{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,27]],"date-time":"2026-09-27T12:55:43Z","timestamp":1790513743414,"version":"4.1.0"},"reference-count":95,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2020,5,22]],"date-time":"2020-05-22T00:00:00Z","timestamp":1590105600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2020,5,22]],"date-time":"2020-05-22T00:00:00Z","timestamp":1590105600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"funder":[{"DOI":"10.13039\/100006754","name":"Army Research Laboratory","doi-asserted-by":"publisher","award":["W911NF-18-1-0460"],"award-info":[{"award-number":["W911NF-18-1-0460"]}],"id":[{"id":"10.13039\/100006754","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int. J. Inf. Secur."],"published-print":{"date-parts":[[2021,6]]},"DOI":"10.1007\/s10207-020-00504-9","type":"journal-article","created":{"date-parts":[[2020,5,22]],"date-time":"2020-05-22T19:02:37Z","timestamp":1590174157000},"page":"331-345","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":22,"title":["Evaluating visualization approaches to detect abnormal activities in network traffic data"],"prefix":"10.1007","volume":"20","author":[{"given":"Soo-Yeon","family":"Ji","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bong-Keun","family":"Jeong","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5271-293X","authenticated-orcid":false,"given":"Dong Hyun","family":"Jeong","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2020,5,22]]},"reference":[{"key":"504_CR1","doi-asserted-by":"crossref","unstructured":"Elshoush, H.T., Osman, I.M.: Reducing false positives through fuzzy alert correlation in collaborative intelligent intrusion detection systems: a review. In: International Conference on Fuzzy Systems, pp. 1\u20138 (2010)","DOI":"10.1109\/FUZZY.2010.5584418"},{"issue":"1","key":"504_CR2","doi-asserted-by":"publisher","first-page":"19","DOI":"10.1186\/s13673-016-0076-z","volume":"6","author":"N Keegan","year":"2016","unstructured":"Keegan, N., Ji, S.Y., Chaudhary, A., Concolato, C., Yu, B., Jeong, D.H.: A survey of cloud-based network intrusion detection analysis. Hum.-centric Comput. Inf. Sci. 6(1), 19 (2016). https:\/\/doi.org\/10.1186\/s13673-016-0076-z","journal-title":"Hum.-centric Comput. Inf. Sci."},{"key":"504_CR3","unstructured":"Dean, J., Ghemawat, S.: Mapreduce: simplified data processing on large clusters. In: OSDI\u201904: Proceedings of the 6th Conference on Symposium on Operating Systems Design and Implementation. USENIX Association (2004)"},{"issue":"8","key":"504_CR4","doi-asserted-by":"publisher","first-page":"1313","DOI":"10.1109\/TVCG.2011.144","volume":"18","author":"H Shiravi","year":"2012","unstructured":"Shiravi, H., Shiravi, A., Ghorbani, A.A.: A survey of visualization systems for network security. IEEE Trans. Vis. Comput. Graph. 18(8), 1313\u20131329 (2012)","journal-title":"IEEE Trans. Vis. Comput. Graph."},{"key":"504_CR5","doi-asserted-by":"publisher","first-page":"9","DOI":"10.1016\/j.jnca.2015.12.004","volume":"62","author":"SY Ji","year":"2016","unstructured":"Ji, S.Y., Jeong, B.K., Choi, S., Jeong, D.H.: A multi-level intrusion detection method for abnormal network behaviors. J. Netw. Comput. Appl. 62, 9\u201317 (2016)","journal-title":"J. Netw. Comput. Appl."