Image Processing Reference
In-Depth Information
Fig. 7.2
Uncertainty views (
red
and
green bars
) and annotations (
red
and
blue overlays
) on the time
histogram. The node uncertainty is to the
right
of the time histogram, and time range uncertainty is
on the
bottom
7.4 SybilVis Uncertainty
Because uncertainty is often involved in network security, tools should be designed
that allow analysts to express, track, and re-use decisions during analysis. In this
section, we describe how uncertainty regarding time-ranges and individual nodes is
interactively specified and integrated into a visualization system.
7.4.1 Uncertainty Integration
Below and to the right of the time histogram view are the time-uncertainty and
node-uncertainty views (see Fig.
7.2
). As analysis progresses, a user may increase
or decrease the suspiciousness-level of one or more nodes or timesteps. Changes to
the uncertainty values of nodes or timesteps is then reflected as the brightness of the
red/green colors in the corresponding areas in the uncertainty views. Specifically,
green areas correspond to no suspected attack, while a red area denotes a likely
attack period. Uncertainty colors are also then used to color nodes in the scatterplot
and node-link views. This helps the analyst to identify nodes previously identified
as suspicious when they appear in future views.
By having a persistent visual representation of node uncertainty, analysts can add
uncertainty fromseparate findings in both the eigenvector and degree-nonrandomness
scatterplot views. For example, a node may show up as an outlier when viewing the
eigenvectors as axes but as a non-outlier with the degree-nonrandomness as axes.
With the uncertainty functions, the analyst need only increase the uncertainty corre-
sponding to the outlier to have this result recorded to inform future analyses.
The uncertainty views and interactions serve as a low-frictionway to store analysis
results. Once relevant nodes or timesteps are selected, the analyst need only use the
mousewheel or
signs on the keyboard to change the uncertainty result for their
selection. Furthermore, at any point a comma-delimited report can be generated with
+
/
−
Search WWH ::
Custom Search