Interactive Analysis of Computer Scenarios through Parallel Coordinates Graphics

Parallel coordinates is a well-recognized method to visualize multivariate data. It uses an n-dimensional representation to reveal correlations in multiple dimensions. A security analyst plays a key role in tackling incidents, albeit being a hard task to achieve properly: a single service can generate a massive amount of log data in a single day. Among several techniques available, parallel coordinates have been widely used for visualization of high-dimensional datasets and are also highly suited to plot graphs with a huge number of data points. Unusual conditions and rare events may also be revealed in parallel coordinates graphs when they are interactively visualized, which would be a nice feature for the analyst to count on. To address that, we developed the Picviz-GUI tool, adding interactivity to the visualization of parallel coordinates graphs. With Picviz-GUI one can shape a graph to reduce visual clutter and to help finding patterns. With a set of simple actions, such as filtering, changing line thickness and color, and selections, the user can highlight the desired information, search through the variables for that subtle data correlation, and thus uncover security issues. This article shows how we implemented these features on top of parallel coordinates graphs, using a practical example to illustrate and demonstrate the effectiveness of this approach.