},{"key":"504_CR6","doi-asserted-by":"crossref","unstructured":"Jeong, D.H., Jeong, B., Ji, S.: Designing a hybrid approach with computational analysis and visual analytics to detect network intrusions. In: 2017 IEEE 7th Annual Computing and Communication Workshop and Conference (CCWC), pp. 1\u20137 (2017)","DOI":"10.1109\/CCWC.2017.7868417"},{"issue":"6","key":"504_CR7","doi-asserted-by":"publisher","first-page":"6","DOI":"10.1109\/MNET.2012.6375887","volume":"26","author":"L Harrison","year":"2012","unstructured":"Harrison, L., Lu, A.: The future of security visualization: lessons from network visualization. IEEE Netw. 26(6), 6\u201311 (2012). https:\/\/doi.org\/10.1109\/MNET.2012.6375887","journal-title":"IEEE Netw."},{"key":"504_CR8","unstructured":"Girardin, L.: An eye on network intruder-administrator shootouts. In: Proceedings of the 1st Conference on Workshop on Intrusion Detection and Network Monitoring\u2014Volume 1, ID\u201999, pp. 3\u20133. USENIX Association, Berkeley, CA, USA (1999)"},{"key":"504_CR9","doi-asserted-by":"publisher","unstructured":"Grinstein, G., Piatetsky-Shapiro, G., Wills, G.: Information exploration shootout or \u201cbenchmarks for information exploration\u201d. In: Proceedings of Seventh Annual IEEE Visualization \u201996, pp. 449\u2013450 (1996). https:\/\/doi.org\/10.1109\/VISUAL.1996.568163","DOI":"10.1109\/VISUAL.1996.568163"},{"key":"504_CR10","doi-asserted-by":"crossref","unstructured":"McPherson, J., Ma, K.L., Krystosk, P., Bartoletti, T., Christensen, M.: Portvis: A tool for port-based detection of security events. In: Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security, VizSEC\/DMSEC \u201904, pp. 73\u201381. ACM, New York (2004)","DOI":"10.1145\/1029208.1029220"},{"key":"504_CR11","doi-asserted-by":"crossref","unstructured":"Ball, R., Fink, G.A., North, C.: Home-centric visualization of network traffic for security administration. In: Proceedings of the 2004 ACM Workshop on Visualization and Data Mining for Computer Security, VizSEC\/DMSEC \u201904, pp. 55\u201364. ACM, New York (2004)","DOI":"10.1145\/1029208.1029217"},{"key":"504_CR12","unstructured":"Goodall, J.R., Lutters, W.G., Rheingans, P., Komlodi, A.: Preserving the big picture: visual network traffic analysis with TNV. In: IEEE Workshop on Visualization for Computer Security, 2005. (VizSEC 05), pp. 47\u201354 (2005)"},{"key":"504_CR13","doi-asserted-by":"publisher","unstructured":"Lippmann, R., Haines, J.W., Fried, D.J., Korba, J., Das, K.: The 1999 darpa off-line intrusion detection evaluation. Comput. Netw. 34(4), 579\u2013595 (2000). https:\/\/doi.org\/10.1016\/S1389-1286(00)00139-0. Recent Advances in Intrusion Detection Systems","DOI":"10.1016\/S1389-1286(00)00139-0"},{"issue":"6","key":"504_CR14","doi-asserted-by":"publisher","first-page":"1105","DOI":"10.1109\/TVCG.2007.70522","volume":"13","author":"F Mansmann","year":"2007","unstructured":"Mansmann, F., Keim, D.A., North, S.C., Rexroad, B., Sheleheda, D.: Visual analysis of network traffic for resource planning, interactive monitoring, and interpretation of security threats. IEEE Trans. Vis. Comput. Graph. 