Visual Correlation for Situational Awareness

Yarden Livnat PhD

SCI Institute

University of Utah

ApproachIncorporates human judgment

Global and Local perspectives

Suggestive visualization

VisAlert: Network Intrusion Detection

ARDA and Air Force Research Lab

Infectious Disease Weather Map

Situational Awareness

VisAlert - Network intrusion detection - ARDA and Air Force Research Lab

CommonGround - Infectious disease weather map- US Army TATRC (Telemedicine & Advance Research Center)

Epinome - Visual analytics workbench for investigation of infectious disease outbreaks- CDC Rocky Mountain Center of Excellence in Public Health Informatics

Vs.

VisAlert

Traditional VisAlert

Visual correlation of network intrusion alerts

Disparate sources, heterogeneous data

The w3 premise- What- When- Where

VisAlertGlobal view with local detailsLocal view within a global context

Context Detail on demand

Application of the VisAlert paradigm

to other domains

VisAwareBioWatch - BioWatch sensors, Geographic Locations

VisAwareEmergency Response

Mapping multiple domains• Events• Resources• States• etc…

Interactive Visual Data Mining

Election results

Evolving investigationover network graphs

Infectious Disease Weather MapAn Interactive Visual Exploration of Temporal Correlations

CommonGround

CommonGround

CommonGround:Qualitative visualization

Current visualization:Quantitative and GIS

Whiteboard illustration of mental model map of influenza activity

The User Mental Model

Graphical cues:

Glyphs, size, clustering, relations, correlations, annotations

CommonGround

CommonGround:Cryptosporidium Outbreak

First appearance of Cryptosporidium

Mix of enteric pathogens more prominent Cryptosporidium

Cryptosporidium outbreak peak

Week of 7/1/2007 Week of 8/5/2007 Week of 8/26/2007

Epinome

An interactive web-based visual analytic workbench

Facilitate infectious disease outbreak investigation

Epinome

“How to get the software out of the way”

Focus of the discourse between the user and the data

Multiple coordinated views

Direct interaction with the data

Supports multiple lines of thought