Fig. 1. Overview of our visualization system: To support triage analysis in OT-networks, our visualization combines sensor readings with results from an anomaly detection algorithm. Spiral plots encode readings and detection results in color and line thickness respectively. An overview of the complete time frame is provided in a time slider and anomalies are highlighted.Abstract-Operation technology networks, i.e. hard-and software used for monitoring and controlling physical/industrial processes, have been considered immune to cyber attacks for a long time. A recent increase of attacks in these networks proves this assumption wrong. Several technical constraints lead to approaches to detect attacks on industrial processes using available sensor data. This setting differs fundamentally from anomaly detection in IT-network traffic and requires new visualization approaches adapted to the common periodical behavior in OT-network data. We present a tailored visualization system that utilizes inherent features of measurements from industrial processes to full capacity to provide insight into the data and support triage analysis by laymen and experts. The novel combination of spiral plots with results from anomaly detection was implemented in an interactive system. The capabilities of our system are demonstrated using sensor and actuator data from a real-world water treatment process with introduced attacks. Exemplary analysis strategies are presented. Finally, we evaluate effectiveness and usability of our system and perform an expert evaluation.

No abstract

No abstract

We present a holistic, topology-based visualization technique for spatial time series data based on an adaptation of Fuzzy Contour Trees. Common analysis approaches for time dependent scalar fields identify and track specific features. To give a more general overview of the data, we extend Fuzzy Contour Trees, from the visualization and simultaneous analysis of the topology of multiple scalar fields, to time dependent scalar fields. The resulting time-varying Fuzzy Contour Trees allow the comparison of multiple time steps that are not required to be consecutive. We provide specific interaction and navigation possibilities that allow the exploration of individual time steps and time windows in addition to the behavior of the contour trees over all time steps. To achieve this, we reduce an existing alignment to multiple sub-alignments and adapt the Fuzzy Contour Tree-layout to continuously reflect changes and similarities in the sub-alignments. We apply time-varying Fuzzy Contour Trees to different real-world data sets and demonstrate their usefulness.

No abstract