Security Visualization

The widespread use of computers and internet makes computer security an increasingly important problem. Homeland security has also become the top prority of our nation. One basic approach to the security problem is to analyze large data collected from all possible sources. The results of the analysis can help spot suspecious activities and track down known malicious intents. We have been studying how visualization can supplement traditional data analysis methods, which often fail to handle the scale and complexity of the security data. Our work is largely driven by computer network security but our research results are also applicable to general data analysis and knowledge discovery. We have developed several prototype systems to demonstrate the effectiveness of visualization based analysis and searching.

Research Team

Kwan-Liu Ma, Professor, IDAV and Department of Computer Science
S. Felix Wu, Associate Professor, Department of Computer Science

Christopher Muelder, PhD student
Michael Ogawa, PhD student

Previous members:

Jonathan McPherson, Microsoft
Soon Tee Teoh, San Jose State University

Research Highlights


We are developing a way of characterizing network scans by using visualization and statistics techniques to analyze the patterns found in the timing of the scans. We have built a system that allows large numbers of network scans to be rapidly compared and subsequently identified.

Information Visualization

We study basic research problems in information visualization with a focus on graph visualization, interactive browsing techniques, and model-based methods.
[More Information]


Elisha is a software system created for understanding Internet anomalies and dynamics through interactive visualization of BGP rounting data. This project is supported in part by NSF and DARPA.
[Software: Executable and data for Windows PC]


In some cases, security data available can only be coarsely detailed because of security concerns or other limitations. How can interesting security events still be discovered in data that lacks important details, such as IP addresses, network security alarms, and labels? PortVis is a software system we have designed that takes very coarsely detailed data---basic, summarized information of the activity on each TCP port during each given hour---and uses visualization to help uncover interesting security events.
[Software: Coming]


Visual-based classification gives promise to the solution of complex, high-dimensinoal data analysis problems. PaintingClass is a new decision-tree exploration mechanism for classifying multi-dimensional data, especially those consisting of both numerical and categorical attributes.
[Software: Executable and data for Windows PC]




Current research projects are sponsored by NSF ITR, DOE LLNL and Boeing.