13(6), 1105\u20131112 (2007). https:\/\/doi.org\/10.1109\/TVCG.2007.70522","journal-title":"IEEE Trans. Vis. Comput. Graph."},{"key":"504_CR15","doi-asserted-by":"crossref","unstructured":"Bertini, E., Hertzog, P., Lalanne, D.: Spiralview: Towards security policies assessment through visual correlation of network resources with evolution of alarms. In: 2007 IEEE Symposium on Visual Analytics Science and Technology, pp. 139\u2013146 (2007)","DOI":"10.1109\/VAST.2007.4389007"},{"key":"504_CR16","doi-asserted-by":"crossref","unstructured":"Brown, C., Cowperthwaite, A., Hijazi, A., Somayaji, A.: Analysis of the 1999 darpa\/lincoln laboratory ids evaluation data with netadhict. In: 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, pp. 1\u20137 (2009)","DOI":"10.1109\/CISDA.2009.5356522"},{"key":"504_CR17","doi-asserted-by":"crossref","unstructured":"Glanfield, J., Brooks, S., Taylor, T., Paterson, D., Smith, C., Gates, C., McHugh, J.: Over flow: an overview visualization for network analysis. In: 2009 6th International Workshop on Visualization for Cyber Security, pp. 11\u201319 (2009)","DOI":"10.1109\/VIZSEC.2009.5375536"},{"key":"504_CR18","doi-asserted-by":"publisher","first-page":"145","DOI":"10.1057\/ivs.2011.2","volume":"10","author":"JR Goodall","year":"2011","unstructured":"Goodall, J.R.: An evaluation of visual and textual network analysis tools. Inf. Vis. 10, 145\u2013157 (2011)","journal-title":"Inf. Vis."},{"key":"504_CR19","doi-asserted-by":"crossref","unstructured":"Angelini, M., Prigent, N., Santucci, G.: Percival: proactive and reactive attack and response assessment for cyber incidents using visual analytics. In: 2015 IEEE Symposium on Visualization for Cyber Security (VizSec), pp. 1\u20138 (2015)","DOI":"10.1109\/VIZSEC.2015.7312764"},{"key":"504_CR20","doi-asserted-by":"crossref","unstructured":"Cappers, B.C.M., van Wijk, J.J.: Understanding the context of network traffic alerts. In: 2016 IEEE Symposium on Visualization for Cyber Security (VizSec), pp. 1\u20138 (2016)","DOI":"10.1109\/VIZSEC.2016.7739579"},{"key":"504_CR21","unstructured":"Huynh, N.A., Ng, W.K., Ulmer, A., Kohlhammer, J.: Uncovering periodic network signals of cyber attacks. In: 2016 IEEE Symposium on Visualization for Cyber Security (VizSec), pp. 1\u20138 (2016)"},{"key":"504_CR22","doi-asserted-by":"publisher","unstructured":"Biglar Beigi, E., Hadian Jazi, H., Stakhanova, N., Ghorbani, A.A.: Towards effective feature selection in machine learning-based botnet detection approaches. In: 2014 IEEE Conference on Communications and Network Security, pp. 247\u2013255 (2014). https:\/\/doi.org\/10.1109\/CNS.2014.6997492","DOI":"10.1109\/CNS.2014.6997492"},{"key":"504_CR23","doi-asserted-by":"crossref","unstructured":"Arendt, D.L., Burtner, R., Best, D.M., Bos, N.D., Gersh, J.R., Piatko, C.D., Paul, C.L.: Ocelot: user-centered design of a decision support visualization for network quarantine. In: 2015 IEEE Symposium on Visualization for Cyber Security (VizSec), pp. 1\u20138 (2015)","DOI":"10.1109\/VIZSEC.2015.7312763"},{"key":"504_CR24","unstructured":"Cook, K., Grinstein, G., Whiting, M.: VAST Challenge 2013: Mini-Challenge 3. http:\/\/vacommunity.org\/VAST+Challenge+2013 (2019). [Online; accessed 10-November-2019]"},{"issue":"4","key":"504_CR25","doi-asserted-by":"publisher","first-page":"250","DOI":"10.1016\/j.dcan.2017.07.004","volume":"3","author":"Z Ruan","year":"2017","unstructured":"Ruan, Z., Miao, Y., Pan, L., Patterson, N., Zhang, J.: Visualization of big data security: a case study on the kdd99 cup data set. Digit. Commun. Netw. 3(4), 250\u2013259 (2017). https:\/\/doi.org\/10.1016\/j.dcan.2017.07.004","journal-title":"Digit. Commun. Netw."},{"key":"504_CR26","unstructured":"KDD99: KDD Cup 1999 Data. http:\/\/kdd.ics.uci.edu\/databases\/kddcup99\/kddcup99.html (2019). [Online; accessed 10-November-2019]"},{"key":"504_CR27","unstructured":"NSL-KDD: NSL-KDD dataset. http:\/\/nsl.cs.unb.ca\/NSL-KDD\/ (2019). [Online; accessed 10-November-2019]"},{"key":"504_CR28","doi-asserted-by":"crossref","unstructured":"Theron, R., Mag\u00e1n-Carri\u00f3n, R., Camacho, J., Fernndez, G.M.: Network-wide intrusion detection supported by multivariate analysis and interactive visualization. In: 2017 IEEE Symposium on Visualization for Cyber Security (VizSec), pp. 1\u20138 (2017)","DOI":"10.1109\/VIZSEC.2017.8062198"},{"key":"504_CR29","doi-asserted-by":"publisher","first-page":"411","DOI":"10.1016\/j.cose.2017.11.004","volume":"73","author":"G Maci\u00e1-Fern\u00e1ndez","year":"2018","unstructured":"Maci\u00e1-Fern\u00e1ndez, G., Camacho, J., Mag\u00e1n-Carri\u00f3n, R., Garc\u00eda-Teodoro, P., Ther\u00f3n, R.: Ugr\u201916: a new dataset for the evaluation of cyclostationarity-based network idss. Comput. Secur. 73, 411\u2013424 (2018)","journal-title":"Comput. Secur."},{"key":"504_CR30","doi-asserted-by":"crossref","unstructured":"Cappers, B., van Wijk, J., Etalle, S., Meessen, P.: Eventpad: Rapid malware analysis and reverse engineering using visual analytics. In: 2018 IEEE Symposium on Visualization for Cyber Security (VizSec) (2018)","DOI":"10.1109\/VIZSEC.2018.8709230"},{"key":"504_CR31","doi-asserted-by":"crossref","unstructured":"Krokos, E., Rowden, A.R., Whitley, K., Varshney, A.: Visual analytics for root dns data. In: 2018 IEEE Symposium on Visualization for Cyber Security (VizSec) (2018)","DOI":"10.1109\/VIZSEC.2018.8709205"},{"issue":"2","key":"504_CR32","doi-asserted-by":"publisher","first-page":"72","DOI":"10.1109\/MCG.2006.31","volume":"26","author":"JR Goodall","year":"2006","unstructured":"Goodall, J.R., Lutters, W.G., Rheingans, P., Komlodi, A.: Focusing on context in network traffic analysis. IEEE Comput. Graph. Appl. 26(2), 72\u201380 (2006). https:\/\/doi.org\/10.1109\/MCG.2006.31","journal-title":"IEEE Comput. Graph. Appl."},{"issue":"1","key":"504_CR33","doi-asserted-by":"publisher","first-page":"49","DOI":"10.1145\/2492101.1555356","volume":"37","author":"Y Jin","year":"2009","unstructured":"Jin, Y., Sharafuddin, E., Zhang, Z.L.: Unveiling core network-wide communication patterns through application traffic activity graph decomposition. SIGMETRICS Perform. Eval. Rev. 37(1), 49\u201360 (2009). https:\/\/doi.org\/10.1145\/2492101.1555356","journal-title":"SIGMETRICS Perform. Eval. Rev."