Recent machine learning (ML) advances have demonstrated that deep learning (DL) achieves impressive results in different application domains, including the classification of computer network traffic to corresponding applications. However, the data frequently contains diverging patterns within a single predicted class. This presents a significant challenge to the ability to provide a clear and comprehensive explanation and emphasizes the necessity for tools capable of detecting and analyzing these patterns. Furthermore, the capacity to extract descriptive rules for classes is a crucial requirement in network traffic analysis and intrusion detection, particularly when leveraging advanced tools like next-generation firewalls. We provide a visual-interactive system that explains predictions of classes for network traffic. Global explanations derived from multiple samples of a given class contribute to understanding model predictions. Visualization of global explanations enables recognition of different patterns that offer experts a more comprehensive overview of its characteristics. We introduce a prototype that facilitates visual exploration and refinement of global explanations, enabling network experts to detect and refine new patterns for specific applications. These explanations support the identification of misleading features and the formulation of new rules for the management of networks. Our approach also aims at enabling ML experts to acquire new insights, including the possibility of separating or merging classes and the development of more accurate and reliable DL models. Our proposed prototype was evaluated by experts in machine learning and network analysis.

Modern software systems continuously generate massive amounts of log files in different and varying formats. These logs contain information about the application activities, which is necessary for improvements by analyzing the behavior and maintaining the security and stability of the system. To manage their size, logs are typically stored in compressed form using algorithms that exploit repetitive patterns. This work presents an approach to detecting frequent patterns in textual data that can be registered simultaneously during the file compression process. The log file is visualized with the possibility to explore the extracted patterns using metrics based on such properties as frequency and length of the acquired pattern. This allows an analyst to gain the relevant insights more efficiently reducing the need for manual labor-intensive inspection in the log data. The implemented extension of a dictionary-based compression algorithm has the advantage of recognizing patterns in log files of any format and eliminates the need to manually perform preparation for any preprocessing of log files.

This demo paper introduces the final version of a cohort analysis module for the support of treating patients with inflammatory bowel disease (IBD). It is not trivial to correctly diagnose the specific IBD in patients, and wrongly treated patients have to endure the disease effects for a long time, with large costs for the individuals and the healthcare systems. The goal of this work is complementing the examination of individual patients with interactive analyses of cohorts and populations with similar disease patterns to support learning from such similarities for future treatments. We report on additional data and functionality compared to 2021 and discuss an evaluation with eight IBD experts.

Deep learning (DL) models achieve remarkable performance in classification tasks. However, models with high complexity can not be used in many risk-sensitive applications unless a comprehensible explanation is presented. Explainable artificial intelligence (xAI) focuses on the research to explain the decision-making of AI systems like DL. We extend a recent method of Class Activation Maps (CAMs) which visualizes the importance of each feature of a data sample contributing to the classification. In this paper, we aggregate CAMs from multiple samples to show a global explanation of the classification for semantically structured data. The aggregation allows the analyst to make sophisticated assumptions and analyze them with further drill-down visualizations. Our visual representation for the global CAM illustrates the impact of each feature with a square glyph containing two indicators. The color of the square indicates the classification impact of this feature. The size of the filled square describes the variability of the impact between single samples. For interesting features that require further analysis, a detailed view is necessary that provides the distribution of these values. We propose an interactive histogram to filter samples and refine the CAM to show relevant samples only. Our approach allows an analyst to detect important features of high-dimensional data and derive adjustments to the AI model based on our global explanation visualization.

A major challenge for departments of public health (DPHs) in dealing with the ongoing COVID-19 pandemic is tracing contacts in exponentially growing SARS-CoV-2 infection clusters. Prevention of further disease spread requires a comprehensive registration of the connections between individuals and clusters. Due to the high number of infections with unknown origin, the healthcare analysts need to identify connected cases and clusters through accumulated epidemiological knowledge and the metadata of the infections in their database. Here we contribute a visual analytics dashboard to identify, assess and visualize clusters in COVID-19 contact tracing networks. Additionally, we demonstrate how graph-based machine learning methods can be used to find missing links between infection clusters and thus support the mission to get a comprehensive view on infection events. This work was developed through close collaboration with DPHs in Germany. We argue how our dashboard supports the identification of clusters by public health experts, discuss ongoing developments and possible extensions.

