpose, as they form truly global networks working together over the Internet to develop next generation technologies. We first describe the software tools we developed to visualize the temporal communication flow, which represent communication patterns as directed acyclic graphs, We then show initial results, which revealed significant variations between the communication patterns and network structures of the different groups., We were also able to identify distinctive communication patterns among group leaders, both those who were officially appointed and other who were assuming unofficial coordinating roles.
---
paper_title: Dynamic Network Visualization withExtended Massive Sequence Views

paper_content:

Networks are present in many fields such as finance, sociology, and transportation. Often these networks are dynamic: they have a structural as well as a temporal aspect. In addition to relations occurring over time, node information is frequently present such as hierarchical structure or time-series data. We present a technique that extends the Massive Sequence View ( msv) for the analysis of temporal and structural aspects of dynamic networks. Using features in the data as well as Gestalt principles in the visualization such as closure, proximity, and similarity, we developed node reordering strategies for the msv to make these features stand out that optionally take the hierarchical node structure into account. This enables users to find temporal properties such as trends, counter trends, periodicity, temporal shifts, and anomalies in the network as well as structural properties such as communities and stars. We introduce the circular msv that further reduces visual clutter. In addition, the (circular) msv is extended to also convey time-series data associated with the nodes. This enables users to analyze complex correlations between edge occurrence and node attribute changes. We show the effectiveness of the reordering methods on both synthetic and a rich real-world dynamic network data set.
---
paper_title: Discovery of rating fraud with real-time streaming visual analytics

paper_content:

The rating fraud in online e-commerce stores targets at receiving large revenues through boosting the popularity of selected items with fake ratings. The challenges of detecting rating frauds come from discovering small scale abnormal activities in a large amount of data and detecting frauds in a time-critical manner from online rating streams. This paper presents a real-time visual analytics system that consists of two essential components: a server for automatically handling data streams and a visual analytics interface for performing interactive analysis. Based on the features of rating frauds, we present a detection solution which balances computationally expensive algorithms and interactive analysis between the server and analysts. Specifically, our detection system filters data through performing an initial suspicion level detection on the server, and analysts can combine different statistical analysis of the user / item matrix through a co-mapped singular value decomposition (SVD) diagram, re-ordered matrix representation, and the temporal view. We demonstrate our approach with case studies of different fraud scenarios and show that rating frauds can be effectively detected.
---
paper_title: Balancing Systematic and Flexible Exploration of Social Networks

paper_content:

Social network analysis (SNA) has emerged as a powerful method for understanding the importance of relationships in networks. However, interactive exploration of networks is currently challenging because: (1) it is difficult to find patterns and comprehend the structure of networks with many nodes and links, and (2) current systems are often a medley of statistical methods and overwhelming visual output which leaves many analysts uncertain about how to explore in an orderly manner. This results in exploration that is largely opportunistic. Our contributions are techniques to help structural analysts understand social networks more effectively. We present SocialAction, a system that uses attribute ranking and coordinated views to help users systematically examine numerous SNA measures. Users can (1) flexibly iterate through visualizations of measures to gain an overview, filter nodes, and find outliers, (2) aggregate networks using link structure, find cohesive subgroups, and focus on communities of interest, and (3) untangle networks by viewing different link types separately, or find patterns across different link types using a matrix overview. For each operation, a stable node layout is maintained in the network visualization so users can make comparisons. SocialAction offers analysts a strategy beyond opportunism, as it provides systematic, yet flexible, techniques for exploring social networks
---
paper_title: Spatiotemporal social media analytics for abnormal event detection and examination using seasonal-trend decomposition

paper_content:

Recent advances in technology have enabled social media services to support space-time indexed data, and internet users from all over the world have created a large volume of time-stamped, geo-located data. Such spatiotemporal data has immense value for increasing situational awareness of local events, providing insights for investigations and understanding the extent of incidents, their severity, and consequences, as well as their time-evolving nature. In analyzing social media data, researchers have mainly focused on finding temporal trends according to volume-based importance. Hence, a relatively small volume of relevant messages may easily be obscured by a huge data set indicating normal situations. In this paper, we present a visual analytics approach that provides users with scalable and interactive social media data analysis and visualization including the exploration and examination of abnormal topics and events within various social media data sources, such as Twitter, Flickr and YouTube. In order to find and understand abnormal events, the analyst can first extract major topics from a set of selected messages and rank them probabilistically using Latent Dirichlet Allocation. He can then apply seasonal trend decomposition together with traditional control chart methods to find unusual peaks and outliers within topic time series. Our case studies show that situational awareness can be improved by incorporating the anomaly and trend examination techniques into a highly interactive visual analysis process.
---
paper_title: Discovery, Retrieval, and Analysis of the 'Star Wars' Botnet in Twitter

paper_content:

It is known that many Twitter users are bots, which are accounts controlled and sometimes created by computers. Twitter bots can send spam tweets, manipulate public opinion and be used for online fraud. Here we report the discovery, retrieval, and analysis of the 'Star Wars' botnet in Twitter, which consists of more than 350,000 bots tweeting random quotations exclusively from Star Wars novels. The botnet contains a single type of bot, showing exactly the same properties throughout the botnet. It is unusually large, many times larger than other available datasets. It provides a valuable source of ground truth for research on Twitter bots. We analysed and revealed rich details on how the botnet was designed and created. As of this writing, the Star Wars bots are still alive in Twitter. They have survived since their creation in 2013, despite the increasing efforts in recent years to detect and remove Twitter bots. We also reflect on the 'unconventional' way in which we discovered the Star Wars bots, and discuss the current problems and future challenges of Twitter bot detection.
---
paper_title: Space-time dynamics of topics in streaming text

paper_content:

Human-generated textual data streams from services such as Twitter increasingly become geo-referenced. The spatial resolution of their coverage improves quickly, making them a promising instrument for sensing various aspects of evolution and dynamics of social systems. This work explores spacetime structures of the topical content of short textual messages in a stream available from Twitter in Ireland. It uses a streaming Latent Dirichlet Allocation topic model trained with an incremental variational Bayes method. The posterior probabilities of the discovered topics are post-processed with a spatial kernel density and subjected to comparative analysis. The identified prevailing topics are often found to be spatially contiguous. We apply Markov-modulated non-homogeneous Poisson processes to quantify a proportion of novelty in the observed abnormal patterns. A combined use of these techniques allows for real-time analysis of the temporal evolution and spatial variability of population's response to various stimuli such as large scale sportive, political or cultural events.
---
paper_title: TargetVue: Visual Analysis of Anomalous User Behaviors in Online Communication Systems

paper_content:

Users with anomalous behaviors in online communication systems (e.g. email and social medial platforms) are potential threats to society. Automated anomaly detection based on advanced machine learning techniques has been developed to combat this issue; challenges remain, though, due to the difficulty of obtaining proper ground truth for model training and evaluation. Therefore, substantial human judgment on the automated analysis results is often required to better adjust the performance of anomaly detection. Unfortunately, techniques that allow users to understand the analysis results more efficiently, to make a confident judgment about anomalies, and to explore data in their context, are still lacking. In this paper, we propose a novel visual analysis system, TargetVue, which detects anomalous users via an unsupervised learning model and visualizes the behaviors of suspicious users in behavior-rich context through novel visualization designs and multiple coordinated contextual views. Particularly, TargetVue incorporates three new ego-centric glyphs to visually summarize a user's behaviors which effectively present the user's communication activities, features, and social interactions. An efficient layout method is proposed to place these glyphs on a triangle grid, which captures similarities among users and facilitates comparisons of behaviors of different users. We demonstrate the power of TargetVue through its application in a social bot detection challenge using Twitter data, a case study based on email records, and an interview with expert users. Our evaluation shows that TargetVue is beneficial to the detection of users with anomalous communication behaviors.
---
paper_title: Episogram: Visual Summarization of Egocentric Social Interactions

paper_content:

The key challenges of visualizing social interaction data include the difficulties of understanding the general structure of social interactions and representing the data in the context of various user activities to reveal different behavior patterns. The design of the proposed interactive visualization tool Episogram is based on an anatomy of social interaction process in which the actors and objects involved can be formally represented as a time-varying tripartite network. The authors show the effectiveness of the proposed technique using real-world datasets and user studies.
---
paper_title: Studying cooperation and conflict between authors with history flow visualizations

paper_content:

The Internet has fostered an unconventional and powerful style of collaboration: "wiki" web sites, where every visitor has the power to become an editor. In this paper we investigate the dynamics of Wikipedia, a prominent, thriving wiki. We make three contributions. First, we introduce a new exploratory data analysis tool, the history flow visualization, which is effective in revealing patterns within the wiki context and which we believe will be useful in other collaborative situations as well. Second, we discuss several collaboration patterns highlighted by this visualization tool and corroborate them with statistical analysis. Third, we discuss the implications of these patterns for the design and governance of online collaborative social spaces. We focus on the relevance of authorship, the value of community surveillance in ameliorating antisocial behavior, and how authors with competing perspectives negotiate their differences.
---
paper_title: The spread of low-credibility content by social bots

paper_content:

The massive spread of digital misinformation has been identified as a major threat to democracies. Communication, cognitive, social, and computer scientists are studying the complex causes for the viral diffusion of misinformation, while online platforms are beginning to deploy countermeasures. Little systematic, data-based evidence has been published to guide these efforts. Here we analyze 14 million messages spreading 400 thousand articles on Twitter during ten months in 2016 and 2017. We find evidence that social bots played a disproportionate role in spreading articles from low-credibility sources. Bots amplify such content in the early spreading moments, before an article goes viral. They also target users with many followers through replies and mentions. Humans are vulnerable to this manipulation, resharing content posted by bots. Successful low-credibility sources are heavily supported by social bots. These results suggest that curbing social bots may be an effective strategy for mitigating the spread of online misinformation.Online misinformation is a threat to a well-informed electorate and undermines democracy. Here, the authors analyse the spread of articles on Twitter, find that bots play a major role in the spread of low-credibility content and suggest control measures for limiting the spread of misinformation.
---
paper_title: Email archive analysis through graphical visualization

paper_content:

The analysis of the vast storehouse of email content accumulated or produced by individual users has received relatively little attention other than for specific tasks such as spam and virus filtering. Current email analysis in standard client applications consists of keyword based matching techniques for filtering and expert driven manual exploration of email files. We have implemented a tool, called the Email Mining Toolkit (EMT) for analyzing email archives which includes a graphical display to explore relationships between users and groups of email users. The chronological flow of an email message can be analyzed by EMT. Our design goal is to embed the technology into standard email clients, such as Outlook, revealing far more information about a user's own email history than is otherwise now possible. In this paper we detail the visualization techniques implemented in EMT. We show the utility of these tools and underlying models for detecting email misuse such as viral propagation, and spam spread as examples.
---
paper_title: Data Flow Analysis and Visualization for Spatiotemporal Statistical Data without Trajectory Information

paper_content:

Geographic visualization research has focused on a variety of techniques to represent and explore spatiotemporal data. The goal of those techniques is to enable users to explore events and interactions over space and time in order to facilitate the discovery of patterns, anomalies and relationships within the data. However, it is difficult to extract and visualize data flow patterns over time for non-directional statistical data without trajectory information. In this work, we develop a novel flow analysis technique to extract, represent, and analyze flow maps of non-directional spatiotemporal data unaccompanied by trajectory information. We estimate a continuous distribution of these events over space and time, and extract flow fields for spatial and temporal changes utilizing a gravity model. Then, we visualize the spatiotemporal patterns in the data by employing flow visualization techniques. The user is presented with temporal trends of geo-referenced discrete events on a map. As such, overall spatiotemporal data flow patterns help users analyze geo-referenced temporal events, such as disease outbreaks, crime patterns, etc. To validate our model, we discard the trajectory information in an origin-destination dataset and apply our technique to the data and compare the derived trajectories and the original. Finally, we present spatiotemporal trend analysis for statistical datasets including twitter data, maritime search and rescue events, and syndromic surveillance.
---
paper_title: Twitinfo: aggregating and visualizing microblogs for event exploration

paper_content:

Microblogs are a tremendous repository of user-generated content about world events. However, for people trying to understand events by querying services like Twitter, a chronological log of posts makes it very difficult to get a detailed understanding of an event. In this paper, we present TwitInfo, a system for visualizing and summarizing events on Twitter. TwitInfo allows users to browse a large collection of tweets using a timeline-based display that highlights peaks of high tweet activity. A novel streaming algorithm automatically discovers these peaks and labels them meaningfully using text from the tweets. Users can drill down to subevents, and explore further via geolocation, sentiment, and popular URLs. We contribute a recall-normalized aggregate sentiment visualization to produce more honest sentiment overviews. An evaluation of the system revealed that users were able to reconstruct meaningful summaries of events in a small amount of time. An interview with a Pulitzer Prize-winning journalist suggested that the system would be especially useful for understanding a long-running event and for identifying eyewitnesses. Quantitatively, our system can identify 80-100% of manually labeled peaks, facilitating a relatively complete view of each event studied.
---
paper_title: Characterising group-cycling journeys using interactive graphics

paper_content:

The group-cycling behaviours of over 16,000 members of the London Cycle Hire Scheme (LCHS), a large public bikeshare system, are identified and analysed. Group journeys are defined as trips made by two or more cyclists together in space and time. Detailed insights into group-cycling behaviour are generated using specifically designed visualization software. We find that in many respects group-cycle journeys fit an expected pattern of discretionary activity: group journeys are more likely at weekends, late evenings and lunchtimes; they generally take place within more pleasant parts of the city; and between individuals apparently known to each other. A separate set of group activity is found, however, that coincides with commuting peaks and that appears to be imposed onto LCHS users by the scheme’s design. Studying the characteristics of individuals making group journeys, we identify a group of less experienced LCHS cyclists that appear to make more spatially extensive journeys than they would do normally while cycling with others; and that female cyclists are more likely to make late evening journeys when cycling in groups. For 20% of group cyclists, the first journey ever made through the LCHS was a group journey; this is particularly surprising since just 9% of all group cyclists’ journeys are group journeys. Moreover, we find that women are very significantly (p < 0.001) overrepresented amongst these ‘first time group cyclists’. Studying the bikeshare cyclists, or bike share ‘friends’, that individuals make ‘first time group journeys’ with, we find a significantly high incidence (p < 0.001) of group journeys being made with friends of the opposite gender, and for a very large proportion (55%) of members these first ever journeys are made with a friend that shares the same postcode. A substantial insight, then, is that group cycling appears to be a means through which early LCHS usage is initiated.
---
paper_title: Spatiotemporal anomaly detection through visual analysis of geolocated Twitter messages

paper_content:

Analyzing message streams from social blogging services such as Twitter is a challenging task because of the vast number of documents that are produced daily. At the same time, the availability of geolocated, realtime, and manually created status updates are an invaluable data source for situational awareness scenarios. In this work we present an approach that allows for an interactive analysis of location-based microblog messages in realtime by means of scalable aggregation and geolocated text visualization. For this purpose, we use a novel cluster analysis approach and distinguish between local event reports and global media reaction to detect spatiotemporal anomalies automatically. A workbench allows the scalable visual examination and analysis of messages featuring perspective and semantic layers on a world map representation. Our novel techniques can be used by analysts to classify the presented event candidates and examine them on a global scale.
---
paper_title: ScatterBlogs2: Real-Time Monitoring of Microblog Messages through User-Guided Filtering

paper_content:

The number of microblog posts published daily has reached a level that hampers the effective retrieval of relevant messages, and the amount of information conveyed through services such as Twitter is still increasing. Analysts require new methods for monitoring their topic of interest, dealing with the data volume and its dynamic nature. It is of particular importance to provide situational awareness for decision making in time-critical tasks. Current tools for monitoring microblogs typically filter messages based on user-defined keyword queries and metadata restrictions. Used on their own, such methods can have drawbacks with respect to filter accuracy and adaptability to changes in trends and topic structure. We suggest ScatterBlogs2, a new approach to let analysts build task-tailored message filters in an interactive and visual manner based on recorded messages of well-understood previous events. These message filters include supervised classification and query creation backed by the statistical distribution of terms and their co-occurrences. The created filter methods can be orchestrated and adapted afterwards for interactive, visual real-time monitoring and analysis of microblog feeds. We demonstrate the feasibility of our approach for analyzing the Twitter stream in emergency management scenarios.
---
paper_title: A visual analytics process for maritime resource allocation and risk assessment

paper_content:

In this paper, we present our collaborative work with the U.S. Coast Guard's Ninth District and Atlantic Area Commands where we developed a visual analytics system to analyze historic response operations and assess the potential risks in the maritime environment associated with the hypothetical allocation of Coast Guard resources. The system includes linked views and interactive displays that enable the analysis of trends, patterns and anomalies among the U.S. Coast Guard search and rescue (SAR) operations and their associated sorties. Our system allows users to determine the potential change in risks associated with closing certain stations in terms of response time, potential lives and property lost and provides optimal direction as to the nearest available station. We provide maritime risk assessment tools that allow analysts to explore Coast Guard coverage for SAR operations and identify regions of high risk. The system also enables a thorough assessment of all SAR operations conducted by each Coast Guard station in the Great Lakes region. Our system demonstrates the effectiveness of visual analytics in analyzing risk within the maritime domain and is currently being used by analysts at the Coast Guard Atlantic Area.
---
paper_title: A visual analytics framework for spatio-temporal analysis and modelling

paper_content:

To support analysis and modelling of large amounts of spatio-temporal data having the form of spatially referenced time series (TS) of numeric values, we combine interactive visual techniques with computational methods from machine learning and statistics. Clustering methods and interactive techniques are used to group TS by similarity. Statistical methods for TS modelling are then applied to representative TS derived from the groups of similar TS. The framework includes interactive visual interfaces to a library of modelling methods supporting the selection of a suitable method, adjustment of model parameters, and evaluation of the models obtained. The models can be externally stored, communicated, and used for prediction and in further computational analyses. From the visual analytics perspective, the framework suggests a way to externalize spatio-temporal patterns emerging in the mind of the analyst as a result of interactive visual analysis: the patterns are represented in the form of computer-processable and reusable models. From the statistical analysis perspective, the framework demonstrates how TS analysis and modelling can be supported by interactive visual interfaces, particularly, in a case of numerous TS that are hard to analyse individually. From the application perspective, the framework suggests a way to analyse large numbers of spatial TS with the use of well-established statistical methods for TS analysis.
---
paper_title: LeadLine: Interactive visual analysis of text data through event identification and exploration

paper_content:

Text data such as online news and microblogs bear valuable insights regarding important events and responses to such events. Events are inherently temporal, evolving over time. Existing visual text analysis systems have provided temporal views of changes based on topical themes extracted from text data. But few have associated topical themes with events that cause the changes. In this paper, we propose an interactive visual analytics system, LeadLine, to automatically identify meaningful events in news and social media data and support exploration of the events. To characterize events, LeadLine integrates topic modeling, event detection, and named entity recognition techniques to automatically extract information regarding the investigative 4 Ws: who, what, when, and where for each event. To further support analysis of the text corpora through events, LeadLine allows users to interactively examine meaningful events using the 4 Ws to develop an understanding of how and why. Through representing large-scale text corpora in the form of meaningful events, LeadLine provides a concise summary of the corpora. LeadLine also supports the construction of simple narratives through the exploration of events. To demonstrate the efficacy of LeadLine in identifying events and supporting exploration, two case studies were conducted using news and social media data.
---
paper_title: Anomaly detection in GPS data based on visual analytics

paper_content:

Modern machine learning techniques provide robust approaches for data-driven modeling and critical information extraction, while human experts hold the advantage of possessing high-level intelligence and domain-specific expertise. We combine the power of the two for anomaly detection in GPS data by integrating them through a visualization and human-computer interaction interface. In this paper we introduce GPSvas (GPS Visual Analytics System), a system that detects anomalies in GPS data using the approach of visual analytics: a conditional random field (CRF) model is used as the machine learning component for anomaly detection in streaming GPS traces. A visualization component and an interactive user interface are built to visualize the data stream, display significant analysis results (i.e., anomalies or uncertain predications) and hidden information extracted by the anomaly detection model, which enable human experts to observe the real-time data behavior and gain insights into the data flow. Human experts further provide guidance to the machine learning model through the interaction tools; the learning model is then incrementally improved through an active learning procedure.
---
paper_title: A Visual Analytics Approach for Detecting and Understanding Anomalous Resident Behaviors in Smart Healthcare

paper_content:

With the development of science and technology, it is possible to analyze residents’ daily behaviors for the purpose of smart healthcare in the smart home environment. Many researchers have begun to detect residents’ anomalous behaviors and assess their physical condition, but these approaches used by the researchers are often caught in plight caused by a lack of ground truth, one-sided analysis of behavior, and difficulty of understanding behaviors. In this paper, we put forward a smart home visual analysis system (SHVis) to help analysts detect and comprehend unusual behaviors of residents, and predict the health information intelligently. Firstly, the system classifies daily activities recorded by sensor devices in smart home environment into different categories, and discovers unusual behavior patterns of residents living in this environment by using various characteristics extracted from those activities and appropriate unsupervised anomaly detection algorithm. Secondly, on the basis of figuring out the residents’ anomaly degree of every date, we explore the daily behavior patterns and details with the help of several visualization views, and compare and analyze residents’ activities of various dates to find the reasons why residents act unusually. In the case study of this paper, we analyze residents’ behaviors that happened over two months and find unusual indoor behaviors and give health advice to the residents.
---
paper_title: Visual analytics methods for categoric spatio-temporal data

paper_content:

We focus on visual analysis of space- and time-referenced categorical data, which describe possible states of spatial (geographical) objects or locations and their changes over time. The analysis of these data is difficult as there are only limited possibilities to analyze the three aspects (location, time and category) simultaneously. We present a new approach which interactively combines (a) visualization of categorical changes over time; (b) various spatial data displays; (c) computational techniques for task-oriented selection of time steps. They provide an expressive visualization with regard to either the overall evolution over time or unusual changes. We apply our approach on two use cases demonstrating its usefulness for a wide variety of tasks. We analyze data from movement tracking and meteorologic areas. Using our approach, expected events could be detected and new insights were gained.
---
paper_title: #FluxFlow: Visual Analysis of Anomalous Information Spreading on Social Media

paper_content:

We present FluxFlow, an interactive visual analysis system for revealing and analyzing anomalous information spreading in social media. Everyday, millions of messages are created, commented, and shared by people on social media websites, such as Twitter and Facebook. This provides valuable data for researchers and practitioners in many application domains, such as marketing, to inform decision-making. Distilling valuable social signals from the huge crowd's messages, however, is challenging, due to the heterogeneous and dynamic crowd behaviors. The challenge is rooted in data analysts' capability of discerning the anomalous information behaviors, such as the spreading of rumors or misinformation, from the rest that are more conventional patterns, such as popular topics and newsworthy events, in a timely fashion. FluxFlow incorporates advanced machine learning algorithms to detect anomalies, and offers a set of novel visualization designs for presenting the detected threads for deeper analysis. We evaluated FluxFlow with real datasets containing the Twitter feeds captured during significant events such as Hurricane Sandy. Through quantitative measurements of the algorithmic performance and qualitative interviews with domain experts, the results show that the back-end anomaly detection model is effective in identifying anomalous retweeting threads, and its front-end interactive visualizations are intuitive and useful for analysts to discover insights in data and comprehend the underlying analytical model.
---
paper_title: Scalable and Interactive Visual Analysis of Financial Wire Transactions for Fraud Detection

paper_content:

Large financial institutions such as Bank of America handle hundreds of thousands of wire transactions per day. Although most transactions are legitimate, these institutions have legal and financial obligations to discover those that are suspicious. With the methods of fraudulent activities ever changing, searching on predefined patterns is often insufficient in detecting previously undiscovered methods. In this paper, we present a set of coordinated visualizations based on identifying specific keywords within the wire transactions. The different views used in our system depict relationships among keywords and accounts over time. Furthermore, we introduce a search-by-example technique, which extracts accounts that show similar transaction patterns. Our system can be connected to a database to handle millions of transactions and still preserve high interactivity. In collaboration with the Anti-Money Laundering division at Bank of America, we demonstrate that using our tool, investigators are able to detect accounts and transactions that exhibit suspicious behaviors.
---
paper_title: Digital artifacts for remembering and storytelling: posthistory and social network fragments

paper_content:

As part of a long-term investigation into visualizing email, we have created two visualizations of email archives. One highlights social networks while the other depicts the temporal rhythms of interactions with individuals. While interviewing users of these systems, it became clear that the applications triggered recall of many personal events. One of the most striking and not entirely expected outcomes was that the visualizations motivated retelling stories from the users' pasts to others. In this paper, we discuss the motivation and design of these projects and analyze their use as catalysts for personal narrative and recall.
---
paper_title: WireVis: Visualization of Categorical, Time-Varying Data From Financial Transactions

paper_content:

Large financial institutions such as Bank of America handle hundreds of thousands of wire transactions per day. Although most transactions are legitimate, these institutions have legal and financial obligations in discovering those that are suspicious. With the methods of fraudulent activities ever changing, searching on predefined patterns is often insufficient in detecting previously undiscovered methods. In this paper, we present a set of coordinated visualizations based on identifying specific keywords within the wire transactions. The different views used in our system depict relationships among keywords and accounts over time. Furthermore, we introduce a search-by-example technique which extracts accounts that show similar transaction patterns. In collaboration with the Anti-Money Laundering division at Bank of America, we demonstrate that using our tool, investigators are able to detect accounts and transactions that exhibit suspicious behaviors.
---
paper_title: TVi: a visual querying system for network monitoring and anomaly detection

paper_content:

Monitoring, anomaly detection and forensics are essential tasks that must be carried out routinely for every computer network. The sheer volume of data generated by conventional anomaly detection tools such as Snort often makes it difficult to explain the nature of an attack and track down its source. In this paper we present TVi, a tool that combines multiple visual representations of network traces carefully designed and tightly coupled to support different levels of visual-based querying and reasoning required for making sense of complex traffic data. TVi allows analysts to visualize data starting at a high level, providing information related to the entire network, and easily move all the way down to a very low level, providing detailed information about selected hosts, anomalies and attack paths. We designed TVi with scalability and extensibility in mind: its DBMS foundations make it scalable with virtually no limitations, and other state-of-the-art IDS, like Snort or Bro, can be easily integrated in our tool. We demonstrate with two case studies, a synthetic dataset (DARPA 1999) and a real one (University of Brescia, UniBS, 2009), how TVi can enhance a network administrator's ability to reveal hidden patterns in network traces and link their key information so as to easily reveal details that by merely observing Snort's output would go unnoticed. We make TVi's source code available to the community under an Open Source license.
---
paper_title: Visual Exploration of Big Spatio-Temporal Urban Data: A Study of New York City Taxi Trips

paper_content:

As increasing volumes of urban data are captured and become available, new opportunities arise for data-driven analysis that can lead to improvements in the lives of citizens through evidence-based decision making and policies. In this paper, we focus on a particularly important urban data set: taxi trips. Taxis are valuable sensors and information associated with taxi trips can provide unprecedented insight into many different aspects of city life, from economic activity and human behavior to mobility patterns. But analyzing these data presents many challenges. The data are complex, containing geographical and temporal components in addition to multiple variables associated with each trip. Consequently, it is hard to specify exploratory queries and to perform comparative analyses (e.g., compare different regions over time). This problem is compounded due to the size of the data-there are on average 500,000 taxi trips each day in NYC. We propose a new model that allows users to visually query taxi trips. Besides standard analytics queries, the model supports origin-destination queries that enable the study of mobility across the city. We show that this model is able to express a wide range of spatio-temporal queries, and it is also flexible in that not only can queries be composed but also different aggregations and visual representations can be applied, allowing users to explore and compare results. We have built a scalable system that implements this model which supports interactive response times; makes use of an adaptive level-of-detail rendering strategy to generate clutter-free visualization for large results; and shows hidden details to the users in a summary through the use of overlay heat maps. We present a series of case studies motivated by traffic engineers and economists that show how our model and system enable domain experts to perform tasks that were previously unattainable for them.
---
paper_title: CloudLines: Compact Display of Event Episodes in Multiple Time-Series

paper_content:

We propose incremental logarithmic time-series technique as a way to deal with time-based representations of large and dynamic event data sets in limited space. Modern data visualization problems in the domains of news analysis, network security and financial applications, require visual analysis of incremental data, which poses specific challenges that are normally not solved by static visualizations. The incremental nature of the data implies that visualizations have to necessarily change their content and still provide comprehensible representations. In particular, in this paper we deal with the need to keep an eye on recent events together with providing a context on the past and to make relevant patterns accessible at any scale. Our technique adapts to the incoming data by taking care of the rate at which data items occur and by using a decay function to let the items fade away according to their relevance. Since access to details is also important, we also provide a novel distortion magnifying lens technique which takes into account the distortions introduced by the logarithmic time scale to augment readability in selected areas of interest. We demonstrate the validity of our techniques by applying them on incremental data coming from online news streams in different time frames.
---
paper_title: Occupational fraud detection through visualization

paper_content:

Occupational fraud affects many companies causing them economic loss and liability issues towards their clients and other entities. Detecting internal fraud requires significant effort since a huge amount of data produced by diverse systems (which are mostly in textual form) has to be processed with little automated support. In this paper, we exploit the advantages of information visualization and present a system that aims to detect occupational fraud in systems which involve a pair of entities (e.g., an employee and a client). The main visualization is a spiral on which the events are drawn according to their time-stamp. Suspicious events are considered those which appear along the same radius or on close radii. The system ranks both entities according to the specifications of the auditor and a video file of their activity is generated such that events with strong evidence of fraud appear first. The system is equipped with several visualizations that facilitate the detection procedure.
---
paper_title: Network Explorer: Design, Implementation, and Real World Deployment of a Large Network Visualization Tool

paper_content:

This paper describes the process of design, implementation, and real world deployment of a web-based network exploration tool called Network Explorer. We designed Network Explorer based on the expressed needs of our clients and later deployed it as part of a larger system for fraud detection in health care. Our implementation of Network Explorer provides visual interactive access to large-scale network data. As part of the Network Explorer tool we contribute a dynamic group-in-a-box implementation for laying out clusters, and a node navigator widget that aids in the exploration of large networks. We are also contributing two open source components of the Network Explorer for the community to reuse: an in-browser clustering library, and the dynamic group-in-a-box algorithm. We have evaluated the network explorer tool in multiple real-world environments including the fraud detection setting above.
---
paper_title: Voila: Visual Anomaly Detection and Monitoring with Streaming Spatiotemporal Data

paper_content:

The increasing availability of spatiotemporal data continuously collected from various sources provides new opportunities for a timely understanding of the data in their spatial and temporal context. Finding abnormal patterns in such data poses significant challenges. Given that there is often no clear boundary between normal and abnormal patterns, existing solutions are limited in their capacity of identifying anomalies in large, dynamic and heterogeneous data, interpreting anomalies in their multifaceted, spatiotemporal context, and allowing users to provide feedback in the analysis loop. In this work, we introduce a unified visual interactive system and framework, Voila, for interactively detecting anomalies in spatiotemporal data collected from a streaming data source. The system is designed to meet two requirements in real-world applications, i.e., online monitoring and interactivity. We propose a novel tensor-based anomaly analysis algorithm with visualization and interaction design that dynamically produces contextualized, interpretable data summaries and allows for interactively ranking anomalous patterns based on user input. Using the “smart city” as an example scenario, we demonstrate the effectiveness of the proposed framework through quantitative evaluation and qualitative case studies.
---
paper_title: Visualizing and Discovering Non-Trivial Patterns in Large Time Series Databases

paper_content:

Data visualization techniques are very important for data analysis, since the human eye has been frequently advocated as the ultimate data-mining tool. However, there has been surprisingly little work on visualizing massive time series data sets. To this end, we developed VizTree, a time series pattern discovery and visualization system based on augmenting suffix trees. VizTree visually summarizes both the global and local structures of time series data at the same time. In addition, it provides novel interactive solutions to many pattern discovery problems, including the discovery of frequently occurring patterns (motif discovery), surprising patterns (anomaly detection), and query by content. VizTree works by transforming the time series into a symbolic representation, and encoding the data in a modified suffix tree in which the frequency and other properties of patterns are mapped onto colors and other visual properties. We demonstrate the utility of our system by comparing it with state-of-the-art batch algorithms on several real and synthetic data sets. Based on the tree structure, we further device a coefficient which measures the dissimilarity between any two time series. This coefficient is shown to be competitive with the well-known Euclidean distance.
---
paper_title: MobiVis: A Visualization System for Exploring Mobile Data

paper_content:

The widespread use of mobile devices brings opportunities to capture large-scale, continuous information about human behavior. Mobile data has tremendous value, leading to business opportunities, market strategies, security concerns, etc. Visual analytics systems that support interactive exploration and discovery are needed to extracting insight from the data. However, visual analysis of complex social-spatial-temporal mobile data presents several challenges. We have created MobiVis, a visual analytics tool, which incorporates the idea of presenting social and spatial information in one heterogeneous network. The system supports temporal and semantic filtering through an interactive time chart and ontology graph, respectively, such that data subsets of interest can be isolated for close-up investigation. "Behavior rings," a compact radial representation of individual and group behaviors, is introduced to allow easy comparison of behavior patterns. We demonstrate the capability of MobiVis with the results obtained from analyzing the MIT Reality Mining dataset.
---
paper_title: Combining visual and automated data mining for near-real-time anomaly detection and analysis in BGP

paper_content:

The security of Internet routing is a major concern because attacks and errors can result in data packets not reaching their intended destination and/or falling into the wrong hands. A key step in improving routing security is to analyze and understand it. In the past, we and other researchers have presented various visual-based, statistical-based, and signature-based methods of analyzing Internet routing data. In this paper, we describe an integration of visual and automated data mining methods for discovering and investigating anomalies in Internet routing. We show how these different components are combined in such a way as to complement each other, creating a very effective and useful analysis tool. In addition to performing analysis on archived data, our system is able to collect, process and visualize data in near-real-time.
---
paper_title: Reordering Massive Sequence Views: Enabling temporal and structural analysis of dynamic networks

paper_content:

Networks are present in many fields such as finance, sociology, and transportation. Often these networks are dynamic: they have a structural as well as a temporal aspect. We present a technique that extends the Massive Sequence View (MSV) for the analysis of the temporal and structural aspects of dynamic networks. Using features in the data as well as in the visualization based on the Gestalt principles closure, proximity, and similarity, we developed node reordering strategies for the MSV to make these features stand out. This enables users to find temporal properties such as trends, counter trends, periodicity, temporal shifts, and anomalies in the network as well as structural properties such as communities and stars. We show the effectiveness of the reordering methods on both synthetic and real-world transaction data sets.
---
paper_title: VisImpact: business impact visualization

paper_content:

Business Intelligence (BI) deals with transforming raw business data into valuable information for making decisions. The goal is to improve the operation and use of large-scale, complex information systems. A number of automated BI techniques are available. These methods, however, have to be supported by user interaction to make successful business decisions. In this paper, we present a new technique for interactive business intelligence based on visualization technology, called VisImpact. The basic idea of the VisImpact technique is to visually display the relationships between the important business operation parameters and the distribution of the process flow. We have applied VisImpact in the areas of business contract analysis, business operation analysis, and fraud analysis, to show the power of the VisImpact technique for finding process flows, patterns, and trends, and for a quick identification of exceptions (outliers). Our interactive VisImpact system provides the means for an instant drilldown to a transaction record level which allows observing the evolution of business dynamics.
---
paper_title: EventRiver: Visually Exploring Text Collections with Temporal References

paper_content:

Many text collections with temporal references, such as news corpora and weblogs, are generated to report and discuss real life events. Thus, event-related tasks, such as detecting real life events that drive the generation of the text documents, tracking event evolutions, and investigating reports and commentaries about events of interest, are important when exploring such text collections. To incorporate and leverage human efforts in conducting such tasks, we propose a novel visual analytics approach named EventRiver. EventRiver integrates event-based automated text analysis and visualization to reveal the events motivating the text generation and the long term stories they construct. On the visualization, users can interactively conduct tasks such as event browsing, tracking, association, and investigation. A working prototype of EventRiver has been implemented for exploring news corpora. A set of case studies, experiments, and a preliminary user test have been conducted to evaluate its effectiveness and efficiency.
---
paper_title: Detecting flaws and intruders with visual data analysis

paper_content:

The task of sifting through large amounts of data to find useful information spawned the field of data mining. Most data mining approaches are based on machine-learning techniques, numerical analysis, or statistical modeling. They use human interaction and visualization only minimally. Such automatic methods can miss some important features of the data. Incorporating human perception into the data mining process through interactive visualization can help us better understand the complex behaviors of computer network systems. This article describes visual-analytics-based solutions and outlines a visual exploration process for log analysis. Three log-file analysis applications demonstrate our approach's effectiveness in discovering flaws and intruders in network systems.
---
paper_title: NStreamAware: real-time visual analytics for data streams to enhance situational awareness

paper_content:

The analysis of data streams is important in many security-related domains to gain situational awareness. To provide monitoring and visual analysis of such data streams, we propose a system, called NStreamAware, that uses modern distributed processing technologies to analyze streams using stream slices, which are presented to analysts in a web-based visual analytics application, called NVisAware. Furthermore, we visually guide the user in the feature selection process to summarize the slices to focus on the most interesting parts of the stream based on introduced expert knowledge of the analyst. We show through case studies, how the system can be used to gain situational awareness and eventually enhance network security. Furthermore, we apply the system to a social media data stream to compete in an international challenge to evaluate the applicability of our approach to other domains.
---
paper_title: Visual correlation of network alerts

paper_content:

The VisAlert visual correlation tool facilitates situational awareness in complex network environments by providing a holistic view of network security to help detect malicious activities. Information visualization techniques and methods in many applications have effectively increased operators' situational awareness, letting them more effectively detect, diagnose, and treat anomalous conditions. Visualization elevates information comprehension by fostering rapid correlation and perceived associations. Our visualization technique integrates the information in log and alert files into an intuitive, flexible, extensible, and scalable visualization tool - VisAlert - that presents critical information concerning network activity in an integrated manner, increasing the user's situational awareness.
---
paper_title: TelCoVis: Visual Exploration of Co-occurrence in Urban Human Mobility Based on Telco Data

paper_content:

Understanding co-occurrence in urban human mobility (i.e. people from two regions visit an urban place during the same time span) is of great value in a variety of applications, such as urban planning, business intelligence, social behavior analysis, as well as containing contagious diseases. In recent years, the widespread use of mobile phones brings an unprecedented opportunity to capture large-scale and fine-grained data to study co-occurrence in human mobility. However, due to the lack of systematic and efficient methods, it is challenging for analysts to carry out in-depth analyses and extract valuable information. In this paper, we present TelCoVis, an interactive visual analytics system, which helps analysts leverage their domain knowledge to gain insight into the co-occurrence in urban human mobility based on telco data. Our system integrates visualization techniques with new designs and combines them in a novel way to enhance analysts' perception for a comprehensive exploration. In addition, we propose to study the correlations in co-occurrence (i.e. people from multiple regions visit different places during the same time span) by means of biclustering techniques that allow analysts to better explore coordinated relationships among different regions and identify interesting patterns. The case studies based on a real-world dataset and interviews with domain experts have demonstrated the effectiveness of our system in gaining insights into co-occurrence and facilitating various analytical tasks.
---
paper_title: Visualizing email content: portraying relationships from conversational histories

paper_content:

We present Themail, a visualization that portrays relationships using the interaction histories preserved in email archives. Using the content of exchanged messages, it shows the words that characterize one's correspondence with an individual and how they change over the period of the relationship.This paper describes the interface and content-parsing algorithms in Themail. It also presents the results from a user study where two main interaction modes with the visualization emerged: exploration of "big picture" trends and themes in email (haystack mode) and more detail-oriented exploration (needle mode). Finally, the paper discusses the limitations of the content parsing approach in Themail and the implications for further research on email content visualization.
---
paper_title: The Event Tunnel: Interactive Visualization of Complex Event Streams for Business Process Pattern Analysis

paper_content:

Event-based systems are gaining increasing popularity for building loosely coupled and distributed systems. Since business processes are becoming more interconnected and event-driven, event-based systems fit well for supporting and monitoring business processes. In this paper, we present an event-based business intelligence tool, the Event Tunnel framework. It provides an interactive visualization of event streams to support business analysts in exploring business incidents. The visualization is based on the metaphor of considering the event stream as a cylindrical tunnel, which is presented to the user from multiple perspectives. The information of single events laid out in the Event Tunnel is encoded in event glyphs that allow for a selective mapping of event attributes to colors, size and position. Different policies for the placement of the events in the tunnel as well as a clustering mechanism generate various views on historical event data. The Event Tunnel is able to display the relationships between events. This facilitates users to discover root causes and causal dependencies of event patterns. Our framework couples the event-tunnel visualization with query tools that allow users to search for relevant events within a data repository. Using query, filler and highlighting operations the analyst can navigate through the Event Tunnel until the required information or event patterns become visible. We demonstrate our approach with use cases from the fraud management and logistics domain.
---
paper_title: Visualization of Communication Patterns in Collaborative Innovation Networks - Analysis of Some W3C Working Groups

paper_content:

Collaborative Innovation Networks (COINs) are groups of self-motivated individuals from various parts of an organization or from multiple organizations, empowered by the Internet, who work together on a new idea, driven by a common vision. In this paper we report first results of a project that examines innovation networks by analyzing the e-mail archives of some W3C (WWW consortium) working groups. These groups exhibit ideal characteristics for our purpose, as they form truly global networks working together over the Internet to develop next generation technologies. We first describe the software tools we developed to visualize the temporal communication flow, which represent communication patterns as directed acyclic graphs, We then show initial results, which revealed significant variations between the communication patterns and network structures of the different groups., We were also able to identify distinctive communication patterns among group leaders, both those who were officially appointed and other who were assuming unofficial coordinating roles.
---
paper_title: Discovery of rating fraud with real-time streaming visual analytics

paper_content:

The rating fraud in online e-commerce stores targets at receiving large revenues through boosting the popularity of selected items with fake ratings. The challenges of detecting rating frauds come from discovering small scale abnormal activities in a large amount of data and detecting frauds in a time-critical manner from online rating streams. This paper presents a real-time visual analytics system that consists of two essential components: a server for automatically handling data streams and a visual analytics interface for performing interactive analysis. Based on the features of rating frauds, we present a detection solution which balances computationally expensive algorithms and interactive analysis between the server and analysts. Specifically, our detection system filters data through performing an initial suspicion level detection on the server, and analysts can combine different statistical analysis of the user / item matrix through a co-mapped singular value decomposition (SVD) diagram, re-ordered matrix representation, and the temporal view. We demonstrate our approach with case studies of different fraud scenarios and show that rating frauds can be effectively detected.
---
paper_title: Visual Analytics for Networked-Guarantee Loans Risk Management

paper_content:

Groups of enterprises can guarantee each other and form complex networks in order to try to obtain loans from banks. Monitoring the financial status of a network, and preventing or reducing systematic risk in case of a crisis, is an area of great concern for the regulatory commission and for the banks. We set the ultimate goal of developing a visual analytic approach and tool for risk dissolving and decision-making. We have consolidated four main analysis tasks conducted by financial experts: i) Multi-faceted Default Risk Visualization, whereby a hybrid representation is devised to predict the default risk and an interface developed to visualize key indicators; ii) Risk Guarantee Patterns Discovery. We follow the Shneiderman mantra guidance for designing interactive visualization applications, whereby an interactive risk guarantee community detection and a motif detection based risk guarantee pattern discovery approach are described; iii) Network Evolution and Retrospective, whereby animation is used to help users to understand the guarantee dynamic; iv) Risk Communication Analysis. The temporal diffusion path analysis can be useful for the government and banks to monitor the spread of the default status. It also provides insight for taking precautionary measures to prevent and dissolve systematic financial risk. We implement the system with case studies using real-world bank loan data. Two financial experts are consulted to endorse the developed tool. To the best of our knowledge, this is the first visual analytics tool developed to explore networked-guarantee loan risks in a systematic manner.
---
paper_title: A visual analytics system to support tax evasion discovery

paper_content:

Abstract This paper describes TaxNet , a decision support system for tax evasion discovery, based on a powerful visual language and on advanced network visualization techniques. It has been developed in cooperation with the Italian Revenue Agency, where it is currently used. TaxNet allows users to visually define classes of suspicious patterns, it exploits effective graph pattern matching technologies to rapidly extract subgraphs that correspond to one or more patterns, it provides facilities to conveniently merge the results, and it implements new ad-hoc centrality indexes to rank taxpayers based on their fiscal risk. Moreover, it offers a visual interface to analyze and interact with those networks that match a desired pattern. The paper discusses the results of an experimental study and some use cases conducted with expert officers on real data and in a real working environment. The experiments give evidence of the effectiveness of our system.
---
paper_title: Understanding Twitter data with TweetXplorer

paper_content:

In the era of big data it is increasingly difficult for an analyst to extract meaningful knowledge from a sea of information. We present TweetXplorer, a system for analysts with little information about an event to gain knowledge through the use of effective visualization techniques. Using tweets collected during Hurricane Sandy as an example, we will lead the reader through a workflow that exhibits the functionality of the system.
---
paper_title: Visual Analysis of Collective Anomalies Through High-Order Correlation Graph

paper_content:

Detecting, analyzing and reasoning collective anomalies is important for many real-life application domains such as facility monitoring, software analysis and security. The main challenges include the overwhelming number of low-risk events and their multifaceted relationships which form the collective anomaly, the diversity in various data and anomaly types, and the difficulty to incorporate domain knowledge in the anomaly analysis process. In this paper, we propose a novel concept of high-order correlation graph (HOCG). Compared with the previous correlation graph definition, HOCG achieves better user interactivity, computational scalability, and domain generality through synthesizing heterogeneous types of nodes, attributes, and multifaceted relationships in a single graph. We design elaborate visual metaphors, interaction models, and the coordinated multiple view based interface to allow users to fully unleash the visual analytics power over HOCG. We conduct case studies in two real-life application domains, i.e., facility monitoring and software analysis. The results demonstrate the effectiveness of HOCG in the overview of point anomalies, detection of collective anomalies, and reasoning process of root cause analysis.
---
paper_title: TargetVue: Visual Analysis of Anomalous User Behaviors in Online Communication Systems

paper_content:

Users with anomalous behaviors in online communication systems (e.g. email and social medial platforms) are potential threats to society. Automated anomaly detection based on advanced machine learning techniques has been developed to combat this issue; challenges remain, though, due to the difficulty of obtaining proper ground truth for model training and evaluation. Therefore, substantial human judgment on the automated analysis results is often required to better adjust the performance of anomaly detection. Unfortunately, techniques that allow users to understand the analysis results more efficiently, to make a confident judgment about anomalies, and to explore data in their context, are still lacking. In this paper, we propose a novel visual analysis system, TargetVue, which detects anomalous users via an unsupervised learning model and visualizes the behaviors of suspicious users in behavior-rich context through novel visualization designs and multiple coordinated contextual views. Particularly, TargetVue incorporates three new ego-centric glyphs to visually summarize a user's behaviors which effectively present the user's communication activities, features, and social interactions. An efficient layout method is proposed to place these glyphs on a triangle grid, which captures similarities among users and facilitates comparisons of behaviors of different users. We demonstrate the power of TargetVue through its application in a social bot detection challenge using Twitter data, a case study based on email records, and an interview with expert users. Our evaluation shows that TargetVue is beneficial to the detection of users with anomalous communication behaviors.
---
paper_title: NVisionIP: netflow visualizations of system state for security situational awareness

paper_content:

The number of attacks against large computer systems is currently growing at a rapid pace. Despite the best efforts of security analysts, large organizations are having trouble keeping on top of the current state of their networks. In this paper, we describe a tool called NVisionIP that is designed to increase the security analyst's situational awareness. As humans are inherently visual beings, NVisionIP uses a graphical representation of a class-B network to allow analysts to quickly visualize the current state of their network. We present an overview of NVisionIP along with a discussion of various types of security-related scenarios that it can be used to detect.
---
paper_title: Episogram: Visual Summarization of Egocentric Social Interactions

paper_content:

The key challenges of visualizing social interaction data include the difficulties of understanding the general structure of social interactions and representing the data in the context of various user activities to reveal different behavior patterns. The design of the proposed interactive visualization tool Episogram is based on an anatomy of social interaction process in which the actors and objects involved can be formally represented as a time-varying tripartite network. The authors show the effectiveness of the proposed technique using real-world datasets and user studies.
---
paper_title: Business Process Impact Visualization and Anomaly Detection

paper_content:

Business operations involve many factors and relationships and are modeled as complex business process workflows. The execution of these business processes generates vast volumes of complex data. The operational data are instances of the process flow, taking different paths through the process. The goal is to use the complex information to analyze and improve operations and to optimize the process flow. In this paper, we introduce a new visualization technique, called Vislmpact that turns raw operational business data into valuable information. Vislmpact reduces data complexity by analyzing operational data and abstracting the most critical factors, called impact factors, which influence business operations. The analysis may identify single nodes of the business flow graph as important factors but it may also determine aggregations of nodes to be important. Moreover, the analysis may find that single nodes have certain data values associated with them which have an influence on some business metrics or resource usage parameters. The impact factors are presented as nodes in a symmetric circular graph, providing insight into core business operations and relationships. A cause-effect mechanism is built in to determine 'good' and 'bad' operational behavior and to take action accordingly. We have applied Vislmpact to real-world applications, fraud analysis and service contract analysis, to show the power of Vislmpact for finding relationships among the most important impact factors and for immediate identification of anomalies. The Vislmpact system provides a highly interactive interface including drilldown capabilities down to transaction levels to allow multilevel views of business dynamics.
---
paper_title: The spread of low-credibility content by social bots

paper_content:

The massive spread of digital misinformation has been identified as a major threat to democracies. Communication, cognitive, social, and computer scientists are studying the complex causes for the viral diffusion of misinformation, while online platforms are beginning to deploy countermeasures. Little systematic, data-based evidence has been published to guide these efforts. Here we analyze 14 million messages spreading 400 thousand articles on Twitter during ten months in 2016 and 2017. We find evidence that social bots played a disproportionate role in spreading articles from low-credibility sources. Bots amplify such content in the early spreading moments, before an article goes viral. They also target users with many followers through replies and mentions. Humans are vulnerable to this manipulation, resharing content posted by bots. Successful low-credibility sources are heavily supported by social bots. These results suggest that curbing social bots may be an effective strategy for mitigating the spread of online misinformation.Online misinformation is a threat to a well-informed electorate and undermines democracy. Here, the authors analyse the spread of articles on Twitter, find that bots play a major role in the spread of low-credibility content and suggest control measures for limiting the spread of misinformation.
---
paper_title: Lessons Learned Developing a Visual Analytics Solution for Investigative Analysis of Scamming Activities

paper_content:

The forensic investigation of communication datasets which contain unstructured text, social network information, and metadata is a complex task that is becoming more important due to the immense amount of data being collected. Currently there are limited approaches that allow an investigator to explore the network, text and metadata in a unified manner. We developed Beagle as a forensic tool for email datasets that allows investigators to flexibly form complex queries in order to discover important information in email data. Beagle was successfully deployed at a security firm which had a large email dataset that was difficult to properly investigate. We discuss our experience developing Beagle as well as the lessons we learned applying visual analytic techniques to a difficult real-world problem.
---
paper_title: A visualization paradigm for network intrusion detection

paper_content:

We present a novel paradigm for visual correlation of network alerts from disparate logs. This paradigm facilitates and promotes situational awareness in complex network environments. Our approach is based on the notion that, by definition, an alert must possess three attributes, namely: what, when, and where. This fundamental premise, which we term w/sup 3/, provides a vehicle for comparing between seemingly disparate events. We propose a concise and scalable representation of these three attributes, that leads to a flexible visualization tool that is also clear and intuitive to use. Within our system, alerts can be grouped and viewed hierarchically with respect to both their type, i.e., the what, and to their where attributes. Further understanding is gained by displaying the temporal distribution of alerts to reveal complex attack trends. Finally, we propose a set of visual metaphor extensions that augment the proposed paradigm and enhance users' situational awareness. These metaphors direct the attention of users to many-to-one correlations within the current display helping them detect abnormal network activity.
---
paper_title: FloVis: Flow Visualization System

paper_content:

NetFlow data is routinely captured at the border of many enterprise networks. Although not as rich as full packet–capture data, NetFlow provides a compact record of the interactions between host pairs on either side of the monitored border. Analysis of this data presents a challenge to the security analyst due to its volume. We report preliminary results on the development of a suite of visualization tools that are intended to complement command linetools, such as those from the SiLK Tools, that are currently used by analysts to perform forensic analysis of NetFlow data. The current version of the tool set draws on three visual paradigms: activity diagrams that display various aspects of multiple individual host behaviors as color1 coded time series, connection bundles that show the interactions among hosts and groups of hosts, and the NetBytes viewer that allows detailed examination of the port and volume behaviors of an individual host over a period of time. The system supports drill down for additional detail and pivoting that allows the analyst to examine the relationships among the displays. SiLK data is preprocessed into a relational database to drive the display modes, and the tools can interact with the SiLK system to extract additional data as necessary.
---
paper_title: Twitinfo: aggregating and visualizing microblogs for event exploration

paper_content:

Microblogs are a tremendous repository of user-generated content about world events. However, for people trying to understand events by querying services like Twitter, a chronological log of posts makes it very difficult to get a detailed understanding of an event. In this paper, we present TwitInfo, a system for visualizing and summarizing events on Twitter. TwitInfo allows users to browse a large collection of tweets using a timeline-based display that highlights peaks of high tweet activity. A novel streaming algorithm automatically discovers these peaks and labels them meaningfully using text from the tweets. Users can drill down to subevents, and explore further via geolocation, sentiment, and popular URLs. We contribute a recall-normalized aggregate sentiment visualization to produce more honest sentiment overviews. An evaluation of the system revealed that users were able to reconstruct meaningful summaries of events in a small amount of time. An interview with a Pulitzer Prize-winning journalist suggested that the system would be especially useful for understanding a long-running event and for identifying eyewitnesses. Quantitatively, our system can identify 80-100% of manually labeled peaks, facilitating a relatively complete view of each event studied.
---
paper_title: Characterising group-cycling journeys using interactive graphics

paper_content:

The group-cycling behaviours of over 16,000 members of the London Cycle Hire Scheme (LCHS), a large public bikeshare system, are identified and analysed. Group journeys are defined as trips made by two or more cyclists together in space and time. Detailed insights into group-cycling behaviour are generated using specifically designed visualization software. We find that in many respects group-cycle journeys fit an expected pattern of discretionary activity: group journeys are more likely at weekends, late evenings and lunchtimes; they generally take place within more pleasant parts of the city; and between individuals apparently known to each other. A separate set of group activity is found, however, that coincides with commuting peaks and that appears to be imposed onto LCHS users by the scheme’s design. Studying the characteristics of individuals making group journeys, we identify a group of less experienced LCHS cyclists that appear to make more spatially extensive journeys than they would do normally while cycling with others; and that female cyclists are more likely to make late evening journeys when cycling in groups. For 20% of group cyclists, the first journey ever made through the LCHS was a group journey; this is particularly surprising since just 9% of all group cyclists’ journeys are group journeys. Moreover, we find that women are very significantly (p < 0.001) overrepresented amongst these ‘first time group cyclists’. Studying the bikeshare cyclists, or bike share ‘friends’, that individuals make ‘first time group journeys’ with, we find a significantly high incidence (p < 0.001) of group journeys being made with friends of the opposite gender, and for a very large proportion (55%) of members these first ever journeys are made with a friend that shares the same postcode. A substantial insight, then, is that group cycling appears to be a means through which early LCHS usage is initiated.
---
paper_title: Visual Discovery in Computer Network Defense

paper_content:

Computer network defense (CND) requires analysts to detect both known and novel forms of attacks in massive volumes of network data. It's through discovering the unexpected that CND analysts detect new versions of mal ware (such as viruses and Trojan horses) that have passed through their antivirus products, new methods of intrusion that have breached their firewalls and intrusion detection systems (IDSs), and new groups of cyber-criminals pressing the attack. This paper presents visual assistant for information assurance analysis. VIAssist is a visualization framework based on a comprehensive cognitive task analysis of CND analysts, and so fits their work practices and operational environment.
---
paper_title: EVA: Visual Analytics to Identify Fraudulent Events

paper_content:

Financial institutions are interested in ensuring security and quality for their customers. Banks, for instance, need to identify and stop harmful transactions in a timely manner. In order to detect fraudulent operations, data mining techniques and customer profile analysis are commonly used. However, these approaches are not supported by Visual Analytics techniques yet. Visual Analytics techniques have potential to considerably enhance the knowledge discovery process and increase the detection and prediction accuracy of financial fraud detection systems. Thus, we propose EVA, a Visual Analytics approach for supporting fraud investigation, fine-tuning fraud detection algorithms, and thus, reducing false positive alarms.
---
paper_title: Analyzing high-dimensional multivaríate network links with integrated anomaly detection, highlighting and exploration

paper_content:

This paper focuses on the integration of a family of visual analytics techniques for analyzing high-dimensional, multivariate network data that features spatial and temporal information, network connections, and a variety of other categorical and numerical data types. Such data types are commonly encountered in transportation, shipping, and logistics industries. Due to the scale and complexity of the data, it is essential to integrate techniques for data analysis, visualization, and exploration. We present new visual representations, Petal and Thread, to effectively present many-to-many network data including multi-attribute vectors. In addition, we deploy an information-theoretic model for anomaly detection across varying dimensions, displaying highlighted anomalies in a visually consistent manner, as well as supporting a managed process of exploration. Lastly, we evaluate the proposed methodology through data exploration and an empirical study.
---
paper_title: Combining Computational Analyses and Interactive Visualization for Document Exploration and Sensemaking in Jigsaw

paper_content:

Investigators across many disciplines and organizations must sift through large collections of text documents to understand and piece together information. Whether they are fighting crime, curing diseases, deciding what car to buy, or researching a new field, inevitably investigators will encounter text documents. Taking a visual analytics approach, we integrate multiple text analysis algorithms with a suite of interactive visualizations to provide a flexible and powerful environment that allows analysts to explore collections of documents while sensemaking. Our particular focus is on the process of integrating automated analyses with interactive visualizations in a smooth and fluid manner. We illustrate this integration through two example scenarios: An academic researcher examining InfoVis and VAST conference papers and a consumer exploring car reviews while pondering a purchase decision. Finally, we provide lessons learned toward the design and implementation of visual analytics systems for document exploration and understanding.
---
paper_title: Network Intrusion Visualization with NIVA, an Intrusion Detection Visual and Haptic Analyzer

paper_content:

The rapid growth of malicious activities on worldwide communication networks, such as the Internet, has highlighted the need for efficient intrusion detection systems. The efficiency of traditional intrusion detection systems is limited, in part, by their inability to relay effectively relevant information due to their lack of interactive/immersive technologies. In this paper, we explore several network visualization techniques geared toward intrusion detection on small- and large-scale networks. We also examine the use of haptics in network intrusion visualization. By incorporating concepts from electromagnetics, fluid dynamics, and gravitational theory, we show that haptic technologies can provide another dimension of information critical to the efficient visualization of network intrusion data. Furthermore, we explore the applicability of these visualization techniques in conjunction with commercial network intrusion detectors. Finally, we present a network intrusion visualization application with haptic integration, NIVA, which allows the analyst to interactively investigate as well as efficiently detect structured attacks across time and space using advanced interactive three-dimensional displays.
---
paper_title: Newsgroup Crowds and AuthorLines: visualizing the activity of individuals in conversational cyberspaces

paper_content:

We discuss the design, implementation and evaluation of two related visualizations of authors' activities in Usenet newsgroups. Current Usenet news browsers focus on messages and thread structures while disregarding valuable information about the authors of messages and the participants of the various discussions. Newsgroup Crowds graphically represents the population of authors in a particular newsgroup. Authors are displayed according to the number of messages they contribute to each thread and the number of different days they appear in the space, illustrating and contrasting the interaction patterns of participants within the newsgroup. AuthorLines visualizes a particular author's posting activity across all newsgroups over a period of one year. This visualization reveals temporal patterns of thread initiation and reply that can broadly characterize the roles authors play in Usenet. We report the results of a user study that explored the value of these interfaces for developing high-level awareness of the activity and population in these conversational spaces. We suggest that interfaces that convey information about the social histories of populations and individuals may support better selection and evaluation of newsgroup content.
---
paper_title: Interactive Exploration of Data Traffic with Hierarchical Network Maps

paper_content:

Network communication has become indispensable in business, education and government. With the pervasive role of the Internet as a means of sharing information across networks, its misuse for destructive purposes, such as spreading malicious code, compromising remote hosts, or damaging data through unauthorized access, has grown immensely in the recent years. The classical way of monitoring the operation of large network systems is by analyzing the system logs for detecting anomalies. In this work, we introduce hierarchical network map, an interactive visualization technique for gaining a deeper insight into network flow behavior by means of user-driven visual exploration. Our approach is meant as an enhancement to conventional analysis methods based on statistics or machine learning. We use multidimensional modeling combined with position and display awareness to view source and target data of the hosts in a hierarchical fashion with the ability to interactively change the level of aggregation or apply filtering. The interdisciplinary approach integrating data warehouse technology, information visualization and decision support brings about the benefit of efficiently collecting the input data and aggregating over very large data sets, visualizing the results and providing interactivity to facilitate analytical reasoning
---
paper_title: ScatterBlogs2: Real-Time Monitoring of Microblog Messages through User-Guided Filtering

paper_content:

The number of microblog posts published daily has reached a level that hampers the effective retrieval of relevant messages, and the amount of information conveyed through services such as Twitter is still increasing. Analysts require new methods for monitoring their topic of interest, dealing with the data volume and its dynamic nature. It is of particular importance to provide situational awareness for decision making in time-critical tasks. Current tools for monitoring microblogs typically filter messages based on user-defined keyword queries and metadata restrictions. Used on their own, such methods can have drawbacks with respect to filter accuracy and adaptability to changes in trends and topic structure. We suggest ScatterBlogs2, a new approach to let analysts build task-tailored message filters in an interactive and visual manner based on recorded messages of well-understood previous events. These message filters include supervised classification and query creation backed by the statistical distribution of terms and their co-occurrences. The created filter methods can be orchestrated and adapted afterwards for interactive, visual real-time monitoring and analysis of microblog feeds. We demonstrate the feasibility of our approach for analyzing the Twitter stream in emergency management scenarios.
---
paper_title: A visual analytics process for maritime resource allocation and risk assessment

paper_content:

In this paper, we present our collaborative work with the U.S. Coast Guard's Ninth District and Atlantic Area Commands where we developed a visual analytics system to analyze historic response operations and assess the potential risks in the maritime environment associated with the hypothetical allocation of Coast Guard resources. The system includes linked views and interactive displays that enable the analysis of trends, patterns and anomalies among the U.S. Coast Guard search and rescue (SAR) operations and their associated sorties. Our system allows users to determine the potential change in risks associated with closing certain stations in terms of response time, potential lives and property lost and provides optimal direction as to the nearest available station. We provide maritime risk assessment tools that allow analysts to explore Coast Guard coverage for SAR operations and identify regions of high risk. The system also enables a thorough assessment of all SAR operations conducted by each Coast Guard station in the Great Lakes region. Our system demonstrates the effectiveness of visual analytics in analyzing risk within the maritime domain and is currently being used by analysts at the Coast Guard Atlantic Area.
---
paper_title: A visual analytics framework for spatio-temporal analysis and modelling

paper_content:

To support analysis and modelling of large amounts of spatio-temporal data having the form of spatially referenced time series (TS) of numeric values, we combine interactive visual techniques with computational methods from machine learning and statistics. Clustering methods and interactive techniques are used to group TS by similarity. Statistical methods for TS modelling are then applied to representative TS derived from the groups of similar TS. The framework includes interactive visual interfaces to a library of modelling methods supporting the selection of a suitable method, adjustment of model parameters, and evaluation of the models obtained. The models can be externally stored, communicated, and used for prediction and in further computational analyses. From the visual analytics perspective, the framework suggests a way to externalize spatio-temporal patterns emerging in the mind of the analyst as a result of interactive visual analysis: the patterns are represented in the form of computer-processable and reusable models. From the statistical analysis perspective, the framework demonstrates how TS analysis and modelling can be supported by interactive visual interfaces, particularly, in a case of numerous TS that are hard to analyse individually. From the application perspective, the framework suggests a way to analyse large numbers of spatial TS with the use of well-established statistical methods for TS analysis.
---
paper_title: MVSec: multi-perspective and deductive visual analytics on heterogeneous network security data

paper_content:

In this article, we present a visual analytics system, MVSec, which helps analysts understand better what information flows under network security datasets. The major contributions of this work include: (1) a data fusion strategy for multiple heterogeneous datasets by using unified event tuple and statistic tuple data structure, which compress large scale datasets and lays the foundation of cooperative visual analysis; (2) multiple coordinated views, which provide analysts with multiple visual perspectives to characterize loud events, dig out subtle events and investigate relations of events in datasets; and (3) a contextual visual analysis with deductive viewpoints, which inspires analysts to explore hypotheses and reason their deductions from visual narratives. In case studies, we demonstrate in detail how the system helps analysts draw an analytical storyline and understand network situations better in VAST Challenge 2013. Additionally, we discuss lessons learned in designing our system and participating in VAST Challenge 2013, which is helpful and applicable not only to similar network security systems but also to other domains facing visual analytics challenges.
---
paper_title: SpiralView: Towards Security Policies Assessment through Visual Correlation of Network Resources with Evolution of Alarms

paper_content:

This article presents SpiralView, a visualization tool for helping system administrators to assess network policies. The tool is meant to be a complementary support to the routine activity of network monitoring, enabling a retrospective view on the alarms generated during and extended period of time. The tool permits to reason about how alarms distribute over time and how they correlate with network resources (e.g., users, IPs, applications, etc.), supporting the analysts in understanding how the network evolves and thus in devising new security policies for the future. The spiral visualization plots alarms in time, and, coupled with interactive bar charts and a users/applications graph view, is used to present network data and perform queries. The user is able to segment the data in meaningful subsets, zoom on specific related information, and inspect for relationships between alarms, users, and applications. In designing the visualizations and their interaction, and through tests with security experts, several ameliorations over the standard techniques have been provided.
---
paper_title: LeadLine: Interactive visual analysis of text data through event identification and exploration

paper_content:

Text data such as online news and microblogs bear valuable insights regarding important events and responses to such events. Events are inherently temporal, evolving over time. Existing visual text analysis systems have provided temporal views of changes based on topical themes extracted from text data. But few have associated topical themes with events that cause the changes. In this paper, we propose an interactive visual analytics system, LeadLine, to automatically identify meaningful events in news and social media data and support exploration of the events. To characterize events, LeadLine integrates topic modeling, event detection, and named entity recognition techniques to automatically extract information regarding the investigative 4 Ws: who, what, when, and where for each event. To further support analysis of the text corpora through events, LeadLine allows users to interactively examine meaningful events using the 4 Ws to develop an understanding of how and why. Through representing large-scale text corpora in the form of meaningful events, LeadLine provides a concise summary of the corpora. LeadLine also supports the construction of simple narratives through the exploration of events. To demonstrate the efficacy of LeadLine in identifying events and supporting exploration, two case studies were conducted using news and social media data.
---
paper_title: A Visual Analytics Approach for Detecting and Understanding Anomalous Resident Behaviors in Smart Healthcare

paper_content:

With the development of science and technology, it is possible to analyze residents’ daily behaviors for the purpose of smart healthcare in the smart home environment. Many researchers have begun to detect residents’ anomalous behaviors and assess their physical condition, but these approaches used by the researchers are often caught in plight caused by a lack of ground truth, one-sided analysis of behavior, and difficulty of understanding behaviors. In this paper, we put forward a smart home visual analysis system (SHVis) to help analysts detect and comprehend unusual behaviors of residents, and predict the health information intelligently. Firstly, the system classifies daily activities recorded by sensor devices in smart home environment into different categories, and discovers unusual behavior patterns of residents living in this environment by using various characteristics extracted from those activities and appropriate unsupervised anomaly detection algorithm. Secondly, on the basis of figuring out the residents’ anomaly degree of every date, we explore the daily behavior patterns and details with the help of several visualization views, and compare and analyze residents’ activities of various dates to find the reasons why residents act unusually. In the case study of this paper, we analyze residents’ behaviors that happened over two months and find unusual indoor behaviors and give health advice to the residents.
---
paper_title: Visual analytics methods for categoric spatio-temporal data

paper_content:

We focus on visual analysis of space- and time-referenced categorical data, which describe possible states of spatial (geographical) objects or locations and their changes over time. The analysis of these data is difficult as there are only limited possibilities to analyze the three aspects (location, time and category) simultaneously. We present a new approach which interactively combines (a) visualization of categorical changes over time; (b) various spatial data displays; (c) computational techniques for task-oriented selection of time steps. They provide an expressive visualization with regard to either the overall evolution over time or unusual changes. We apply our approach on two use cases demonstrating its usefulness for a wide variety of tasks. We analyze data from movement tracking and meteorologic areas. Using our approach, expected events could be detected and new insights were gained.
---
paper_title: A fraud detection visualization system utilizing radial drawings and heat-maps

paper_content:

We present a prototype system developed in cooperation with a business organization that combines information visualization and pattern-matching techniques to detect fraudulent activity by employees. The system is built upon common fraud patterns searched while trying to detect occupational fraud suggested by internal auditors of a business company. The main visualization of the system consists of a multi-layer radial drawing that represents the activity of the employees and clients. Each layer represents a different examined pattern whereas heat-maps indicating suspicious activity are incorporated in the visualization. The data are first preprocessed based on a decision tree generated by the examined patterns and each employee is assigned a value indicating whether or not there exist indications of fraud. The visualization is presented as an animation and the employees are visualized one by one according to their severity values together with their related clients.
---
paper_title: #FluxFlow: Visual Analysis of Anomalous Information Spreading on Social Media

paper_content:

We present FluxFlow, an interactive visual analysis system for revealing and analyzing anomalous information spreading in social media. Everyday, millions of messages are created, commented, and shared by people on social media websites, such as Twitter and Facebook. This provides valuable data for researchers and practitioners in many application domains, such as marketing, to inform decision-making. Distilling valuable social signals from the huge crowd's messages, however, is challenging, due to the heterogeneous and dynamic crowd behaviors. The challenge is rooted in data analysts' capability of discerning the anomalous information behaviors, such as the spreading of rumors or misinformation, from the rest that are more conventional patterns, such as popular topics and newsworthy events, in a timely fashion. FluxFlow incorporates advanced machine learning algorithms to detect anomalies, and offers a set of novel visualization designs for presenting the detected threads for deeper analysis. We evaluated FluxFlow with real datasets containing the Twitter feeds captured during significant events such as Hurricane Sandy. Through quantitative measurements of the algorithmic performance and qualitative interviews with domain experts, the results show that the back-end anomaly detection model is effective in identifying anomalous retweeting threads, and its front-end interactive visualizations are intuitive and useful for analysts to discover insights in data and comprehend the underlying analytical model.
---
paper_title: An advanced network visualization system for financial crime detection

paper_content:

We present a new system, VISFAN, for the visual analysis of financial activity networks. It supports the analyst with effective tools to discover financial crimes, like money laundering and frauds. If compared with other existing systems and methodologies for the analysis of criminal networks, VISFAN presents the following main novelties: (i) It combines bottom-up and top-down interaction paradigms for the visual exploration of complex networks; (ii) It makes it possible to mix automatic and manual clustering; (iii) It allows the analyst to interactively customize the dimensions of each cluster region and to apply different geometric constraints on the layout. VISFAN also implements several tools for social network analysis other than clustering. For example, it computes several indices to measure the centrality of each actor in the network.
---
paper_title: Visual Exploration and Analysis of Historic Hotel Visits

paper_content:

Understanding the spatial and temporal characteristics of individual and group behavior in social networks is a critical component of visual tools for intelligence analysis, emergency management, consumer analysis, and human geography. Identification and analysis of patterns of recurring events is an essential feature of such tools. In this paper, we describe an interactive visual tool for exploring the visitation patterns of guests at two hotels in central Pennsylvania from 1894 to 1900. The centerpiece of the tool is a wrapping spreadsheet technique, called reruns, that reveals regular and irregular periodic patterns of events in multiple overlapping artificial and natural calendars. Implemented as a coordinated multiple view visualization in Improvise, the tool is in ongoing development through an iterative process of data collection, transcription, hypothesis, design, discovery, analysis, and evaluation in close collaboration with historical geographers. Numerous discoveries have driven additional data collection from archival newspaper and census sources, as well as plans to enhance analysis of spatial patterns using historic weather records and railroad schedules. Distributed online evaluations of usability and usefulness have resulted in feature and design recommendations that are being incorporated into the tool.
---
paper_title: Visual Exploration of Big Spatio-Temporal Urban Data: A Study of New York City Taxi Trips

paper_content:

As increasing volumes of urban data are captured and become available, new opportunities arise for data-driven analysis that can lead to improvements in the lives of citizens through evidence-based decision making and policies. In this paper, we focus on a particularly important urban data set: taxi trips. Taxis are valuable sensors and information associated with taxi trips can provide unprecedented insight into many different aspects of city life, from economic activity and human behavior to mobility patterns. But analyzing these data presents many challenges. The data are complex, containing geographical and temporal components in addition to multiple variables associated with each trip. Consequently, it is hard to specify exploratory queries and to perform comparative analyses (e.g., compare different regions over time). This problem is compounded due to the size of the data-there are on average 500,000 taxi trips each day in NYC. We propose a new model that allows users to visually query taxi trips. Besides standard analytics queries, the model supports origin-destination queries that enable the study of mobility across the city. We show that this model is able to express a wide range of spatio-temporal queries, and it is also flexible in that not only can queries be composed but also different aggregations and visual representations can be applied, allowing users to explore and compare results. We have built a scalable system that implements this model which supports interactive response times; makes use of an adaptive level-of-detail rendering strategy to generate clutter-free visualization for large results; and shows hidden details to the users in a summary through the use of overlay heat maps. We present a series of case studies motivated by traffic engineers and economists that show how our model and system enable domain experts to perform tasks that were previously unattainable for them.
---
paper_title: Voila: Visual Anomaly Detection and Monitoring with Streaming Spatiotemporal Data

paper_content:

The increasing availability of spatiotemporal data continuously collected from various sources provides new opportunities for a timely understanding of the data in their spatial and temporal context. Finding abnormal patterns in such data poses significant challenges. Given that there is often no clear boundary between normal and abnormal patterns, existing solutions are limited in their capacity of identifying anomalies in large, dynamic and heterogeneous data, interpreting anomalies in their multifaceted, spatiotemporal context, and allowing users to provide feedback in the analysis loop. In this work, we introduce a unified visual interactive system and framework, Voila, for interactively detecting anomalies in spatiotemporal data collected from a streaming data source. The system is designed to meet two requirements in real-world applications, i.e., online monitoring and interactivity. We propose a novel tensor-based anomaly analysis algorithm with visualization and interaction design that dynamically produces contextualized, interpretable data summaries and allows for interactively ranking anomalous patterns based on user input. Using the “smart city” as an example scenario, we demonstrate the effectiveness of the proposed framework through quantitative evaluation and qualitative case studies.
---
paper_title: TelCoVis: Visual Exploration of Co-occurrence in Urban Human Mobility Based on Telco Data

paper_content:

Understanding co-occurrence in urban human mobility (i.e. people from two regions visit an urban place during the same time span) is of great value in a variety of applications, such as urban planning, business intelligence, social behavior analysis, as well as containing contagious diseases. In recent years, the widespread use of mobile phones brings an unprecedented opportunity to capture large-scale and fine-grained data to study co-occurrence in human mobility. However, due to the lack of systematic and efficient methods, it is challenging for analysts to carry out in-depth analyses and extract valuable information. In this paper, we present TelCoVis, an interactive visual analytics system, which helps analysts leverage their domain knowledge to gain insight into the co-occurrence in urban human mobility based on telco data. Our system integrates visualization techniques with new designs and combines them in a novel way to enhance analysts' perception for a comprehensive exploration. In addition, we propose to study the correlations in co-occurrence (i.e. people from multiple regions visit different places during the same time span) by means of biclustering techniques that allow analysts to better explore coordinated relationships among different regions and identify interesting patterns. The case studies based on a real-world dataset and interviews with domain experts have demonstrated the effectiveness of our system in gaining insights into co-occurrence and facilitating various analytical tasks.
---
paper_title: Characterising group-cycling journeys using interactive graphics

paper_content:

The group-cycling behaviours of over 16,000 members of the London Cycle Hire Scheme (LCHS), a large public bikeshare system, are identified and analysed. Group journeys are defined as trips made by two or more cyclists together in space and time. Detailed insights into group-cycling behaviour are generated using specifically designed visualization software. We find that in many respects group-cycle journeys fit an expected pattern of discretionary activity: group journeys are more likely at weekends, late evenings and lunchtimes; they generally take place within more pleasant parts of the city; and between individuals apparently known to each other. A separate set of group activity is found, however, that coincides with commuting peaks and that appears to be imposed onto LCHS users by the scheme’s design. Studying the characteristics of individuals making group journeys, we identify a group of less experienced LCHS cyclists that appear to make more spatially extensive journeys than they would do normally while cycling with others; and that female cyclists are more likely to make late evening journeys when cycling in groups. For 20% of group cyclists, the first journey ever made through the LCHS was a group journey; this is particularly surprising since just 9% of all group cyclists’ journeys are group journeys. Moreover, we find that women are very significantly (p < 0.001) overrepresented amongst these ‘first time group cyclists’. Studying the bikeshare cyclists, or bike share ‘friends’, that individuals make ‘first time group journeys’ with, we find a significantly high incidence (p < 0.001) of group journeys being made with friends of the opposite gender, and for a very large proportion (55%) of members these first ever journeys are made with a friend that shares the same postcode. A substantial insight, then, is that group cycling appears to be a means through which early LCHS usage is initiated.
---
paper_title: Anomaly detection in GPS data based on visual analytics

paper_content:

Modern machine learning techniques provide robust approaches for data-driven modeling and critical information extraction, while human experts hold the advantage of possessing high-level intelligence and domain-specific expertise. We combine the power of the two for anomaly detection in GPS data by integrating them through a visualization and human-computer interaction interface. In this paper we introduce GPSvas (GPS Visual Analytics System), a system that detects anomalies in GPS data using the approach of visual analytics: a conditional random field (CRF) model is used as the machine learning component for anomaly detection in streaming GPS traces. A visualization component and an interactive user interface are built to visualize the data stream, display significant analysis results (i.e., anomalies or uncertain predications) and hidden information extracted by the anomaly detection model, which enable human experts to observe the real-time data behavior and gain insights into the data flow. Human experts further provide guidance to the machine learning model through the interaction tools; the learning model is then incrementally improved through an active learning procedure.
---
paper_title: VisTracer: a visual analytics tool to investigate routing anomalies in traceroutes

paper_content:

Routing in the Internet is vulnerable to attacks due to the insecure design of the border gateway protocol (BGP). One possible exploitation of this insecure design is the hijacking of IP blocks. Such hijacked IP blocks can then be used to conduct malicious activities from seemingly legitimate IP addresses. In this study we actively trace and monitor the routes to spam sources over several consecutive days after having received a spam message from such a source. However, the real challenge is to distinguish between legitimate routing changes and those ones that are related to systematic misuse in so-called spam campaigns. To combine the strengths of human judgement and computational efficiency, we thus present a novel visual analytics tool named Vistracer in this paper. This tool represents analysis results of our anomaly detection algorithms on large traceroute data sets with the help of several scalable representations to support the analyst to explore, identify and analyze suspicious events and their relations to malicious activities. In particular, pixel-based visualization techniques, novel glyph-based summary representations and a combination of temporal glyphs in a graph representation are used to give an overview of route changes to specific destinations over time. To evaluate our tool, real-world case studies demonstrate the usage of Vistracer in practice on large-scale data sets.
---
paper_title: VisFlowConnect: netflow visualizations of link relationships for security situational awareness

paper_content:

We present a visualization design to enhance the ability of an administrator to detect and investigate anomalous traffic between a local network and external domains. Central to the design is a parallel axes view which displays NetFlow records as links between two machines or domains while employing a variety of visual cues to assist the user. We describe several filtering options that can be employed to hide uninteresting or innocuous traffic such that the user can focus his or her attention on the more unusual network flows. This design is implemented in the form of VisFlowConnect, a prototype application which we used to study the effectiveness of our visualization approach. Using VisFlowConnect, we were able to discover a variety of interesting network traffic patterns. Some of these were harmless, normal behavior, but some were malicious attacks against machines on the network.
---
paper_title: Combining visual and automated data mining for near-real-time anomaly detection and analysis in BGP

paper_content:

The security of Internet routing is a major concern because attacks and errors can result in data packets not reaching their intended destination and/or falling into the wrong hands. A key step in improving routing security is to analyze and understand it. In the past, we and other researchers have presented various visual-based, statistical-based, and signature-based methods of analyzing Internet routing data. In this paper, we describe an integration of visual and automated data mining methods for discovering and investigating anomalies in Internet routing. We show how these different components are combined in such a way as to complement each other, creating a very effective and useful analysis tool. In addition to performing analysis on archived data, our system is able to collect, process and visualize data in near-real-time.
---
paper_title: Detecting flaws and intruders with visual data analysis

paper_content:

The task of sifting through large amounts of data to find useful information spawned the field of data mining. Most data mining approaches are based on machine-learning techniques, numerical analysis, or statistical modeling. They use human interaction and visualization only minimally. Such automatic methods can miss some important features of the data. Incorporating human perception into the data mining process through interactive visualization can help us better understand the complex behaviors of computer network systems. This article describes visual-analytics-based solutions and outlines a visual exploration process for log analysis. Three log-file analysis applications demonstrate our approach's effectiveness in discovering flaws and intruders in network systems.
---
paper_title: NStreamAware: real-time visual analytics for data streams to enhance situational awareness

paper_content:

The analysis of data streams is important in many security-related domains to gain situational awareness. To provide monitoring and visual analysis of such data streams, we propose a system, called NStreamAware, that uses modern distributed processing technologies to analyze streams using stream slices, which are presented to analysts in a web-based visual analytics application, called NVisAware. Furthermore, we visually guide the user in the feature selection process to summarize the slices to focus on the most interesting parts of the stream based on introduced expert knowledge of the analyst. We show through case studies, how the system can be used to gain situational awareness and eventually enhance network security. Furthermore, we apply the system to a social media data stream to compete in an international challenge to evaluate the applicability of our approach to other domains.
---
paper_title: Visual correlation of network alerts

paper_content:

The VisAlert visual correlation tool facilitates situational awareness in complex network environments by providing a holistic view of network security to help detect malicious activities. Information visualization techniques and methods in many applications have effectively increased operators' situational awareness, letting them more effectively detect, diagnose, and treat anomalous conditions. Visualization elevates information comprehension by fostering rapid correlation and perceived associations. Our visualization technique integrates the information in log and alert files into an intuitive, flexible, extensible, and scalable visualization tool - VisAlert - that presents critical information concerning network activity in an integrated manner, increasing the user's situational awareness.
---
paper_title: Visualizing graph dynamics and similarity for enterprise network security and management

paper_content:

Managing complex enterprise networks requires an understanding at a finer granularity than traditional network monitoring. The ability to correlate and visualize the dynamics and inter-relationships among various network components such as hosts, users, and applications is non-trivial. In this paper, we propose a visualization approach based on the hierarchical structure of similarity/difference visualization in the context of heterogeneous graphs. The concept of hierarchical visualization starts with the evolution of inter-graph states, adapts to the visualization of intra-graph clustering, and concludes with the visualization of similarity between individual nodes. Our visualization tool, ENAVis (Enterprise Network Activities Visualization), quantifies and presents these important changes and dynamics essential to network operators through a visually appealing and highly interactive manner. Through novel graph construction and transformation, such as network connectivity graphs, MDS graphs, bipartite graphs, and similarity graphs, we demonstrate how similarity/dynamics can be effectively visualized to provide insight with regards to network understanding.
---
paper_title: FloVis: Flow Visualization System

paper_content:

NetFlow data is routinely captured at the border of many enterprise networks. Although not as rich as full packet–capture data, NetFlow provides a compact record of the interactions between host pairs on either side of the monitored border. Analysis of this data presents a challenge to the security analyst due to its volume. We report preliminary results on the development of a suite of visualization tools that are intended to complement command linetools, such as those from the SiLK Tools, that are currently used by analysts to perform forensic analysis of NetFlow data. The current version of the tool set draws on three visual paradigms: activity diagrams that display various aspects of multiple individual host behaviors as color1 coded time series, connection bundles that show the interactions among hosts and groups of hosts, and the NetBytes viewer that allows detailed examination of the port and volume behaviors of an individual host over a period of time. The system supports drill down for additional detail and pivoting that allows the analyst to examine the relationships among the displays. SiLK data is preprocessed into a relational database to drive the display modes, and the tools can interact with the SiLK system to extract additional data as necessary.
---
paper_title: Preserving the big picture: visual network traffic analysis with TNV

paper_content:

When performing packet-level analysis in intrusion detection, analysts often lose sight of the big picture while examining these low-level details. In order to prevent this loss of context and augment the available tools for intrusion detection analysis tasks, we developed an information visualization tool, the time-based network traffic visualizer (TNV). TNV is grounded in an understanding of the work practices of intrusion detection analysts, particularly foregrounding the overarching importance of context and time in the process of intrusion detection analysis. The main visual component of TNV is a matrix showing network activity of hosts over time, with connections between hosts superimposed on the matrix, complemented by multiple, linked views showing port activity and the details of the raw packets. Providing low-level textual data in the context of a high-level, aggregated graphical display enables analysts to examine packet-level details within the larger context of activity. This combination has the potential to facilitate the intrusion detection analysis tasks and help novice analysts learn what constitutes normal on a particular network.
---
paper_title: MVSec: multi-perspective and deductive visual analytics on heterogeneous network security data

paper_content:

In this article, we present a visual analytics system, MVSec, which helps analysts understand better what information flows under network security datasets. The major contributions of this work include: (1) a data fusion strategy for multiple heterogeneous datasets by using unified event tuple and statistic tuple data structure, which compress large scale datasets and lays the foundation of cooperative visual analysis; (2) multiple coordinated views, which provide analysts with multiple visual perspectives to characterize loud events, dig out subtle events and investigate relations of events in datasets; and (3) a contextual visual analysis with deductive viewpoints, which inspires analysts to explore hypotheses and reason their deductions from visual narratives. In case studies, we demonstrate in detail how the system helps analysts draw an analytical storyline and understand network situations better in VAST Challenge 2013. Additionally, we discuss lessons learned in designing our system and participating in VAST Challenge 2013, which is helpful and applicable not only to similar network security systems but also to other domains facing visual analytics challenges.
---
paper_title: Scalable and Interactive Visual Analysis of Financial Wire Transactions for Fraud Detection

paper_content:

Large financial institutions such as Bank of America handle hundreds of thousands of wire transactions per day. Although most transactions are legitimate, these institutions have legal and financial obligations to discover those that are suspicious. With the methods of fraudulent activities ever changing, searching on predefined patterns is often insufficient in detecting previously undiscovered methods. In this paper, we present a set of coordinated visualizations based on identifying specific keywords within the wire transactions. The different views used in our system depict relationships among keywords and accounts over time. Furthermore, we introduce a search-by-example technique, which extracts accounts that show similar transaction patterns. Our system can be connected to a database to handle millions of transactions and still preserve high interactivity. In collaboration with the Anti-Money Laundering division at Bank of America, we demonstrate that using our tool, investigators are able to detect accounts and transactions that exhibit suspicious behaviors.
---
paper_title: WireVis: Visualization of Categorical, Time-Varying Data From Financial Transactions

paper_content:

Large financial institutions such as Bank of America handle hundreds of thousands of wire transactions per day. Although most transactions are legitimate, these institutions have legal and financial obligations in discovering those that are suspicious. With the methods of fraudulent activities ever changing, searching on predefined patterns is often insufficient in detecting previously undiscovered methods. In this paper, we present a set of coordinated visualizations based on identifying specific keywords within the wire transactions. The different views used in our system depict relationships among keywords and accounts over time. Furthermore, we introduce a search-by-example technique which extracts accounts that show similar transaction patterns. In collaboration with the Anti-Money Laundering division at Bank of America, we demonstrate that using our tool, investigators are able to detect accounts and transactions that exhibit suspicious behaviors.
---
paper_title: VisTracer: a visual analytics tool to investigate routing anomalies in traceroutes

paper_content:

Routing in the Internet is vulnerable to attacks due to the insecure design of the border gateway protocol (BGP). One possible exploitation of this insecure design is the hijacking of IP blocks. Such hijacked IP blocks can then be used to conduct malicious activities from seemingly legitimate IP addresses. In this study we actively trace and monitor the routes to spam sources over several consecutive days after having received a spam message from such a source. However, the real challenge is to distinguish between legitimate routing changes and those ones that are related to systematic misuse in so-called spam campaigns. To combine the strengths of human judgement and computational efficiency, we thus present a novel visual analytics tool named Vistracer in this paper. This tool represents analysis results of our anomaly detection algorithms on large traceroute data sets with the help of several scalable representations to support the analyst to explore, identify and analyze suspicious events and their relations to malicious activities. In particular, pixel-based visualization techniques, novel glyph-based summary representations and a combination of temporal glyphs in a graph representation are used to give an overview of route changes to specific destinations over time. To evaluate our tool, real-world case studies demonstrate the usage of Vistracer in practice on large-scale data sets.
---
paper_title: VisFlowConnect: netflow visualizations of link relationships for security situational awareness

paper_content:

We present a visualization design to enhance the ability of an administrator to detect and investigate anomalous traffic between a local network and external domains. Central to the design is a parallel axes view which displays NetFlow records as links between two machines or domains while employing a variety of visual cues to assist the user. We describe several filtering options that can be employed to hide uninteresting or innocuous traffic such that the user can focus his or her attention on the more unusual network flows. This design is implemented in the form of VisFlowConnect, a prototype application which we used to study the effectiveness of our visualization approach. Using VisFlowConnect, we were able to discover a variety of interesting network traffic patterns. Some of these were harmless, normal behavior, but some were malicious attacks against machines on the network.
---
paper_title: Occupational fraud detection through visualization

paper_content:

Occupational fraud affects many companies causing them economic loss and liability issues towards their clients and other entities. Detecting internal fraud requires significant effort since a huge amount of data produced by diverse systems (which are mostly in textual form) has to be processed with little automated support. In this paper, we exploit the advantages of information visualization and present a system that aims to detect occupational fraud in systems which involve a pair of entities (e.g., an employee and a client). The main visualization is a spiral on which the events are drawn according to their time-stamp. Suspicious events are considered those which appear along the same radius or on close radii. The system ranks both entities according to the specifications of the auditor and a video file of their activity is generated such that events with strong evidence of fraud appear first. The system is equipped with several visualizations that facilitate the detection procedure.
---
paper_title: Network Explorer: Design, Implementation, and Real World Deployment of a Large Network Visualization Tool

paper_content:

This paper describes the process of design, implementation, and real world deployment of a web-based network exploration tool called Network Explorer. We designed Network Explorer based on the expressed needs of our clients and later deployed it as part of a larger system for fraud detection in health care. Our implementation of Network Explorer provides visual interactive access to large-scale network data. As part of the Network Explorer tool we contribute a dynamic group-in-a-box implementation for laying out clusters, and a node navigator widget that aids in the exploration of large networks. We are also contributing two open source components of the Network Explorer for the community to reuse: an in-browser clustering library, and the dynamic group-in-a-box algorithm. We have evaluated the network explorer tool in multiple real-world environments including the fraud detection setting above.
---
paper_title: Combining visual and automated data mining for near-real-time anomaly detection and analysis in BGP

paper_content:

The security of Internet routing is a major concern because attacks and errors can result in data packets not reaching their intended destination and/or falling into the wrong hands. A key step in improving routing security is to analyze and understand it. In the past, we and other researchers have presented various visual-based, statistical-based, and signature-based methods of analyzing Internet routing data. In this paper, we describe an integration of visual and automated data mining methods for discovering and investigating anomalies in Internet routing. We show how these different components are combined in such a way as to complement each other, creating a very effective and useful analysis tool. In addition to performing analysis on archived data, our system is able to collect, process and visualize data in near-real-time.
---
paper_title: VisImpact: business impact visualization

paper_content:

Business Intelligence (BI) deals with transforming raw business data into valuable information for making decisions. The goal is to improve the operation and use of large-scale, complex information systems. A number of automated BI techniques are available. These methods, however, have to be supported by user interaction to make successful business decisions. In this paper, we present a new technique for interactive business intelligence based on visualization technology, called VisImpact. The basic idea of the VisImpact technique is to visually display the relationships between the important business operation parameters and the distribution of the process flow. We have applied VisImpact in the areas of business contract analysis, business operation analysis, and fraud analysis, to show the power of the VisImpact technique for finding process flows, patterns, and trends, and for a quick identification of exceptions (outliers). Our interactive VisImpact system provides the means for an instant drilldown to a transaction record level which allows observing the evolution of business dynamics.
---
paper_title: Detecting flaws and intruders with visual data analysis

paper_content:

The task of sifting through large amounts of data to find useful information spawned the field of data mining. Most data mining approaches are based on machine-learning techniques, numerical analysis, or statistical modeling. They use human interaction and visualization only minimally. Such automatic methods can miss some important features of the data. Incorporating human perception into the data mining process through interactive visualization can help us better understand the complex behaviors of computer network systems. This article describes visual-analytics-based solutions and outlines a visual exploration process for log analysis. Three log-file analysis applications demonstrate our approach's effectiveness in discovering flaws and intruders in network systems.
---
paper_title: NStreamAware: real-time visual analytics for data streams to enhance situational awareness

paper_content:

The analysis of data streams is important in many security-related domains to gain situational awareness. To provide monitoring and visual analysis of such data streams, we propose a system, called NStreamAware, that uses modern distributed processing technologies to analyze streams using stream slices, which are presented to analysts in a web-based visual analytics application, called NVisAware. Furthermore, we visually guide the user in the feature selection process to summarize the slices to focus on the most interesting parts of the stream based on introduced expert knowledge of the analyst. We show through case studies, how the system can be used to gain situational awareness and eventually enhance network security. Furthermore, we apply the system to a social media data stream to compete in an international challenge to evaluate the applicability of our approach to other domains.
---
paper_title: Visual correlation of network alerts

paper_content:

The VisAlert visual correlation tool facilitates situational awareness in complex network environments by providing a holistic view of network security to help detect malicious activities. Information visualization techniques and methods in many applications have effectively increased operators' situational awareness, letting them more effectively detect, diagnose, and treat anomalous conditions. Visualization elevates information comprehension by fostering rapid correlation and perceived associations. Our visualization technique integrates the information in log and alert files into an intuitive, flexible, extensible, and scalable visualization tool - VisAlert - that presents critical information concerning network activity in an integrated manner, increasing the user's situational awareness.
---
paper_title: The Event Tunnel: Interactive Visualization of Complex Event Streams for Business Process Pattern Analysis

paper_content:

Event-based systems are gaining increasing popularity for building loosely coupled and distributed systems. Since business processes are becoming more interconnected and event-driven, event-based systems fit well for supporting and monitoring business processes. In this paper, we present an event-based business intelligence tool, the Event Tunnel framework. It provides an interactive visualization of event streams to support business analysts in exploring business incidents. The visualization is based on the metaphor of considering the event stream as a cylindrical tunnel, which is presented to the user from multiple perspectives. The information of single events laid out in the Event Tunnel is encoded in event glyphs that allow for a selective mapping of event attributes to colors, size and position. Different policies for the placement of the events in the tunnel as well as a clustering mechanism generate various views on historical event data. The Event Tunnel is able to display the relationships between events. This facilitates users to discover root causes and causal dependencies of event patterns. Our framework couples the event-tunnel visualization with query tools that allow users to search for relevant events within a data repository. Using query, filler and highlighting operations the analyst can navigate through the Event Tunnel until the required information or event patterns become visible. We demonstrate our approach with use cases from the fraud management and logistics domain.
---
paper_title: Visual Analytics for Networked-Guarantee Loans Risk Management

paper_content:

Groups of enterprises can guarantee each other and form complex networks in order to try to obtain loans from banks. Monitoring the financial status of a network, and preventing or reducing systematic risk in case of a crisis, is an area of great concern for the regulatory commission and for the banks. We set the ultimate goal of developing a visual analytic approach and tool for risk dissolving and decision-making. We have consolidated four main analysis tasks conducted by financial experts: i) Multi-faceted Default Risk Visualization, whereby a hybrid representation is devised to predict the default risk and an interface developed to visualize key indicators; ii) Risk Guarantee Patterns Discovery. We follow the Shneiderman mantra guidance for designing interactive visualization applications, whereby an interactive risk guarantee community detection and a motif detection based risk guarantee pattern discovery approach are described; iii) Network Evolution and Retrospective, whereby animation is used to help users to understand the guarantee dynamic; iv) Risk Communication Analysis. The temporal diffusion path analysis can be useful for the government and banks to monitor the spread of the default status. It also provides insight for taking precautionary measures to prevent and dissolve systematic financial risk. We implement the system with case studies using real-world bank loan data. Two financial experts are consulted to endorse the developed tool. To the best of our knowledge, this is the first visual analytics tool developed to explore networked-guarantee loan risks in a systematic manner.
---
paper_title: A visual analytics system to support tax evasion discovery

paper_content:

Abstract This paper describes TaxNet , a decision support system for tax evasion discovery, based on a powerful visual language and on advanced network visualization techniques. It has been developed in cooperation with the Italian Revenue Agency, where it is currently used. TaxNet allows users to visually define classes of suspicious patterns, it exploits effective graph pattern matching technologies to rapidly extract subgraphs that correspond to one or more patterns, it provides facilities to conveniently merge the results, and it implements new ad-hoc centrality indexes to rank taxpayers based on their fiscal risk. Moreover, it offers a visual interface to analyze and interact with those networks that match a desired pattern. The paper discusses the results of an experimental study and some use cases conducted with expert officers on real data and in a real working environment. The experiments give evidence of the effectiveness of our system.
---
paper_title: Visual Analysis of Collective Anomalies Through High-Order Correlation Graph

paper_content:

Detecting, analyzing and reasoning collective anomalies is important for many real-life application domains such as facility monitoring, software analysis and security. The main challenges include the overwhelming number of low-risk events and their multifaceted relationships which form the collective anomaly, the diversity in various data and anomaly types, and the difficulty to incorporate domain knowledge in the anomaly analysis process. In this paper, we propose a novel concept of high-order correlation graph (HOCG). Compared with the previous correlation graph definition, HOCG achieves better user interactivity, computational scalability, and domain generality through synthesizing heterogeneous types of nodes, attributes, and multifaceted relationships in a single graph. We design elaborate visual metaphors, interaction models, and the coordinated multiple view based interface to allow users to fully unleash the visual analytics power over HOCG. We conduct case studies in two real-life application domains, i.e., facility monitoring and software analysis. The results demonstrate the effectiveness of HOCG in the overview of point anomalies, detection of collective anomalies, and reasoning process of root cause analysis.
---
paper_title: NVisionIP: netflow visualizations of system state for security situational awareness

paper_content:

The number of attacks against large computer systems is currently growing at a rapid pace. Despite the best efforts of security analysts, large organizations are having trouble keeping on top of the current state of their networks. In this paper, we describe a tool called NVisionIP that is designed to increase the security analyst's situational awareness. As humans are inherently visual beings, NVisionIP uses a graphical representation of a class-B network to allow analysts to quickly visualize the current state of their network. We present an overview of NVisionIP along with a discussion of various types of security-related scenarios that it can be used to detect.
---
paper_title: Business Process Impact Visualization and Anomaly Detection

paper_content:

Business operations involve many factors and relationships and are modeled as complex business process workflows. The execution of these business processes generates vast volumes of complex data. The operational data are instances of the process flow, taking different paths through the process. The goal is to use the complex information to analyze and improve operations and to optimize the process flow. In this paper, we introduce a new visualization technique, called Vislmpact that turns raw operational business data into valuable information. Vislmpact reduces data complexity by analyzing operational data and abstracting the most critical factors, called impact factors, which influence business operations. The analysis may identify single nodes of the business flow graph as important factors but it may also determine aggregations of nodes to be important. Moreover, the analysis may find that single nodes have certain data values associated with them which have an influence on some business metrics or resource usage parameters. The impact factors are presented as nodes in a symmetric circular graph, providing insight into core business operations and relationships. A cause-effect mechanism is built in to determine 'good' and 'bad' operational behavior and to take action accordingly. We have applied Vislmpact to real-world applications, fraud analysis and service contract analysis, to show the power of Vislmpact for finding relationships among the most important impact factors and for immediate identification of anomalies. The Vislmpact system provides a highly interactive interface including drilldown capabilities down to transaction levels to allow multilevel views of business dynamics.
---
paper_title: Examining the Use of a Visual Analytics System for Sensemaking Tasks: Case Studies with Domain Experts

paper_content:

While the formal evaluation of systems in visual analytics is still relatively uncommon, particularly rare are case studies of prolonged system use by domain analysts working with their own data. Conducting case studies can be challenging, but it can be a particularly effective way to examine whether visual analytics systems are truly helping expert users to accomplish their goals. We studied the use of a visual analytics system for sensemaking tasks on documents by six analysts from a variety of domains. We describe their application of the system along with the benefits, issues, and problems that we uncovered. Findings from the studies identify features that visual analytics systems should emphasize as well as missing capabilities that should be addressed. These findings inform design implications for future systems.
---
paper_title: A visualization paradigm for network intrusion detection

paper_content:

We present a novel paradigm for visual correlation of network alerts from disparate logs. This paradigm facilitates and promotes situational awareness in complex network environments. Our approach is based on the notion that, by definition, an alert must possess three attributes, namely: what, when, and where. This fundamental premise, which we term w/sup 3/, provides a vehicle for comparing between seemingly disparate events. We propose a concise and scalable representation of these three attributes, that leads to a flexible visualization tool that is also clear and intuitive to use. Within our system, alerts can be grouped and viewed hierarchically with respect to both their type, i.e., the what, and to their where attributes. Further understanding is gained by displaying the temporal distribution of alerts to reveal complex attack trends. Finally, we propose a set of visual metaphor extensions that augment the proposed paradigm and enhance users' situational awareness. These metaphors direct the attention of users to many-to-one correlations within the current display helping them detect abnormal network activity.
---
paper_title: FloVis: Flow Visualization System

paper_content:

NetFlow data is routinely captured at the border of many enterprise networks. Although not as rich as full packet–capture data, NetFlow provides a compact record of the interactions between host pairs on either side of the monitored border. Analysis of this data presents a challenge to the security analyst due to its volume. We report preliminary results on the development of a suite of visualization tools that are intended to complement command linetools, such as those from the SiLK Tools, that are currently used by analysts to perform forensic analysis of NetFlow data. The current version of the tool set draws on three visual paradigms: activity diagrams that display various aspects of multiple individual host behaviors as color1 coded time series, connection bundles that show the interactions among hosts and groups of hosts, and the NetBytes viewer that allows detailed examination of the port and volume behaviors of an individual host over a period of time. The system supports drill down for additional detail and pivoting that allows the analyst to examine the relationships among the displays. SiLK data is preprocessed into a relational database to drive the display modes, and the tools can interact with the SiLK system to extract additional data as necessary.
---
paper_title: EVA: Visual Analytics to Identify Fraudulent Events

paper_content:

Financial institutions are interested in ensuring security and quality for their customers. Banks, for instance, need to identify and stop harmful transactions in a timely manner. In order to detect fraudulent operations, data mining techniques and customer profile analysis are commonly used. However, these approaches are not supported by Visual Analytics techniques yet. Visual Analytics techniques have potential to considerably enhance the knowledge discovery process and increase the detection and prediction accuracy of financial fraud detection systems. Thus, we propose EVA, a Visual Analytics approach for supporting fraud investigation, fine-tuning fraud detection algorithms, and thus, reducing false positive alarms.
---
paper_title: Combining Computational Analyses and Interactive Visualization for Document Exploration and Sensemaking in Jigsaw

paper_content:

Investigators across many disciplines and organizations must sift through large collections of text documents to understand and piece together information. Whether they are fighting crime, curing diseases, deciding what car to buy, or researching a new field, inevitably investigators will encounter text documents. Taking a visual analytics approach, we integrate multiple text analysis algorithms with a suite of interactive visualizations to provide a flexible and powerful environment that allows analysts to explore collections of documents while sensemaking. Our particular focus is on the process of integrating automated analyses with interactive visualizations in a smooth and fluid manner. We illustrate this integration through two example scenarios: An academic researcher examining InfoVis and VAST conference papers and a consumer exploring car reviews while pondering a purchase decision. Finally, we provide lessons learned toward the design and implementation of visual analytics systems for document exploration and understanding.
---
paper_title: Network intrusion visualization with NIVA, an intrusion detection visual analyzer with haptic integration

paper_content:

The explosive growth of malicious activities on worldwide communication networks, such as the Internet, has highlighted the need for efficient intrusion detection systems. The efficiency of traditional intrusion detection systems is limited by their inability to effectively relay relevant information due to their lack of interactive/immersive technologies. We explore several network visualization techniques geared towards intrusion detection on small and large-scale networks. We also examine the use of haptics in network intrusion visualization. By incorporating concepts from electromagnetics, fluid dynamics, and gravitational theory, we show that haptic technologies can provide another dimension of information critical to the efficient visualization of network intrusion data. Furthermore, we explore the applicability of these visualization techniques in conjunction with commercial network intrusion detectors. Finally, we present a network intrusion visualization application with haptic integration, NIVA which allows the analyst to interactively investigate as well as efficiently detect structured attacks across time and space using advanced interactive three-dimensional displays.
---
paper_title: Network Intrusion Visualization with NIVA, an Intrusion Detection Visual and Haptic Analyzer

paper_content:

The rapid growth of malicious activities on worldwide communication networks, such as the Internet, has highlighted the need for efficient intrusion detection systems. The efficiency of traditional intrusion detection systems is limited, in part, by their inability to relay effectively relevant information due to their lack of interactive/immersive technologies. In this paper, we explore several network visualization techniques geared toward intrusion detection on small- and large-scale networks. We also examine the use of haptics in network intrusion visualization. By incorporating concepts from electromagnetics, fluid dynamics, and gravitational theory, we show that haptic technologies can provide another dimension of information critical to the efficient visualization of network intrusion data. Furthermore, we explore the applicability of these visualization techniques in conjunction with commercial network intrusion detectors. Finally, we present a network intrusion visualization application with haptic integration, NIVA, which allows the analyst to interactively investigate as well as efficiently detect structured attacks across time and space using advanced interactive three-dimensional displays.
---
paper_title: Preserving the big picture: visual network traffic analysis with TNV

paper_content:

When performing packet-level analysis in intrusion detection, analysts often lose sight of the big picture while examining these low-level details. In order to prevent this loss of context and augment the available tools for intrusion detection analysis tasks, we developed an information visualization tool, the time-based network traffic visualizer (TNV). TNV is grounded in an understanding of the work practices of intrusion detection analysts, particularly foregrounding the overarching importance of context and time in the process of intrusion detection analysis. The main visual component of TNV is a matrix showing network activity of hosts over time, with connections between hosts superimposed on the matrix, complemented by multiple, linked views showing port activity and the details of the raw packets. Providing low-level textual data in the context of a high-level, aggregated graphical display enables analysts to examine packet-level details within the larger context of activity. This combination has the potential to facilitate the intrusion detection analysis tasks and help novice analysts learn what constitutes normal on a particular network.
---
paper_title: MVSec: multi-perspective and deductive visual analytics on heterogeneous network security data

paper_content:

In this article, we present a visual analytics system, MVSec, which helps analysts understand better what information flows under network security datasets. The major contributions of this work include: (1) a data fusion strategy for multiple heterogeneous datasets by using unified event tuple and statistic tuple data structure, which compress large scale datasets and lays the foundation of cooperative visual analysis; (2) multiple coordinated views, which provide analysts with multiple visual perspectives to characterize loud events, dig out subtle events and investigate relations of events in datasets; and (3) a contextual visual analysis with deductive viewpoints, which inspires analysts to explore hypotheses and reason their deductions from visual narratives. In case studies, we demonstrate in detail how the system helps analysts draw an analytical storyline and understand network situations better in VAST Challenge 2013. Additionally, we discuss lessons learned in designing our system and participating in VAST Challenge 2013, which is helpful and applicable not only to similar network security systems but also to other domains facing visual analytics challenges.
---
paper_title: SpiralView: Towards Security Policies Assessment through Visual Correlation of Network Resources with Evolution of Alarms

paper_content:

This article presents SpiralView, a visualization tool for helping system administrators to assess network policies. The tool is meant to be a complementary support to the routine activity of network monitoring, enabling a retrospective view on the alarms generated during and extended period of time. The tool permits to reason about how alarms distribute over time and how they correlate with network resources (e.g., users, IPs, applications, etc.), supporting the analysts in understanding how the network evolves and thus in devising new security policies for the future. The spiral visualization plots alarms in time, and, coupled with interactive bar charts and a users/applications graph view, is used to present network data and perform queries. The user is able to segment the data in meaningful subsets, zoom on specific related information, and inspect for relationships between alarms, users, and applications. In designing the visualizations and their interaction, and through tests with security experts, several ameliorations over the standard techniques have been provided.
---
paper_title: Case study: interactive visualization for internet security

paper_content:

Internet connectivity is defined by a set of routing protocols which let the routers that comprise the Internet backbone choose the best route for a packet to reach its destination. One way to improve the security and performance of Internet is to routinely examine the routing data. In this case study, we show how interactive visualization of Border Gateway Protocol (BGP) data helps characterize routing behavior, identify weaknesses in connectivity which could potentially cripple the Internet, as well as detect and explain actual anomalous events.
---
paper_title: A fraud detection visualization system utilizing radial drawings and heat-maps

paper_content:

We present a prototype system developed in cooperation with a business organization that combines information visualization and pattern-matching techniques to detect fraudulent activity by employees. The system is built upon common fraud patterns searched while trying to detect occupational fraud suggested by internal auditors of a business company. The main visualization of the system consists of a multi-layer radial drawing that represents the activity of the employees and clients. Each layer represents a different examined pattern whereas heat-maps indicating suspicious activity are incorporated in the visualization. The data are first preprocessed based on a decision tree generated by the examined patterns and each employee is assigned a value indicating whether or not there exist indications of fraud. The visualization is presented as an animation and the employees are visualized one by one according to their severity values together with their related clients.
---
paper_title: An advanced network visualization system for financial crime detection

paper_content:

We present a new system, VISFAN, for the visual analysis of financial activity networks. It supports the analyst with effective tools to discover financial crimes, like money laundering and frauds. If compared with other existing systems and methodologies for the analysis of criminal networks, VISFAN presents the following main novelties: (i) It combines bottom-up and top-down interaction paradigms for the visual exploration of complex networks; (ii) It makes it possible to mix automatic and manual clustering; (iii) It allows the analyst to interactively customize the dimensions of each cluster region and to apply different geometric constraints on the layout. VISFAN also implements several tools for social network analysis other than clustering. For example, it computes several indices to measure the centrality of each actor in the network.
---
paper_title: VisImpact: business impact visualization

paper_content:

Business Intelligence (BI) deals with transforming raw business data into valuable information for making decisions. The goal is to improve the operation and use of large-scale, complex information systems. A number of automated BI techniques are available. These methods, however, have to be supported by user interaction to make successful business decisions. In this paper, we present a new technique for interactive business intelligence based on visualization technology, called VisImpact. The basic idea of the VisImpact technique is to visually display the relationships between the important business operation parameters and the distribution of the process flow. We have applied VisImpact in the areas of business contract analysis, business operation analysis, and fraud analysis, to show the power of the VisImpact technique for finding process flows, patterns, and trends, and for a quick identification of exceptions (outliers). Our interactive VisImpact system provides the means for an instant drilldown to a transaction record level which allows observing the evolution of business dynamics.
---
paper_title: The Event Tunnel: Interactive Visualization of Complex Event Streams for Business Process Pattern Analysis

paper_content:

Event-based systems are gaining increasing popularity for building loosely coupled and distributed systems. Since business processes are becoming more interconnected and event-driven, event-based systems fit well for supporting and monitoring business processes. In this paper, we present an event-based business intelligence tool, the Event Tunnel framework. It provides an interactive visualization of event streams to support business analysts in exploring business incidents. The visualization is based on the metaphor of considering the event stream as a cylindrical tunnel, which is presented to the user from multiple perspectives. The information of single events laid out in the Event Tunnel is encoded in event glyphs that allow for a selective mapping of event attributes to colors, size and position. Different policies for the placement of the events in the tunnel as well as a clustering mechanism generate various views on historical event data. The Event Tunnel is able to display the relationships between events. This facilitates users to discover root causes and causal dependencies of event patterns. Our framework couples the event-tunnel visualization with query tools that allow users to search for relevant events within a data repository. Using query, filler and highlighting operations the analyst can navigate through the Event Tunnel until the required information or event patterns become visible. We demonstrate our approach with use cases from the fraud management and logistics domain.
---
paper_title: Visual Analytics for Networked-Guarantee Loans Risk Management

paper_content:

Groups of enterprises can guarantee each other and form complex networks in order to try to obtain loans from banks. Monitoring the financial status of a network, and preventing or reducing systematic risk in case of a crisis, is an area of great concern for the regulatory commission and for the banks. We set the ultimate goal of developing a visual analytic approach and tool for risk dissolving and decision-making. We have consolidated four main analysis tasks conducted by financial experts: i) Multi-faceted Default Risk Visualization, whereby a hybrid representation is devised to predict the default risk and an interface developed to visualize key indicators; ii) Risk Guarantee Patterns Discovery. We follow the Shneiderman mantra guidance for designing interactive visualization applications, whereby an interactive risk guarantee community detection and a motif detection based risk guarantee pattern discovery approach are described; iii) Network Evolution and Retrospective, whereby animation is used to help users to understand the guarantee dynamic; iv) Risk Communication Analysis. The temporal diffusion path analysis can be useful for the government and banks to monitor the spread of the default status. It also provides insight for taking precautionary measures to prevent and dissolve systematic financial risk. We implement the system with case studies using real-world bank loan data. Two financial experts are consulted to endorse the developed tool. To the best of our knowledge, this is the first visual analytics tool developed to explore networked-guarantee loan risks in a systematic manner.
---
paper_title: VisBiz: A Simplified Visualization of Business Operation

paper_content:

In this poster, we present a new technique, VisBiz, for interactively visualizing business operations. The basic idea of this technique is to visually mining relationships between important operation parameters (attributes) and to map the parameters into visualizations. VisBiz simplifies the complexity by partitioning the operation into multiple attribute circular graphs. VisBiz allows the analysis of business data as follows:
---
paper_title: Fraud detection using self-organizing map visualizing the user profiles

paper_content:

We propose a fraud detection method based on the user accounts visualization and threshold-type detection. The visualization technique employed in our approach is the Self-Organizing Map (SOM). Since the SOM technique in its original form visualizes only the vectors, and the user accounts are represented in our work as the matrices storing a collection of records reflecting the user sequential activities, we propose a method of the matrices visualization on the SOM grid, which constitutes the main contribution of this paper. Furthermore, we propose a method of the detection threshold setting on the basis of the SOM U-matrix. The results of the conducted experimental study on real data in three different research fields confirm the advantages and effectiveness of the proposed approach.
---
paper_title: EVA: Visual Analytics to Identify Fraudulent Events

paper_content:

Financial institutions are interested in ensuring security and quality for their customers. Banks, for instance, need to identify and stop harmful transactions in a timely manner. In order to detect fraudulent operations, data mining techniques and customer profile analysis are commonly used. However, these approaches are not supported by Visual Analytics techniques yet. Visual Analytics techniques have potential to considerably enhance the knowledge discovery process and increase the detection and prediction accuracy of financial fraud detection systems. Thus, we propose EVA, a Visual Analytics approach for supporting fraud investigation, fine-tuning fraud detection algorithms, and thus, reducing false positive alarms.
---
paper_title: VisFlowConnect: netflow visualizations of link relationships for security situational awareness

paper_content:

We present a visualization design to enhance the ability of an administrator to detect and investigate anomalous traffic between a local network and external domains. Central to the design is a parallel axes view which displays NetFlow records as links between two machines or domains while employing a variety of visual cues to assist the user. We describe several filtering options that can be employed to hide uninteresting or innocuous traffic such that the user can focus his or her attention on the more unusual network flows. This design is implemented in the form of VisFlowConnect, a prototype application which we used to study the effectiveness of our visualization approach. Using VisFlowConnect, we were able to discover a variety of interesting network traffic patterns. Some of these were harmless, normal behavior, but some were malicious attacks against machines on the network.
---
paper_title: Visual Exploration of Big Spatio-Temporal Urban Data: A Study of New York City Taxi Trips

paper_content:

As increasing volumes of urban data are captured and become available, new opportunities arise for data-driven analysis that can lead to improvements in the lives of citizens through evidence-based decision making and policies. In this paper, we focus on a particularly important urban data set: taxi trips. Taxis are valuable sensors and information associated with taxi trips can provide unprecedented insight into many different aspects of city life, from economic activity and human behavior to mobility patterns. But analyzing these data presents many challenges. The data are complex, containing geographical and temporal components in addition to multiple variables associated with each trip. Consequently, it is hard to specify exploratory queries and to perform comparative analyses (e.g., compare different regions over time). This problem is compounded due to the size of the data-there are on average 500,000 taxi trips each day in NYC. We propose a new model that allows users to visually query taxi trips. Besides standard analytics queries, the model supports origin-destination queries that enable the study of mobility across the city. We show that this model is able to express a wide range of spatio-temporal queries, and it is also flexible in that not only can queries be composed but also different aggregations and visual representations can be applied, allowing users to explore and compare results. We have built a scalable system that implements this model which supports interactive response times; makes use of an adaptive level-of-detail rendering strategy to generate clutter-free visualization for large results; and shows hidden details to the users in a summary through the use of overlay heat maps. We present a series of case studies motivated by traffic engineers and economists that show how our model and system enable domain experts to perform tasks that were previously unattainable for them.
---
paper_title: Interactive Visualization of Normal Behavioral Models and Expert Rules for Maritime Anomaly Detection

paper_content:

Maritime surveillance systems analyze vast amounts of heterogeneous sensor data from a large number of objects. In order to support the operator while monitoring such systems, the identification of anomalous vessels or situations that might need further investigation may reduce the operator's cognitive load. While it is worth acknowledging that many existing mining applications support identification of anomalous behavior, autonomous anomaly detection systems are rarely used in the real world, since the detection of anomalous behavior is normally not a well-defined problem and therefore, human expert knowledge is needed. This calls for the development of interaction components that can support the user in the detection process. In order to support the comprehension of the knowledge embedded in the system, we propose an interactive way of visualizing expert rules and normal behavioral models built from the data. The overall goal is to facilitate the validation and update of these models and signatures, supporting the insertion of human expert knowledge while improving confidence and trust in the system.
---
paper_title: FraudVis: Understanding Unsupervised Fraud Detection Algorithms

paper_content:

Discovering fraud user behaviors is vital to keeping online websites healthy. Fraudsters usually exhibit grouping behaviors, and researchers have effectively leveraged this behavior to design unsupervised algorithms to detect fraud user groups. In this work, we propose a visualization system, FraudVis, to visually analyze the unsupervised fraud detection algorithms from temporal, intra-group correlation, inter-group correlation, feature selection, and the individual user perspectives. FraudVis helps domain experts better understand the algorithm output and the detected fraud behaviors. Meanwhile, FraudVis also helps algorithm experts to fine-tune the algorithm design through the visual comparison. By using the visualization system, we solve two real-world cases of fraud detection, one for a social video website and another for an e-commerce website. The results on both cases demonstrate the effectiveness of FraudVis in understanding unsupervised fraud detection algorithms.
---
paper_title: Challenges for Visual Analytics

paper_content:

Visual analytics has seen unprecedented growth in its first 5 years of mainstream existence. Great progress has been made in a short time, yet significant challenges must be met in the next decade to provide new technologies that will be widely accepted throughout the world. This article explains some of those challenges in an effort to provide a stimulus for research, both basic and applied, that can realize or even exceed the potential envisioned for visual analytics technologies. We start with a brief summary of the initial challenges, followed by a discussion of the initial driving domains and applications. These are followed by a selection of additional applications and domains that have been a part of recent rapid expansion of visual analytics usage. We then look at the common characteristics of several tools illustrating emerging visual analytics technologies and conclude with the top 10 challenges for the field of study. We encourage feedback and continued participation by members of the research community, the wide array of user communities and private industry.
---
paper_title: Dynamic Network Visualization withExtended Massive Sequence Views

paper_content:

Networks are present in many fields such as finance, sociology, and transportation. Often these networks are dynamic: they have a structural as well as a temporal aspect. In addition to relations occurring over time, node information is frequently present such as hierarchical structure or time-series data. We present a technique that extends the Massive Sequence View ( msv) for the analysis of temporal and structural aspects of dynamic networks. Using features in the data as well as Gestalt principles in the visualization such as closure, proximity, and similarity, we developed node reordering strategies for the msv to make these features stand out that optionally take the hierarchical node structure into account. This enables users to find temporal properties such as trends, counter trends, periodicity, temporal shifts, and anomalies in the network as well as structural properties such as communities and stars. We introduce the circular msv that further reduces visual clutter. In addition, the (circular) msv is extended to also convey time-series data associated with the nodes. This enables users to analyze complex correlations between edge occurrence and node attribute changes. We show the effectiveness of the reordering methods on both synthetic and a rich real-world dynamic network data set.
---
paper_title: NVisionIP: netflow visualizations of system state for security situational awareness

paper_content:

The number of attacks against large computer systems is currently growing at a rapid pace. Despite the best efforts of security analysts, large organizations are having trouble keeping on top of the current state of their networks. In this paper, we describe a tool called NVisionIP that is designed to increase the security analyst's situational awareness. As humans are inherently visual beings, NVisionIP uses a graphical representation of a class-B network to allow analysts to quickly visualize the current state of their network. We present an overview of NVisionIP along with a discussion of various types of security-related scenarios that it can be used to detect.
---
paper_title: Network intrusion detection

paper_content:

Intrusion detection is a new, retrofit approach for providing a sense of security in existing computers and data networks, while allowing them to operate in their current "open" mode. The goal of intrusion detection is to identify unauthorized use, misuse, and abuse of computer systems by both system insiders and external penetrators. The intrusion detection problem is becoming a challenging task due to the proliferation of heterogeneous computer networks since the increased connectivity of computer systems gives greater access to outsiders and makes it easier for intruders to avoid identification. Intrusion detection systems (IDSs) are based on the beliefs that an intruder's behavior will be noticeably different from that of a legitimate user and that many unauthorized actions are detectable. Typically, IDSs employ statistical anomaly and rulebased misuse models in order to detect intrusions. A number of prototype IDSs have been developed at several institutions, and some of them have also been deployed on an experimental basis in operational systems. In the present paper, several host-based and network-based IDSs are surveyed, and the characteristics of the corresponding systems are identified. The host-based systems employ the host operating system's audit trails as the main source of input to detect intrusive activity, while most of the network-based IDSs build their detection mechanism on monitored network traffic, and some employ host audit trails as well. An outline of a statistical anomaly detection algorithm employed in a typical IDS is also included. >
---
paper_title: Preventing Private Information Inference Attacks on Social Networks

paper_content:

Online social networks, such as Facebook, are increasingly utilized by many people. These networks allow users to publish details about themselves and to connect to their friends. Some of the information revealed inside these networks is meant to be private. Yet it is possible to use learning algorithms on released data to predict private information. In this paper, we explore how to launch inference attacks using released social networking data to predict private information. We then devise three possible sanitization techniques that could be used in various situations. Then, we explore the effectiveness of these techniques and attempt to use methods of collective inference to discover sensitive attributes of the data set. We show that we can decrease the effectiveness of both local and relational classification algorithms by using the sanitization methods we described.
---
paper_title: EVA: Visual Analytics to Identify Fraudulent Events

paper_content:

Financial institutions are interested in ensuring security and quality for their customers. Banks, for instance, need to identify and stop harmful transactions in a timely manner. In order to detect fraudulent operations, data mining techniques and customer profile analysis are commonly used. However, these approaches are not supported by Visual Analytics techniques yet. Visual Analytics techniques have potential to considerably enhance the knowledge discovery process and increase the detection and prediction accuracy of financial fraud detection systems. Thus, we propose EVA, a Visual Analytics approach for supporting fraud investigation, fine-tuning fraud detection algorithms, and thus, reducing false positive alarms.
---
paper_title: Suspicious Behavior Detection: Current Trends and Future Directions

paper_content:

Different real-world applications have varying definitions of suspicious behaviors. Detection methods often look for the most suspicious parts of the data by optimizing scores, but quantifying the suspiciousness of a behavioral pattern is still an open issue.
---
paper_title: Visual analytics methods for categoric spatio-temporal data

paper_content:

We focus on visual analysis of space- and time-referenced categorical data, which describe possible states of spatial (geographical) objects or locations and their changes over time. The analysis of these data is difficult as there are only limited possibilities to analyze the three aspects (location, time and category) simultaneously. We present a new approach which interactively combines (a) visualization of categorical changes over time; (b) various spatial data displays; (c) computational techniques for task-oriented selection of time steps. They provide an expressive visualization with regard to either the overall evolution over time or unusual changes. We apply our approach on two use cases demonstrating its usefulness for a wide variety of tasks. We analyze data from movement tracking and meteorologic areas. Using our approach, expected events could be detected and new insights were gained.
---
paper_title: Discovery of rating fraud with real-time streaming visual analytics

paper_content:

The rating fraud in online e-commerce stores targets at receiving large revenues through boosting the popularity of selected items with fake ratings. The challenges of detecting rating frauds come from discovering small scale abnormal activities in a large amount of data and detecting frauds in a time-critical manner from online rating streams. This paper presents a real-time visual analytics system that consists of two essential components: a server for automatically handling data streams and a visual analytics interface for performing interactive analysis. Based on the features of rating frauds, we present a detection solution which balances computationally expensive algorithms and interactive analysis between the server and analysts. Specifically, our detection system filters data through performing an initial suspicion level detection on the server, and analysts can combine different statistical analysis of the user / item matrix through a co-mapped singular value decomposition (SVD) diagram, re-ordered matrix representation, and the temporal view. We demonstrate our approach with case studies of different fraud scenarios and show that rating frauds can be effectively detected.
---
paper_title: CopyCatch: stopping group attacks by spotting lockstep behavior in social networks

paper_content:

How can web services that depend on user generated content discern fraudulent input by spammers from legitimate input? In this paper we focus on the social network Facebook and the problem of discerning ill-gotten Page Likes, made by spammers hoping to turn a profit, from legitimate Page Likes. Our method, which we refer to as CopyCatch, detects lockstep Page Like patterns on Facebook by analyzing only the social graph between users and Pages and the times at which the edges in the graph (the Likes) were created. We offer the following contributions: (1) We give a novel problem formulation, with a simple concrete definition of suspicious behavior in terms of graph structure and edge constraints. (2) We offer two algorithms to find such suspicious lockstep behavior - one provably-convergent iterative algorithm and one approximate, scalable MapReduce implementation. (3) We show that our method severely limits "greedy attacks" and analyze the bounds from the application of the Zarankiewicz problem to our setting. Finally, we demonstrate and discuss the effectiveness of CopyCatch at Facebook and on synthetic data, as well as potential extensions to anomaly detection problems in other domains. CopyCatch is actively in use at Facebook, searching for attacks on Facebook's social graph of over a billion users, many millions of Pages, and billions of Page Likes.
---
paper_title: Deep Learning for Anomaly Detection: A Survey

paper_content:

Anomaly detection is an important problem that has been well-studied within diverse research areas and application domains. The aim of this survey is two-fold, firstly we present a structured and comprehensive overview of research methods in deep learning-based anomaly detection. Furthermore, we review the adoption of these methods for anomaly across various application domains and assess their effectiveness. We have grouped state-of-the-art research techniques into different categories based on the underlying assumptions and approach adopted. Within each category we outline the basic anomaly detection technique, along with its variants and present key assumptions, to differentiate between normal and anomalous behavior. For each category, we present we also present the advantages and limitations and discuss the computational complexity of the techniques in real application domains. Finally, we outline open issues in research and challenges faced while adopting these techniques.
---
paper_title: FraudVis: Understanding Unsupervised Fraud Detection Algorithms

paper_content:

Discovering fraud user behaviors is vital to keeping online websites healthy. Fraudsters usually exhibit grouping behaviors, and researchers have effectively leveraged this behavior to design unsupervised algorithms to detect fraud user groups. In this work, we propose a visualization system, FraudVis, to visually analyze the unsupervised fraud detection algorithms from temporal, intra-group correlation, inter-group correlation, feature selection, and the individual user perspectives. FraudVis helps domain experts better understand the algorithm output and the detected fraud behaviors. Meanwhile, FraudVis also helps algorithm experts to fine-tune the algorithm design through the visual comparison. By using the visualization system, we solve two real-world cases of fraud detection, one for a social video website and another for an e-commerce website. The results on both cases demonstrate the effectiveness of FraudVis in understanding unsupervised fraud detection algorithms.
---
paper_title: An overview of anomaly detection techniques: Existing solutions and latest technological trends

paper_content:

As advances in networking technology help to connect the distant corners of the globe and as the Internet continues to expand its influence as a medium for communications and commerce, the threat from spammers, attackers and criminal enterprises has also grown accordingly. It is the prevalence of such threats that has made intrusion detection systems-the cyberspace's equivalent to the burglar alarm-join ranks with firewalls as one of the fundamental technologies for network security. However, today's commercially available intrusion detection systems are predominantly signature-based intrusion detection systems that are designed to detect known attacks by utilizing the signatures of those attacks. Such systems require frequent rule-base updates and signature updates, and are not capable of detecting unknown attacks. In contrast, anomaly detection systems, a subset of intrusion detection systems, model the normal system/network behavior which enables them to be extremely effective in finding and foiling both known as well as unknown or ''zero day'' attacks. While anomaly detection systems are attractive conceptually, a host of technological problems need to be overcome before they can be widely adopted. These problems include: high false alarm rate, failure to scale to gigabit speeds, etc. In this paper, we provide a comprehensive survey of anomaly detection systems and hybrid intrusion detection systems of the recent past and present. We also discuss recent technological trends in anomaly detection and identify open problems and challenges in this area.
---
paper_title: LSTM-based Encoder-Decoder for Multi-sensor Anomaly Detection

paper_content:

Mechanical devices such as engines, vehicles, aircrafts, etc., are typically instrumented with numerous sensors to capture the behavior and health of the machine. However, there are often external factors or variables which are not captured by sensors leading to time-series which are inherently unpredictable. For instance, manual controls and/or unmonitored environmental conditions or load may lead to inherently unpredictable time-series. Detecting anomalies in such scenarios becomes challenging using standard approaches based on mathematical models that rely on stationarity, or prediction models that utilize prediction errors to detect anomalies. We propose a Long Short Term Memory Networks based Encoder-Decoder scheme for Anomaly Detection (EncDec-AD) that learns to reconstruct 'normal' time-series behavior, and thereafter uses reconstruction error to detect anomalies. We experiment with three publicly available quasi predictable time-series datasets: power demand, space shuttle, and ECG, and two real-world engine datasets with both predictive and unpredictable behavior. We show that EncDec-AD is robust and can detect anomalies from predictable, unpredictable, periodic, aperiodic, and quasi-periodic time-series. Further, we show that EncDec-AD is able to detect anomalies from short time-series (length as small as 30) as well as long time-series (length as large as 500).
---
paper_title: A Deep Neural Network for Unsupervised Anomaly Detection and Diagnosis in Multivariate Time Series Data

paper_content:

Nowadays, multivariate time series data are increasingly collected in various real world systems, e.g., power plants, wearable devices, etc. Anomaly detection and diagnosis in multivariate time series refer to identifying abnormal status in certain time steps and pinpointing the root causes. Building such a system, however, is challenging since it not only requires to capture the temporal dependency in each time series, but also need encode the inter-correlations between different pairs of time series. In addition, the system should be robust to noise and provide operators with different levels of anomaly scores based upon the severity of different incidents. Despite the fact that a number of unsupervised anomaly detection algorithms have been developed, few of them can jointly address these challenges. In this paper, we propose a Multi-Scale Convolutional Recurrent Encoder-Decoder (MSCRED), to perform anomaly detection and diagnosis in multivariate time series data. Specifically, MSCRED first constructs multi-scale (resolution) signature matrices to characterize multiple levels of the system statuses in different time steps. Subsequently, given the signature matrices, a convolutional encoder is employed to encode the inter-sensor (time series) correlations and an attention based Convolutional Long-Short Term Memory (ConvLSTM) network is developed to capture the temporal patterns. Finally, based upon the feature maps which encode the inter-sensor correlations and temporal information, a convolutional decoder is used to reconstruct the input signature matrices and the residual signature matrices are further utilized to detect and diagnose anomalies. Extensive empirical studies based on a synthetic dataset and a real power plant dataset demonstrate that MSCRED can outperform state-ofthe-art baseline methods.
---
paper_title: Towards Better Analysis of Machine Learning Models: A Visual Analytics Perspective

paper_content:

Interactive model analysis, the process of understanding, diagnosing, and refining a machine learning model with the help of interactive visualization, is very important for users to efficiently solve real-world artificial intelligence and data mining problems. Dramatic advances in big data analytics has led to a wide variety of interactive model analysis tasks. In this paper, we present a comprehensive analysis and interpretation of this rapidly developing area. Specifically, we classify the relevant work into three categories: understanding, diagnosis, and refinement. Each category is exemplified by recent influential work. Possible future research opportunities are also explored and discussed.
---
paper_title: TargetVue: Visual Analysis of Anomalous User Behaviors in Online Communication Systems

paper_content:

Users with anomalous behaviors in online communication systems (e.g. email and social medial platforms) are potential threats to society. Automated anomaly detection based on advanced machine learning techniques has been developed to combat this issue; challenges remain, though, due to the difficulty of obtaining proper ground truth for model training and evaluation. Therefore, substantial human judgment on the automated analysis results is often required to better adjust the performance of anomaly detection. Unfortunately, techniques that allow users to understand the analysis results more efficiently, to make a confident judgment about anomalies, and to explore data in their context, are still lacking. In this paper, we propose a novel visual analysis system, TargetVue, which detects anomalous users via an unsupervised learning model and visualizes the behaviors of suspicious users in behavior-rich context through novel visualization designs and multiple coordinated contextual views. Particularly, TargetVue incorporates three new ego-centric glyphs to visually summarize a user's behaviors which effectively present the user's communication activities, features, and social interactions. An efficient layout method is proposed to place these glyphs on a triangle grid, which captures similarities among users and facilitates comparisons of behaviors of different users. We demonstrate the power of TargetVue through its application in a social bot detection challenge using Twitter data, a case study based on email records, and an interview with expert users. Our evaluation shows that TargetVue is beneficial to the detection of users with anomalous communication behaviors.
---
paper_title: Episogram: Visual Summarization of Egocentric Social Interactions

paper_content:

The key challenges of visualizing social interaction data include the difficulties of understanding the general structure of social interactions and representing the data in the context of various user activities to reveal different behavior patterns. The design of the proposed interactive visualization tool Episogram is based on an anatomy of social interaction process in which the actors and objects involved can be formally represented as a time-varying tripartite network. The authors show the effectiveness of the proposed technique using real-world datasets and user studies.
---
paper_title: Visitpedia: Wiki Article Visit Log Visualization for Event Exploration

paper_content:

This paper proposes an interactive visualization tool, Visitpedia, to detect and analyze social events based on Wikipedia visit history. It helps users discover real-world events behind the data and study how these events evolve over time. Different from previous work based on on-line news or similar text corpora, we choose Wikipedia visit counts as our data source since the visit count data better reflect user concerns of social events. We tackle the event-based task from a time-series pattern perspective rather than semantic perspective. Various visualization and user interaction techniques are integrated in Visitpedia. Two case studies are conducted to demonstrate the effectiveness of Visitpedia.
---
paper_title: #FluxFlow: Visual Analysis of Anomalous Information Spreading on Social Media

paper_content:

We present FluxFlow, an interactive visual analysis system for revealing and analyzing anomalous information spreading in social media. Everyday, millions of messages are created, commented, and shared by people on social media websites, such as Twitter and Facebook. This provides valuable data for researchers and practitioners in many application domains, such as marketing, to inform decision-making. Distilling valuable social signals from the huge crowd's messages, however, is challenging, due to the heterogeneous and dynamic crowd behaviors. The challenge is rooted in data analysts' capability of discerning the anomalous information behaviors, such as the spreading of rumors or misinformation, from the rest that are more conventional patterns, such as popular topics and newsworthy events, in a timely fashion. FluxFlow incorporates advanced machine learning algorithms to detect anomalies, and offers a set of novel visualization designs for presenting the detected threads for deeper analysis. We evaluated FluxFlow with real datasets containing the Twitter feeds captured during significant events such as Hurricane Sandy. Through quantitative measurements of the algorithmic performance and qualitative interviews with domain experts, the results show that the back-end anomaly detection model is effective in identifying anomalous retweeting threads, and its front-end interactive visualizations are intuitive and useful for analysts to discover insights in data and comprehend the underlying analytical model.
---
paper_title: WireVis: Visualization of Categorical, Time-Varying Data From Financial Transactions

paper_content:

Large financial institutions such as Bank of America handle hundreds of thousands of wire transactions per day. Although most transactions are legitimate, these institutions have legal and financial obligations in discovering those that are suspicious. With the methods of fraudulent activities ever changing, searching on predefined patterns is often insufficient in detecting previously undiscovered methods. In this paper, we present a set of coordinated visualizations based on identifying specific keywords within the wire transactions. The different views used in our system depict relationships among keywords and accounts over time. Furthermore, we introduce a search-by-example technique which extracts accounts that show similar transaction patterns. In collaboration with the Anti-Money Laundering division at Bank of America, we demonstrate that using our tool, investigators are able to detect accounts and transactions that exhibit suspicious behaviors.
---
paper_title: Visual Exploration of Big Spatio-Temporal Urban Data: A Study of New York City Taxi Trips

paper_content:

As increasing volumes of urban data are captured and become available, new opportunities arise for data-driven analysis that can lead to improvements in the lives of citizens through evidence-based decision making and policies. In this paper, we focus on a particularly important urban data set: taxi trips. Taxis are valuable sensors and information associated with taxi trips can provide unprecedented insight into many different aspects of city life, from economic activity and human behavior to mobility patterns. But analyzing these data presents many challenges. The data are complex, containing geographical and temporal components in addition to multiple variables associated with each trip. Consequently, it is hard to specify exploratory queries and to perform comparative analyses (e.g., compare different regions over time). This problem is compounded due to the size of the data-there are on average 500,000 taxi trips each day in NYC. We propose a new model that allows users to visually query taxi trips. Besides standard analytics queries, the model supports origin-destination queries that enable the study of mobility across the city. We show that this model is able to express a wide range of spatio-temporal queries, and it is also flexible in that not only can queries be composed but also different aggregations and visual representations can be applied, allowing users to explore and compare results. We have built a scalable system that implements this model which supports interactive response times; makes use of an adaptive level-of-detail rendering strategy to generate clutter-free visualization for large results; and shows hidden details to the users in a summary through the use of overlay heat maps. We present a series of case studies motivated by traffic engineers and economists that show how our model and system enable domain experts to perform tasks that were previously unattainable for them.
---
paper_title: Voila: Visual Anomaly Detection and Monitoring with Streaming Spatiotemporal Data

paper_content:

The increasing availability of spatiotemporal data continuously collected from various sources provides new opportunities for a timely understanding of the data in their spatial and temporal context. Finding abnormal patterns in such data poses significant challenges. Given that there is often no clear boundary between normal and abnormal patterns, existing solutions are limited in their capacity of identifying anomalies in large, dynamic and heterogeneous data, interpreting anomalies in their multifaceted, spatiotemporal context, and allowing users to provide feedback in the analysis loop. In this work, we introduce a unified visual interactive system and framework, Voila, for interactively detecting anomalies in spatiotemporal data collected from a streaming data source. The system is designed to meet two requirements in real-world applications, i.e., online monitoring and interactivity. We propose a novel tensor-based anomaly analysis algorithm with visualization and interaction design that dynamically produces contextualized, interpretable data summaries and allows for interactively ranking anomalous patterns based on user input. Using the “smart city” as an example scenario, we demonstrate the effectiveness of the proposed framework through quantitative evaluation and qualitative case studies.
---
paper_title: Toward a Deeper Understanding of the Role of Interaction in Information Visualization

paper_content:

Even though interaction is an important part of information visualization (Infovis), it has garnered a relatively low level of attention from the Infovis community. A few frameworks and taxonomies of Infovis interaction techniques exist, but they typically focus on low-level operations and do not address the variety of benefits interaction provides. After conducting an extensive review of Infovis systems and their interactive capabilities, we propose seven general categories of interaction techniques widely used in Infovis: 1) Select, 2) Explore, 3) Reconfigure, 4) Encode, 5) Abstract/Elaborate, 6) Filter, and 7) Connect. These categories are organized around a user's intent while interacting with a system rather than the low-level interaction techniques provided by a system. The categories can act as a framework to help discuss and evaluate interaction techniques and hopefully lay an initial foundation toward a deeper understanding and a science of interaction.
---
paper_title: Discovery of rating fraud with real-time streaming visual analytics

paper_content:

The rating fraud in online e-commerce stores targets at receiving large revenues through boosting the popularity of selected items with fake ratings. The challenges of detecting rating frauds come from discovering small scale abnormal activities in a large amount of data and detecting frauds in a time-critical manner from online rating streams. This paper presents a real-time visual analytics system that consists of two essential components: a server for automatically handling data streams and a visual analytics interface for performing interactive analysis. Based on the features of rating frauds, we present a detection solution which balances computationally expensive algorithms and interactive analysis between the server and analysts. Specifically, our detection system filters data through performing an initial suspicion level detection on the server, and analysts can combine different statistical analysis of the user / item matrix through a co-mapped singular value decomposition (SVD) diagram, re-ordered matrix representation, and the temporal view. We demonstrate our approach with case studies of different fraud scenarios and show that rating frauds can be effectively detected.
---
paper_title: Balancing Systematic and Flexible Exploration of Social Networks

paper_content:

Social network analysis (SNA) has emerged as a powerful method for understanding the importance of relationships in networks. However, interactive exploration of networks is currently challenging because: (1) it is difficult to find patterns and comprehend the structure of networks with many nodes and links, and (2) current systems are often a medley of statistical methods and overwhelming visual output which leaves many analysts uncertain about how to explore in an orderly manner. This results in exploration that is largely opportunistic. Our contributions are techniques to help structural analysts understand social networks more effectively. We present SocialAction, a system that uses attribute ranking and coordinated views to help users systematically examine numerous SNA measures. Users can (1) flexibly iterate through visualizations of measures to gain an overview, filter nodes, and find outliers, (2) aggregate networks using link structure, find cohesive subgroups, and focus on communities of interest, and (3) untangle networks by viewing different link types separately, or find patterns across different link types using a matrix overview. For each operation, a stable node layout is maintained in the network visualization so users can make comparisons. SocialAction offers analysts a strategy beyond opportunism, as it provides systematic, yet flexible, techniques for exploring social networks
---
paper_title: TargetVue: Visual Analysis of Anomalous User Behaviors in Online Communication Systems

paper_content:

Users with anomalous behaviors in online communication systems (e.g. email and social medial platforms) are potential threats to society. Automated anomaly detection based on advanced machine learning techniques has been developed to combat this issue; challenges remain, though, due to the difficulty of obtaining proper ground truth for model training and evaluation. Therefore, substantial human judgment on the automated analysis results is often required to better adjust the performance of anomaly detection. Unfortunately, techniques that allow users to understand the analysis results more efficiently, to make a confident judgment about anomalies, and to explore data in their context, are still lacking. In this paper, we propose a novel visual analysis system, TargetVue, which detects anomalous users via an unsupervised learning model and visualizes the behaviors of suspicious users in behavior-rich context through novel visualization designs and multiple coordinated contextual views. Particularly, TargetVue incorporates three new ego-centric glyphs to visually summarize a user's behaviors which effectively present the user's communication activities, features, and social interactions. An efficient layout method is proposed to place these glyphs on a triangle grid, which captures similarities among users and facilitates comparisons of behaviors of different users. We demonstrate the power of TargetVue through its application in a social bot detection challenge using Twitter data, a case study based on email records, and an interview with expert users. Our evaluation shows that TargetVue is beneficial to the detection of users with anomalous communication behaviors.
---
paper_title: Visual Discovery in Computer Network Defense

paper_content:

Computer network defense (CND) requires analysts to detect both known and novel forms of attacks in massive volumes of network data. It's through discovering the unexpected that CND analysts detect new versions of mal ware (such as viruses and Trojan horses) that have passed through their antivirus products, new methods of intrusion that have breached their firewalls and intrusion detection systems (IDSs), and new groups of cyber-criminals pressing the attack. This paper presents visual assistant for information assurance analysis. VIAssist is a visualization framework based on a comprehensive cognitive task analysis of CND analysts, and so fits their work practices and operational environment.
---
paper_title: EmailTime: Visual analytics of emails

paper_content:

Although the discovery and analysis of communication patterns in large and complex email datasets are difficult tasks, they can be a valuable source of information. This paper presents EmailTime's capabilities through several examples. EmailTime is a visual analysis of email correspondence patterns over the course of time that interactively portrays personal and interpersonal networks using the correspondence in the email dataset. We suggest that integrating both statistics and visualizations in order to display information about the email datasets may simplify its evaluation.
---
paper_title: ScatterBlogs2: Real-Time Monitoring of Microblog Messages through User-Guided Filtering

paper_content:

The number of microblog posts published daily has reached a level that hampers the effective retrieval of relevant messages, and the amount of information conveyed through services such as Twitter is still increasing. Analysts require new methods for monitoring their topic of interest, dealing with the data volume and its dynamic nature. It is of particular importance to provide situational awareness for decision making in time-critical tasks. Current tools for monitoring microblogs typically filter messages based on user-defined keyword queries and metadata restrictions. Used on their own, such methods can have drawbacks with respect to filter accuracy and adaptability to changes in trends and topic structure. We suggest ScatterBlogs2, a new approach to let analysts build task-tailored message filters in an interactive and visual manner based on recorded messages of well-understood previous events. These message filters include supervised classification and query creation backed by the statistical distribution of terms and their co-occurrences. The created filter methods can be orchestrated and adapted afterwards for interactive, visual real-time monitoring and analysis of microblog feeds. We demonstrate the feasibility of our approach for analyzing the Twitter stream in emergency management scenarios.
---
paper_title: A visual analytics framework for spatio-temporal analysis and modelling

paper_content:

To support analysis and modelling of large amounts of spatio-temporal data having the form of spatially referenced time series (TS) of numeric values, we combine interactive visual techniques with computational methods from machine learning and statistics. Clustering methods and interactive techniques are used to group TS by similarity. Statistical methods for TS modelling are then applied to representative TS derived from the groups of similar TS. The framework includes interactive visual interfaces to a library of modelling methods supporting the selection of a suitable method, adjustment of model parameters, and evaluation of the models obtained. The models can be externally stored, communicated, and used for prediction and in further computational analyses. From the visual analytics perspective, the framework suggests a way to externalize spatio-temporal patterns emerging in the mind of the analyst as a result of interactive visual analysis: the patterns are represented in the form of computer-processable and reusable models. From the statistical analysis perspective, the framework demonstrates how TS analysis and modelling can be supported by interactive visual interfaces, particularly, in a case of numerous TS that are hard to analyse individually. From the application perspective, the framework suggests a way to analyse large numbers of spatial TS with the use of well-established statistical methods for TS analysis.
---
paper_title: MVSec: multi-perspective and deductive visual analytics on heterogeneous network security data

paper_content:

In this article, we present a visual analytics system, MVSec, which helps analysts understand better what information flows under network security datasets. The major contributions of this work include: (1) a data fusion strategy for multiple heterogeneous datasets by using unified event tuple and statistic tuple data structure, which compress large scale datasets and lays the foundation of cooperative visual analysis; (2) multiple coordinated views, which provide analysts with multiple visual perspectives to characterize loud events, dig out subtle events and investigate relations of events in datasets; and (3) a contextual visual analysis with deductive viewpoints, which inspires analysts to explore hypotheses and reason their deductions from visual narratives. In case studies, we demonstrate in detail how the system helps analysts draw an analytical storyline and understand network situations better in VAST Challenge 2013. Additionally, we discuss lessons learned in designing our system and participating in VAST Challenge 2013, which is helpful and applicable not only to similar network security systems but also to other domains facing visual analytics challenges.
---
paper_title: Visual analytics methods for categoric spatio-temporal data

paper_content:

We focus on visual analysis of space- and time-referenced categorical data, which describe possible states of spatial (geographical) objects or locations and their changes over time. The analysis of these data is difficult as there are only limited possibilities to analyze the three aspects (location, time and category) simultaneously. We present a new approach which interactively combines (a) visualization of categorical changes over time; (b) various spatial data displays; (c) computational techniques for task-oriented selection of time steps. They provide an expressive visualization with regard to either the overall evolution over time or unusual changes. We apply our approach on two use cases demonstrating its usefulness for a wide variety of tasks. We analyze data from movement tracking and meteorologic areas. Using our approach, expected events could be detected and new insights were gained.
---
paper_title: A fraud detection visualization system utilizing radial drawings and heat-maps

paper_content:

We present a prototype system developed in cooperation with a business organization that combines information visualization and pattern-matching techniques to detect fraudulent activity by employees. The system is built upon common fraud patterns searched while trying to detect occupational fraud suggested by internal auditors of a business company. The main visualization of the system consists of a multi-layer radial drawing that represents the activity of the employees and clients. Each layer represents a different examined pattern whereas heat-maps indicating suspicious activity are incorporated in the visualization. The data are first preprocessed based on a decision tree generated by the examined patterns and each employee is assigned a value indicating whether or not there exist indications of fraud. The visualization is presented as an animation and the employees are visualized one by one according to their severity values together with their related clients.
---

Title: Visual Analytics of Anomalous User Behaviors: A Survey

Section 1: INTRODUCTION
Description 1: Write an introduction discussing the significance of understanding user behaviors, the challenge of detecting anomalies, and the role of visualization in integrating human knowledge into the process. 

Section 2: RELATED SURVEYS
Description 2: Discuss related surveys in the field, highlighting their contributions and identifying the uniqueness and broader scope of the current survey.

Section 3: TERMINOLOGY, METHODOLOGY, AND TAXONOMY
Description 3: Explain the terminology, describe the methodology for selecting relevant papers, and introduce the taxonomy developed for categorizing data types, anomaly detection techniques, visualization, and interaction methods.

Section 4: SOCIAL INTERACTION
Description 4: Analyze social interaction behaviors, categorize data types used, discuss the anomaly detection techniques applied, illustrate the visualization techniques employed, and summarize the interaction methods involved.

Section 5: TRAVEL
Description 5: Examine travel behaviors, describe the types of data involved, outline the anomaly detection techniques used, detail the visualization approaches implemented, and review the interaction methods applied.

Section 6: NETWORK COMMUNICATION
Description 6: Investigate network communication behaviors, explain the data types analyzed, describe the anomaly detection techniques used, outline the visualization techniques applied, and summarize the interaction methods involved.

Section 7: TRANSACTION
Description 7: Discuss transaction behaviors, identify the data types examined, outline the anomaly detection techniques applied, illustrate the visualization techniques used, and describe the interaction methods involved.

Section 8: DISCUSSION AND OUTLOOK
Description 8: Summarize research trends, discuss findings regarding data types, anomaly detection techniques, visualization techniques, and interaction methods, and highlight potential future research directions.

Section 9: CONCLUSION
Description 9: Provide a concluding summary of the survey, emphasizing key insights and contributions, and the importance of visual analytics in understanding anomalous user behaviors.