},{"issue":"2","key":"504_CR34","doi-asserted-by":"publisher","first-page":"110","DOI":"10.1109\/TNSM.2009.090604","volume":"6","author":"A Kind","year":"2009","unstructured":"Kind, A., Stoecklin, M., Dimitropoulos, X.: Histogram-based traffic anomaly detection. IEEE Trans. Netw. Serv. Manag. 6(2), 110\u2013121 (2009)","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"504_CR35","doi-asserted-by":"crossref","unstructured":"Boschetti, A., Salgarelli, L., Muelder, C., Ma, K.L.: TVI: a visual querying system for network monitoring and anomaly detection. In: Proceedings of the 8th International Symposium on Visualization for Cyber Security, VizSec \u201911, pp. 1:1\u20131:10. ACM, New York (2011)","DOI":"10.1145\/2016904.2016905"},{"key":"504_CR36","doi-asserted-by":"publisher","first-page":"677","DOI":"10.1109\/TVCG.2006.160","volume":"12","author":"N Henry","year":"2006","unstructured":"Henry, N., Fekete, J.D.: Matrixexplorer: a dual-representation system to explore social networks. IEEE Trans. Vis. Comput. Graph 12, 677\u2013684 (2006)","journal-title":"IEEE Trans. Vis. Comput. Graph"},{"key":"504_CR37","volume-title":"Applied Security Visualization","author":"R Marty","year":"2008","unstructured":"Marty, R.: Applied Security Visualization, 1st edn. Addison-Wesley Professional, Reading (2008)","edition":"1"},{"key":"504_CR38","doi-asserted-by":"crossref","unstructured":"Roberts, J.C.: State of the art: coordinated and multiple views in exploratory visualization. In: Proceedings of the Fifth International Conference on Coordinated and Multiple Views in Exploratory Visualization, CMV \u201907, pp. 61\u201371. IEEE Computer Society, Washington (2007)","DOI":"10.1109\/CMV.2007.20"},{"key":"504_CR39","doi-asserted-by":"publisher","unstructured":"Song, J., Takakura, H., Okabe, Y., Eto, M., Inoue, D., Nakao, K.: Statistical analysis of honeypot data and building of kyoto 2006+ dataset for NIDS evaluation. In: Proceedings of the First Workshop on Building Analysis Datasets and Gathering Experience Returns for Security, BADGERS \u201911, pp. 29\u201336. Association for Computing Machinery, New York (2011). https:\/\/doi.org\/10.1145\/1978672.1978676","DOI":"10.1145\/1978672.1978676"},{"key":"504_CR40","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Bagheri, E., Lu, W., Ghorbani, A.A.: A detailed analysis of the kdd cup 99 data set. In: 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, pp. 1\u20136 (2009)","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"504_CR41","unstructured":"Song, J., Takakura, H., Okabe, Y.: Traffic Data from Kyoto University\u2019s Honeypots. http:\/\/www.takakura.com\/Kyoto_data\/ (2020). [Online; accessed 1-January-2020]"},{"issue":"12","key":"504_CR42","doi-asserted-by":"publisher","first-page":"3448","DOI":"10.1016\/j.comnet.2007.02.001","volume":"51","author":"A Patcha","year":"2007","unstructured":"Patcha, A., Park, J.M.: An overview of anomaly detection techniques: existing solutions and latest technological trends. Comput. Netw. 51(12), 3448\u20133470 (2007)","journal-title":"Comput. Netw."