VIGOR: Interactive Visual Exploration of Graph Query Results

Abstract

Finding patterns in graphs has become a vital challenge in many domains from biological systems, network security, to finance (e.g., finding money laundering rings of bankers and business owners). While there is significant interest in graph databases and querying techniques, less research has focused on helping analysts make sense of underlying patterns within a group of subgraph results. Visualizing graph query results is challenging, requiring effective summarization of a large number of subgraphs, each having potentially shared node-values, rich node features, and flexible structure across queries. We present VIGOR, a novel interactive visual analytics system, for exploring and making sense of query results. VIGOR uses multiple coordinated views, leveraging different data representations and organizations to streamline analysts sensemaking process. VIGOR contributes: (1) an exemplar-based interaction technique, where an analyst starts with a specific result and relaxes constraints to find other similar results or starts with only the structure (i.e., without node value constraints), and adds constraints to narrow in on specific results; and (2) a novel feature-aware subgraph result summarization. Through a collaboration with Symantec, we demonstrate how VIGOR helps tackle real-world problems through the discovery of security blindspots in a cybersecurity dataset with over 11,000 incidents. We also evaluate VIGOR with a within-subjects study, demonstrating VIGOR's ease of use over a leading graph database management system, and its ability to help analysts understand their results at higher speed and make fewer errors.

The State of the Art in Visualizing Multivariate Networks

“…Figure (a) shows a juxtaposition of a geospatial node‐link view to encode the topology of the network, with a parallel coordinates plot to encode attributes [Guo09]. VIGOR [PHE*18], shown in Figurel4(b), uses juxtaposition to show two topology‐related views and two attribute views.…”

“…© 2009 IEEE, reprinted with permission. (b) VIGOR [PHE*18] displays two views for the topology of the network along with a juxtaposed attribute view that shows attribute‐specific distributions across the network. © 2018 IEEE, reprinted with permission.…”

“…Querying or filtering enables analysts to work with much larger networks than can be reasonably displayed otherwise. Filters and queries can be defined based on topological structures, attributes, or combinations of both [KZA10, PHE*18]. Querying first and expanding a network from a seed is a hallmark approach of many large graph MVN visualization approaches [LPB*06, vHP09, PGS*16, NSL19].…”

The Validity, Generalizability and Feasibility of Summative Evaluation Methods in Visual Analytics

“…Therefore, researchers include subjective assessment methods as ways of determining a solution's usefulness. Subjective assessment can be performed quantitatively [61,76] or qualitatively [27], and can be done with the help of human subjects [88] or through inspecting the design without relying on human subjects [42]. Qualitative methods have the flexibility to assess both objective and subjective aspects.…”

Exploring the limits of complexity: A survey of empirical studies on graph visualisation

“…There are only 28 studies that use graphs with 1,000 edges or more. Most of these allow the participants to look at parts of the network instead of performing the task on the whole network [12,37,52,56,82,85,88,94,95,99,101,102,117,120,124,129,132,136,146,152]. Similar to studies that use a large number of nodes to highlight the benefits of aggregation or interaction methods, some studies use a large number of edges to show the benefits of edge compression, bundling, or highlighting techniques.…”