A major challenge for departments of public health (DPHs) in dealing with the ongoing COVID-19 pandemic is tracing contacts in exponentially growing SARS-CoV2 infection clusters. Prevention of further disease spread requires a comprehensive registration of the connections between individuals and clusters. Due to the high number of infections with unknown origin, the healthcare analysts need to identify connected cases and clusters through accumulated epidemiological knowledge and the metadata of the infections in their database. Here we contribute a visual analytics framework to identify, assess and visualize clusters in COVID-19 contact tracing networks. Additionally, we demonstrate how graph-based machine learning methods can be used to find missing links between infection clusters and thus support the mission to get a comprehensive view on infection events. This work was developed through close collaboration with DPHs in Germany. We argue how our systems supports the identification of clusters by public health experts and discuss ongoing developments and possible extensions.

The global routing network is the backbone of the Internet. However, it is quite vulnerable to attacks that cause major disruptions or routing manipulations. Prior related works have visualized routing path changes with node link diagrams, but it requires strong domain expertise to understand if a routing change between autonomous systems is suspicious. Geographic visualization has an advantage over conventional node‐link diagrams by helping uncover such suspicious routes as the user can immediately see if a path is the shortest path to the target or an unreasonable detour. In this paper, we present ProBGP, a web‐based progressive approach to visually analyze BGP update routes. We created a novel progressive data processing algorithm for the geographic approximation of autonomous systems and combined it with a progressively updating visualization. While the newest log data is continuously loaded, our approach also allows querying the entire log recordings since 1999. We present the usefulness of our approach with a real use case of a major route leak from June 2019. We report on multiple interviews with domain experts throughout the development. Finally, we evaluated our algorithm quantitatively against a public peering database and qualitatively against AS network maps.

This paper reports on a joint project with medical experts on inflammatory bowel disease (IBD). Patients suffering from IBD. e.g. Crohn's disease or ulcerative colitis, do not have a reduced life expectancy and disease progressions easily span several decades. We designed a visualization to highlight information that is vital for comparing patients and progressions, especially with respect to the treatments administered over the years. Medical experts can interactively determine the amount of information displayed and can synchronize the progressions to the beginning of certain treatments and medications. While the visualization was designed in close collaboration with IBD experts, we additionally evaluated our approach with 35 participants to ensure good usability and accessibility. The paper also highlights the future work on similarity definition and additional visual features in this on-going project.

With the aim to increase the awareness of the everyday internet user for the own home network traffic, we present two interactive visualization interfaces for visual exploration of home router traffic records. Thereby we differentiate between users with a present intrinsic motivation for the topic and those with absent intrinsic motivation. Therefore, gamification in the first interface is used to maintain motivation of the first type of user, while the storytelling concept based on the hero's journey in the second interface aims at increasing the perceived incentives for the second user group.

Network traffic log data is a key data source for forensic analysis of cybersecurity incidents. Packet Captures (PCAPs) are the raw information directly gathered from the network device. As the bandwidth and connections to other hosts rise, this data becomes very large quickly. Malware analysts and administrators are using this data frequently for their analysis. However, the currently most used tool Wireshark is displaying the data as a table, making it difficult to get an overview and focus on the significant parts. Also, the process of loading large files into Wireshark takes time and has to be repeated each time the file is closed. We believe that this problem poses an optimal setting for a client-server infrastructure with a progressive visual analytics approach. The processing can be outsourced to the server while the client is progressively updated. In this paper we present NetCapVis, an web-based progressive visual analytics system where the user can upload PCAP files, set initial filters to reduce the data before uploading and then instantly interact with the data while the rest is progressively loaded into the visualizations.

Routing of network packets from one computer to another is the backbone of the internet and impacts the everyday life of many people. Although, this is a fully automated process it has many security issues. IP hijacks and misconfigurations occur very often and are difficult to detect. In the past visual analytics approaches aimed at detecting these phenomenons but only a few of these integrated geographical references. Geo-IP data is being used mostly as a lookup table which is an undervaluation of its capabilities. In this paper we present a visual-interactive system which only relies on Geo-IP data to create more awareness for this data source. We show that looking at Geo-IP data over time in combination with owner and location information of IP blocks already reveals suspicious cases. Together with our design study we also contribute a pre-processing algorithm for the Maxmind GeoIP2 City and ISP databases, to motivate the community to integrate this data source in future approaches.