},{"key":"504_CR43","doi-asserted-by":"crossref","unstructured":"Nychis, G., Sekar, V., Andersen, D.G., Kim, H., 0001, H.Z.: An empirical evaluation of entropy-based traffic anomaly detection. In: Papagiannaki, K., Zhang, Z.L. (eds.) Internet Measurement Comference, pp. 151\u2013156. ACM (2008)","DOI":"10.1145\/1452520.1452539"},{"issue":"1","key":"504_CR44","doi-asserted-by":"publisher","first-page":"6","DOI":"10.1109\/MNET.2009.4804318","volume":"23","author":"G Androulidakis","year":"2009","unstructured":"Androulidakis, G., Chatzigiannakis, V., Papavassiliou, S.: Network anomaly detection and classification via opportunistic sampling. IEEE Netw. 23(1), 6\u201312 (2009). https:\/\/doi.org\/10.1109\/MNET.2009.4804318","journal-title":"IEEE Netw."},{"key":"504_CR45","volume-title":"Principal Component Analysis","author":"IT Jolliffe","year":"2002","unstructured":"Jolliffe, I.T.: Principal Component Analysis, 2nd edn. Springer, Berlin (2002)","edition":"2"},{"key":"504_CR46","first-page":"2581","volume":"3","author":"H Shirazi","year":"2009","unstructured":"Shirazi, H.: Anomaly intrusion detection system using information theory, k-nn and kmc algorithms. Aust. J. Basic Appl. Sci. 3, 2581\u20132597 (2009)","journal-title":"Aust. J. Basic Appl. Sci."},{"key":"504_CR47","doi-asserted-by":"publisher","first-page":"511","DOI":"10.1007\/11548706_54","volume-title":"Rough Sets, Fuzzy Sets, Data Mining, and Granular Computing","author":"H Lee","year":"2005","unstructured":"Lee, H., Song, J., Park, D.: Intrusion detection system based on multi-class svm. In: Slezak, D., Yao, J., Peters, J.F., Ziarko, W., Hu, X. (eds.) Rough Sets, Fuzzy Sets, Data Mining, and Granular Computing, pp. 511\u2013519. Springer, Berlin (2005)"},{"key":"504_CR48","unstructured":"Plassman, G.E.: A survey of singular value decomposition methods and performance comparison of some available serial codes. NASA Technical Report CR-2005-213500 (2005)"},{"issue":"1","key":"504_CR49","doi-asserted-by":"publisher","first-page":"141","DOI":"10.1109\/TVCG.2015.2467553","volume":"22","author":"D J\u00e4ckle","year":"2016","unstructured":"J\u00e4ckle, D., Fischer, F., Schreck, T., Keim, D.A.: Temporal MDS plots for analysis of multivariate data. IEEE Trans. Vis. Comput. Graph. 22(1), 141\u2013150 (2016). https:\/\/doi.org\/10.1109\/TVCG.2015.2467553","journal-title":"IEEE Trans. Vis. Comput. Graph."},{"issue":"1","key":"504_CR50","doi-asserted-by":"publisher","first-page":"22","DOI":"10.1198\/106186002317375604","volume":"11","author":"SG Eick","year":"2002","unstructured":"Eick, S.G., Karr, A.F.: Visual scalability. J. Comput. Graph. Stat. 11(1), 22\u201343 (2002). https:\/\/doi.org\/10.1198\/106186002317375604","journal-title":"J. Comput. Graph. Stat."},{"key":"504_CR51","doi-asserted-by":"crossref","unstructured":"Tufte, E.R.: Visual Explanations: Images and Quantities, Evidence and Narrative . Graphics Press (1997)","DOI":"10.1063\/1.168637"},{"key":"504_CR52","unstructured":"Jeong, D.H., Ziemkiewicz, C., Ribarsky, W., Chang, R.: Understanding principal component analysis using a visual analytics tool (2009)"},{"key":"504_CR53","unstructured":"Keim, D.A., Kriegel, H.P., Seidl, T.: Visual feedback in querying large databases. In: Nielson, G.M., Bergeron, R.D. (eds.) IEEE Visualization, pp. 158\u2013165. IEEE Computer Society (1993)"},{"issue":"1","key":"504_CR54","doi-asserted-by":"publisher","first-page":"59","DOI":"10.1109\/2945.841121","volume":"6","author":"DA Keim","year":"2000","unstructured":"Keim, D.A.: Designing pixel-oriented visualization techniques: theory and applications. IEEE Trans. Vis. Comput. Graph. 