Mission-focused Interaction and Visualization for Cyber-Awareness!

Mission-focused Interaction and Visualization for Cyber-Awareness! ARO MURI on Cyber Situation Awareness Year Two Review Meeting Tobias Höllerer Four Eyes Laboratory (Imaging, Interaction, and Innovative Interfaces), Computer Science Department, Media Arts & Technology Program,

The Big Picture 1. Up-to-date views of the available cyber-assets 2. A comprehensive analysis of the dependencies between cyber-missions and cyber-assets, 3. An accurate understanding of the impact of cyberattacks 4. Actionable cyber-attack forecasts 5. A semantically-rich, easy-to-grasp view of the cybermission status.

Motivation Goal: superior cybersecurity situational awareness Needs: successful information transfer to a decision-maker suitable analysis tools given a particular user-context context-specific knowledge dissemination theory and mechanisms for arriving at the correct analysis dynamic explanation and understanding of such data unveiling the options and consequences for the decisions ahead all of this in a timely fashion (window of opportunity) Approach: usability engineered interactive visualization methodology scalability with regard to changes in display and interaction capabilities scalability with regard to mission/user context.

Approach Scalable Visualization and Interaction Effective information and knowledge presentation by tailoring interfaces to user s information needs, context, and cognitive state. User models (e.g. war fighters, network security officers, command center personnel) Display and interaction platforms (mobile interfaces, desktop, immersive situation rooms) Situation: (e.g. specific task, interest, workspace, teaming, workload, stress-level, ) Cybaware s emerging integrative framework and the data structures we share (from data modeling & acquisition, extraction & abstraction, and analysis & presentation) enables such dynamic tailoring. Enable users to interactively explore the information landscape. 5

Year 1: Accomplishments User / Task Analysis Platform Evaluation: [Mobile Desktop Situation Room] Networked Graphs and Information Browsing (WiGis platform) Cybaware NSR software framework for immersive situation room (Allosphere), including plugins for various data/simulations (LBL logs, simple game theoretic analysis) Year 2: New Visualizations (Attacks, Compromised Services, Missions) based on [ICTF Data, VAST Challenge, UCSB data logs] Study: Graph analysis in 3D / 2D (Allosphere) Study: Effects of interactive graph manipulation on standard graph analysis tasks (72 users, instrumented 1h sessions) Early explorations of interactive visual recommender systems WiGis Open Source Distribution 6

Novel Cyber Mission Views Attack overviews (ICTF data & VAST Challenge) 7

Novel Cyber Mission Views Service-centered attack visualization (ICTF data) 8

Novel Cyber Mission Views Mission-centric view of potentially compromised services (ICTF data) 9

Graphs, graphs, graphs Network Topologies, Mission Graphs, Resource Dependency Graphs, Scenario Graphs, Attack Graphs 10

Role of 3D Question arose last year from our Immersive Situation Room (Allosphere) visualizations ( 2D vs 3D ) Expert and pilot evaluations steered us toward graph analysis as an interesting domain Comparison of 4 conditions: 3D graph layout, color highlighting, stereo 2.5D layout, stereo+color highlighting 2.5D layout, stereo highlighting 2D layout, color highlighting 5 topology-based tasks adjacency and common connections 11

B. Alper, T. Höllerer, J. Kuchera-Morin, A.Forbes: Stereoscopic Highlighting: 2D Graph Visualization on Stereo Displays. IEEE Transactions on Visualization and Computer Graphics (Proceedings Information Visualization 2011). To appear. Results 2.5D with stereo and color highlighting significantly better than other conditions For more complicated tasks, 2.5D with stereo highlighting alone performed also well No benefit of 3D over 2D, but careful use of stereoscopy can bring benefits 14

Role of Interactive Manipulation Last year, we demonstrated the WiGis platform for interactive manipulation of large graphs (tens and hundreds of thousands of nodes and edges). Interactive control of such graph displays can be crucial for understanding large data structures and explore them, e.g. for what-if analyses. There are few research results (yet) on the efficacy of interactive manipulation of graphs (of any size). è We decided to explore this in a controlled study 15

Role of Interactive Manipulation Built software (on top of WiGis) for controlled instrumented evaluation (training, simplified input of answers, complete log of user actions). Sequence of studies: Several pilot studies Main study (effects of manipulation technique and graph size on standard graph tasks) Comparison to only zoom, pan, and highlighting on static layouts (in progress) 16

