Visual analysis of large-scale network anomalies

Abstract

The amount of information flowing across communication networks has rapidly increased. The highly dynamic and complex networks, represented as large graphs, make the analysis of such networks increasingly challenging. In this paper, we provide a brief overview of several useful visualization techniques for the analysis of spatiotemporal anomalies in large-scale networks. We make use of community-based similarity graphs (CSGs), temporal expansion model graphs (TEMGs), correlation graphs (CGs), high-dimension projection graphs (HDPGs), and topology-preserving compressed graphs (TPCGs). CSG is used to detect anomalies based on community membership changes rather than individual nodes and edges and therefore may be more tolerant to the highly dynamic nature of large networks. TEMG transforms network topologies into directed trees so that efficient search is more likely to be performed for anomalous changes in network behavior and routing topology in large dynamic networks. CG and HDPG are used to examine the complex relationship of data dimensions among graph nodes through transformation in a high-dimensional space. TPCG groups nodes with similar neighbor sets into mega-nodes, thus making graph visualization and analysis more scalable to large networks. All the methods target efficient large-graph anomaly visualization from different perspectives and together provide valuable insights.

A survey of network anomaly visualization

“…Based on conventional node-link diagrams, Liao et al [32] improved the node design by presenting informative nodes that include various anomaly events. Cortese et al [41] enhanced the simple nodelink BGPlay system by employing a topographic map that clearly shows ASes traversing tiers.…”

“…However, visualizing intricate traffic in the network topology is challenging because of the tremendous amount of traffic generated by network devices at any time. Techniques such as edge bundling [40,97], graph compression [32], and clustering [98] are used to simplify the graph result to solve the complexity of the topology.…”

A Taxonomy and Survey of Dynamic Graph Visualization

“…Psychology and user interface research may profit from depicting eye gaze data as dynamic graphs recorded in eye‐tracking studies [BBR*14, HEF*13]. Computer scientists can investigate the evolution of the Internet [BBP08] or anomalies in communication networks [LSW13]. Business researchers and managers are supported in analysing contagion in financial networks [vLDBF13] and movements in stock portfolios [DE02].…”

Owleyes: A Visual Analytics System for Functions and Connection Patterns of IPv4 Addresses in Networks

“…In the visualization result of [21], several obvious central nodes divide the hosts in the network into different areas, in which is more likely to form centers due to unusual network scanning behaviors. Dzwinel et al [22] proposed a new and fast graph-drawing method called ivga to support visual analysis for complex networks consisting of |V| 106+ vertices.…”