6(1), 59\u201378 (2000). https:\/\/doi.org\/10.1109\/2945.841121","journal-title":"IEEE Trans. Vis. Comput. Graph."},{"key":"504_CR55","unstructured":"Jeong, D.H., Dou, W., Ribarsky, W., Chang, R.: Knowledge-oriented refactoring in visualization (2009)"},{"key":"504_CR56","doi-asserted-by":"crossref","unstructured":"Xiao, L., Gerth, J., Hanrahan, P.: Enhancing visual analysis of network traffic using a knowledge representation. In: VAST \u201906: Proceedings of the IEEE Symposium on Visual Analytics Science And Technology, 2006, pp. 107\u2013114 (2006)","DOI":"10.1109\/VAST.2006.261436"},{"key":"504_CR57","doi-asserted-by":"publisher","first-page":"12","DOI":"10.1007\/978-3-540-71027-1_2","volume-title":"Pixelization Paradigm","author":"DA Keim","year":"2007","unstructured":"Keim, D.A., Schneidewind, J., Sips, M.: Scalable pixel based visual data exploration. In: L\u00e9vy, P.P., Le Grand, B., Poulet, F., Soto, M., Darago, L., Toubiana, L., Vibert, J.F. (eds.) Pixelization Paradigm, pp. 12\u201324. Springer, Berlin (2007)"},{"key":"504_CR58","doi-asserted-by":"publisher","first-page":"2","DOI":"10.1007\/978-3-642-00219-9_2","volume-title":"Graph Drawing","author":"R Tamassia","year":"2009","unstructured":"Tamassia, R., Palazzi, B., Papamanthou, C.: Graph drawing for security visualization. In: Tollis, I.G., Patrignani, M. (eds.) Graph Drawing, pp. 2\u201313. Springer, Berlin (2009)"},{"issue":"11","key":"504_CR59","doi-asserted-by":"publisher","first-page":"1129","DOI":"10.1002\/spe.4380211102","volume":"21","author":"TMJ Fruchterman","year":"1991","unstructured":"Fruchterman, T.M.J., Reingold, E.M.: Graph drawing by force-directed placement. Softw. Pract. Exp. 21(11), 1129\u20131164 (1991). https:\/\/doi.org\/10.1002\/spe.4380211102","journal-title":"Softw. Pract. Exp."},{"key":"504_CR60","doi-asserted-by":"crossref","unstructured":"Gajer, P., Kobourov, S.G.: Grip: Graph drawing with intelligent placement. In: Marks, J. (ed.) Graph Drawing, Lecture Notes in Computer Science, vol. 1984, pp. 222\u2013228. Springer, Berlin (2000)","DOI":"10.1007\/3-540-44541-2_21"},{"issue":"4","key":"504_CR61","doi-asserted-by":"publisher","first-page":"555","DOI":"10.1016\/j.jcss.2004.10.006","volume":"70","author":"S Dasgupta","year":"2005","unstructured":"Dasgupta, S., Long, P.M.: Performance guarantees for hierarchical clustering. J. Comput. Syst. Sci. 70(4), 555\u2013569 (2005). https:\/\/doi.org\/10.1016\/j.jcss.2004.10.006","journal-title":"J. Comput. Syst. Sci."},{"issue":"5","key":"504_CR62","doi-asserted-by":"publisher","first-page":"669","DOI":"10.1109\/TVCG.2006.120","volume":"12","author":"J Abello","year":"2006","unstructured":"Abello, J., van Ham, F., Krishnan, N.: Ask-graphview: a large scale graph visualization system. IEEE Trans. Vis. Comput. Graph. 12(5), 669\u2013676 (2006). https:\/\/doi.org\/10.1109\/TVCG.2006.120","journal-title":"IEEE Trans. Vis. Comput. Graph."