Image Processing Reference
In-Depth Information
(a)
(b)
(c)
Fig. 7.3
Case study examining the analysis process of a dataset containing three Sybil attacks.
a
Scatterplot outliers and a corresponding tightly connected subgraph.
b
Initial time-histogram
view.
c
Final time-histogram view showing updated time and node uncertainties
view. However, this subgraph is not
fully
connected. Therefore, the uncertainty values
of these nodes can be increased according to how tightly connected the subgraph
appears.
In total, six separate time ranges are analyzed for attacks (see Fig.
7.3
c). Three
ranges demonstrated both the presence of outliers in the scatterplot view and tightly
connected subgraphs in the node-link view. One time range identified as containing
an attack was previously identified as benign. With uncertainty views and interac-
tions, time ranges can be marked during an investigation, which can guide future time
range selection. Perhaps more importantly, nodes that have higher uncertainty val-
ues appear as varying shades of red in subsequent node-link and scatterplot views,
which can guide selections during the iterative scatterplot/node-link investigation
process. Without uncertainty techniques, previous results regarding time range and
scatterplot/node-link analyses are not available for future investigation, unless they
are committed to some external source and revisited/recalled at the appropriate time.
7.5 Discussion and Conclusion
In security analysis, several “soft” or “weak” decisions can be treated as evidence and
combined to produce a better-informed final decision. In fact, analytic uncertainty
need not be limited to security applications. For example, financial and healthcare
analysis also often involve analytic uncertainty. Therefore, the capabilities of uncer-
tainty analysis, which allows analysts to quantify and re-use uncertain decisions,
should be provided by visual analysis tools rather than external sources.
Search WWH ::
Custom Search