Role of Interactive Manipulation DEMO 17

Role of Interactive Manipulation Results (ongoing) Benefit of Interactive Manipulation over just pan, zoom and highlight on static layouts Very large variance on peoples abilities to answer these questions. Hence we ran many participants (72 in main study, 30 so far in followup, each 1 hour of question answering). There is a main effect of interaction method on task performance for some tasks (shortest path, count nodes exactly 2 hops away): Slightly simplified: Interpolation > Simple > Spring There is an interaction between graph size and method with an effect on task performance for some tasks. Simplified: Interpolation>Spring and Interpolation> Simple for large graphs for complicated tasks 18

Mission-centric Situational Awareness 19

Recommender systems normally don t reveal provenance of recommendation Interactive exploration can help a user form an understanding of sources and influence factors Smallworlds prototype for social network recommendations (came out of ARL NS- CTA work) Outlook: Visual Recommender Systems Application to Cyber-Mission Planning Recommendations 20

Summary Year 2 Results Lessons learned and research questions answered Graph highlighting in Immersive Situation Room: Some benefit of carefully applied 3D but no case for 3D throughout. Interactive manipulation of large graph representations: helpful for certain tasks (enumerating resources 2 or three hops away, shortest path) on all graph sizes, necessary for resolving complicated questions on large graphs. Mission-based visualization iterative design with team members indicates usefulness, but still need to design and run evaluation study 21

Year 2 Metrics Keynote Talks: Anywhere Interfaces Scaling and Adapting Mixed Reality, Real-Time Computer Vision, and Visualization, International Symposium on Visual Computing (ISVC 2010), Las Vegas, NV, November 2010 The Role of Academia in Augmented Reality Research AR Research in the Time of AR Business Opportunities, Winter Augmented Reality Meeting (WARM 2011), Graz, Austria, February 2011 Relevant Invited Talks and Demonstrations: 08/19/10 CyberSecurity Visualization (Demonstrations). Computational CyberSecurity in Compromised Environments (C3E) Workshop. Field trip to UCSB 10/04/10 Information Network Visualization, and Research Overview: Multi- and Composite Information Network Analysis U.S. Army Network Science CTA, INARC Annual Meeting, New York City, NY 10/29/10 behaviorism: a Framework for Dynamic Data Visualization. Presented by PhD student A. Forbes in my presence. IEEE Information Visualization, VisWeek 2010, Salt Lake City, UT 03/11/11 Anywhere Interfaces: Scaling and Adapting Mixed Reality, Real-Time Computer Vision, and Visualization, Qualcomm Inc., San Diego, CA 03/15/11 Cognitive Models of Trust: Trust Considerations in Information Network User Interfaces Network Science Collaborative Technology Alliance, Cross-Cutting Research Iniative on Trust, Cambridge, MA Journal Papers: A.G. Forbes, T. Höllerer, and G. Legrady, behaviorism: a Framework for Dynamic Data Visualization. /IEEE Transactions on Visualization and Computer Graphics/ (Proceedings Information Visualization 2010) 16, 6 (November December 2010). B. Alper, T. Höllerer, J. Kuchera-Morin, A.Forbes: Stereoscopic Highlighting: 2D Graph Visualization on Stereo Displays. IEEE Transactions on Visualization and Computer Graphics (Proceedings Information Visualization 2011). To appear. B. Gretarsson, J. O Donovan, S. Bostandjiev, T. Höllerer, A. Asuncion, D. Newman, and P. Smyth: TopicNets: Visual Analysis of Large Text Corpora with Topic Modeling. ACM Transactions on Intelligent Systems and Technology, 2011 Conference and Workshop Papers: S. Bostandjiev, J. O Donovan, C. Hall, B. Gretarsson, T. Höllerer: WiGipedia: A Tool for Improving Structured Data in Wikipedia. B. Gretarsson, Fifth IEEE International Conference on Semantic Computing (ICSC '11), Sep. 19-21, 2011, Palo Alto, CA. S. Bostandjiev, J. O Donovan, B. Gretarsson, C. Hall, T. Höllerer: WiGiPedia: Visual Editing of Semantic Data in Wikipedia, Demonstration at VISSW 2011: Visual interfaces to the Social and Semantic Web, Workshop, Intelligent User Interfaces, Palo Alto, CA, Feb. 13, 2011. Public Software Launch: WiGis OpenSource Distribution, www.wigis.net 22

Future Work Evaluation of mission-specific visualizations using formal models. Iterative usability design. Scale visualizations between ICTF, UCSB support data, LBL data [UCSB, UCB] Design, development, and evaluation of interactive visual explanation systems for security alerts (incl. recommendation provenance) [UCSB, UCB] Design, development, and evaluation of interfaces for active exploration of game theoretic what-if analyses [UCSB, GATech] Scalability and automatic adaptation to presentation platforms, screen estate, and implied user context [UCSB] Deployment of interactive visualization framework for realworld scenarios [UCSB, UCB, GATech]

Questions? 24