In this design study, we present a visualization technique that segments patients' histories instead of treating them as raw event sequences, aggregates the segments using criteria such as the whole history or treatment combinations, and then visualizes the aggregated segments as static dashboards that are arranged in a dashboard network to show longitudinal changes. The static dashboards were developed in nine iterations, to show 15 important attributes from the patients' histories. The final design was evaluated with five non-experts, five visualization experts and four medical experts, who successfully used it to gain an overview of a 2,000 patient dataset, and to make observations about longitudinal changes and differences between two cohorts. The research represents a step-change in the detail of large-scale data that may be successfully visualized using dashboards, and provides guidance about how the approach may be generalized.

Figure 1: The gap: (a) The mental gap between users and the CS world. The expert can bridge it by VA and mental effort. Non-expert needs support by UX. (b) The gap to the expert can be caused by limited mental capacity and the additional gap to non-experts by the lack of incentive and knowledge (c) A vision how the four research areas could work together, enveloped by empathy and domain knowledge.

The definition of similarity is a key prerequisite when analyzing complex data types in data mining, information retrieval, or machine learning. However, the meaningful definition is often hampered by the complexity of data objects and particularly by different notions of subjective similarity latent in targeted user groups. Taking the example of soccer players, we present a visual-interactive system that learns users' mental models of similarity. In a visual-interactive interface, users are able to label pairs of soccer players with respect to their subjective notion of similarity. Our proposed similarity model automatically learns the respective concept of similarity using an active learning strategy. A visual-interactive retrieval technique is provided to validate the model and to execute downstream retrieval tasks for soccer player analysis. The applicability of the approach is demonstrated in different evaluation strategies, including usage scenarions and cross-validation tests.

The analysis of large, multivariate data sets is challenging, especially when some of these data objects are time-oriented. Exploring relationships between multivariate and temporal information, e.g., to identify patterns that support decision making is an important industrial analysis task. The target group of this design study are data analysts aiming at detecting fault patterns in a telecommunications network in order to spend maintenance budget more effectively. We present a visual analytics tool that provides overviews of multivariate data sets and associated time series. Users can select data subsets of interest in both attribute data and clustered time series data. Linked views consequently support the identification of relations between the two spaces. To ensure usefulness, the tool was designed in an iterative way, based on a careful characterization of the data, users, and tasks. A usage scenario demonstrates the applicability of the approach.

We present a concept for the visual-interactive definition of meaningful subsets in data sets comprising multivariate attributes and time series data. Based on a generalization of requirements of a real-world user group, we propose a three-stage approach, combining visual-interactive querying, query filter analysis, and result exploration. The approach includes several design parameters that can easily be adapted in future design studies for alternative applications.

The assessment of patient well-being is highly relevant for the early detection of diseases, for assessing the risks of therapies, or for evaluating therapy outcomes. The knowledge to assess a patient's well-being is actually tacit knowledge and thus, can only be used by the physicians themselves. The rationale of this research approach is to use visual interfaces to capture the mental models of experts and make them available more explicitly. We present a visual active learning system that enables physicians to label the well-being state of patient histories suffering prostate cancer. The labeled instances are iteratively learned in an active learning approach. In addition, the system provides models and visual interfaces for a) estimating the number of patients needed for learning, b) suggesting meaningful learning candidates and c) visual feedback on test candidates. We present the results of two evaluation strategies that prove the validity of the applied model. In a representative real-world use case, we learned the feedback of physicians on a data collection of more than 16.000 prostate cancer histories.

A long-term goal in prostate cancer research is a sound prognosis prior to surgery, and as a consequence, data-centered research is becoming increasingly important. Currently, it takes several days to define meaningful cohorts by manually selecting patients from health record systems and performing statistical hypothesis tests with cohorts. The authors developed an efficient and effective visual-interactive system for the definition and analysis of patient cohorts. The system provides an overview of large sets of patient records and allows medical researchers to interactively drill down to relevant patient cohorts. In addition, a guidance concept helps them identify interesting relations between defined cohorts and rich sets of attributes available in the patient records. The system increases the efficiency of the researchers' analytical workflow by reducing the temporal effort from days to minutes.