Decision trees are commonly used for classification. We propose to use decision trees not just for classification but also for the wider purpose of knowledge discovery, because visualizing the decision tree can reveal much valuable information in the data. We introduce PaintingClass, a system for interactive construction, visualization and exploration of decision trees. PaintingClass provides an intuitive layout and convenient navigation of the decision tree. PaintingClass also provides the user the means to interactively construct the decision tree. Each node in the decision tree is displayed as a visual projection of the data. Through actual examples and comparison with other classification methods, we show that the user can effectively use PaintingClass to construct a decision tree and explore the decision tree to gain additional knowledge.

We present RINGS, a technique for visualizing large trees. We introduce a new ringed circular layout of nodes to make more efficient use of limited display space. RINGS provides the user with the means to specify areas of primary and secondary focus, and is able to show multiple foci without compromising understanding of the graph. The strength of RINGS is its ability to show more area in focus and more contextual information than existing techniques. We demonstrate the effectiveness of RINGS by applying it to the visualization of a Unix file directory.

The Internet pervades many aspects of our lives and is becoming indispensable to critical functions in areas such as commerce, government, production and general information dissemination. To maintain the stability and efficiency of the Internet, every effort must be made to protect it against various forms of attacks, malicious uses, and errors. A key component in the Internet security effort is the routine examination of Internet routing data, which unfortunately can be too large and complicated to browse directly. We have developed an interactive visualization process which proves to be very effective for the analysis of Internet routing data. In this application paper, we show how each step in the visualization process helps direct the analysis and glean insights from the data. These insights include the discovery of patterns, detection of faults and abnormal events, understanding of event correlations, formation of causation hypotheses, and classification of anomalies. We also discuss lessons learned in our visual analysis study.

To ensure the normal operation of a large computer network system, the common practice is to constantly collect system logs and analyze the network activities for detecting anomalies. Most of the analysis methods in use today are highly automated due to the enormous size of the collected data. Conventional automated methods are largely based on statistical modeling, and some employ machine learning. In this paper, we show interactive visualization as an alternative and effective data exploration method for understanding the complex behaviors of computer network systems. We describe three log-file analysis applications, and demonstrate how the use of our visualization-centered tools can lead to the discovery of flaws and intruders in the network systems.

Internet connectivity is defined by a set of routing protocols which let the routers that comprise the Internet backbone choose the best route for a packet to reach its destination. One way to improve the security and performance of Internet is to routinely examine the routing data. In this case study, we show how interactive visualization of Border Gateway Protocol (BGP) data helps characterize routing behavior, identify weaknesses in connectivity which could potentially cripple the Internet, as well as detect and explain actual anomalous events.

Instead of relying completely on machine intelligence in anomaly event analysis and correlation, in this paper, we take one step back and investigate the possibility of a human-interactive visual-based anomaly detection system for faults and security attacks related to the BGP (Border Gateway Protocol) routing protocol. In particular, we have built and tested a program, based on fairly simple information visualization techniques, to navigate interactively real-life BGP OASC (Origin AS Change) events. Our initial experience demonstrates that the integration of mechanic analysis and human intelligence can effectively improve the performance of anomaly detection and alert correlation. Furthermore, while a traditional representation of OASC events provides either little or no valuable information, our program can accurately identify, correlate previously unknown BGP/OASC problems, and provide network operators with a valuable high-level abstraction about the dynamics of BGP.