},{"key":"504_CR63","unstructured":"Shneiderman, B.: The eyes have it: a task by data type taxonomy for information visualizations. In: Proceedings 1996 IEEE Symposium on Visual Languages, pp. 336\u2013343 (1996)"},{"issue":"6","key":"504_CR64","doi-asserted-by":"publisher","first-page":"1224","DOI":"10.1109\/TVCG.2007.70515","volume":"13","author":"JS Yi","year":"2007","unstructured":"Yi, J.S., Kang, Ya., Stasko, J., Jacko, J.: Toward a deeper understanding of the role of interaction in information visualization. IEEE Trans. Vis. Comput. Graph. 13(6), 1224\u20131231 (2007). https:\/\/doi.org\/10.1109\/TVCG.2007.70515","journal-title":"IEEE Trans. Vis. Comput. Graph."},{"issue":"3","key":"504_CR65","doi-asserted-by":"publisher","first-page":"767","DOI":"10.1111\/j.1467-8659.2009.01475.x","volume":"28","author":"DH Jeong","year":"2009","unstructured":"Jeong, D.H., Ziemkiewicz, C., Fisher, B.D., Ribarsky, W., Chang, R.: ipca: an interactive system for PCA-based visual analytics. Comput. Graph. Forum 28(3), 767\u2013774 (2009)","journal-title":"Comput. Graph. Forum"},{"key":"504_CR66","unstructured":"Hong, J., Jeong, D.H., Shaw, C.D., Ribarsky, W., Borodovsky, M., Song, C.: Gvis: A scalable visualization framework for genomic data. In: EUROVIS 2005: Proceedings of the Eurographics\/IEEE VGTC Symposium on Visualization 2005, pp. 191\u2013198 (2005)"},{"key":"504_CR67","doi-asserted-by":"publisher","unstructured":"Carpendale, S.: Evaluating Information Visualizations, pp. 19\u201345. Springer, Berlin (2008). https:\/\/doi.org\/10.1007\/978-3-540-70956-5_2","DOI":"10.1007\/978-3-540-70956-5_2"},{"key":"504_CR68","doi-asserted-by":"publisher","first-page":"271","DOI":"10.1177\/1473871611415994","volume":"10","author":"S Kandel","year":"2011","unstructured":"Kandel, S., Heer, J., Plaisant, C., Kennedy, J., van Ham, F., Riche, N.H., Weaver, C., Lee, B., Brodbeck, D., Buono, P.: Research directions in data wrangling: visualizations and transformations for usable and credible data. Inf. Vis. J. 10, 271\u2013288 (2011)","journal-title":"Inf. Vis. J."},{"key":"504_CR69","doi-asserted-by":"publisher","first-page":"2368","DOI":"10.3389\/fpsyg.2017.02368","volume":"8","author":"CR Madan","year":"2018","unstructured":"Madan, C.R., Bayer, J., Gamer, M., Lonsdorf, T.B., Sommer, T.: Visual complexity and affect: ratings reflect more than meets the eye. Front. Psychol. 8, 2368\u20132368 (2018). https:\/\/doi.org\/10.3389\/fpsyg.2017.02368","journal-title":"Front. Psychol."},{"key":"504_CR70","unstructured":"Duffy, B., Dasgupta, A., Kosara, R., Walton, S.J., Chen, M.: Measuring visual complexity of cluster-based visualizations. CoRR (2013). arXiv:1302.5824"},{"key":"504_CR71","doi-asserted-by":"publisher","unstructured":"Wang, Y., Archambault, D., Haleem, H., Moeller, T., Wu, Y., Qu, H.: Nonuniform timeslicing of dynamic graphs based on visual complexity. In: 2019 IEEE Visualization Conference (VIS), pp. 1\u20135 (2019). https:\/\/doi.org\/10.1109\/VISUAL.2019.8933748","DOI":"10.1109\/VISUAL.2019.8933748"},{"issue":"1","key":"504_CR72","doi-asserted-by":"publisher","first-page":"22","DOI":"10.1198\/106186002317375604","volume":"11","author":"SG Eick","year":"2002","unstructured":"Eick, S.G., Karr, A.F.: Visual scalability. J. Comput. Graph. Stat. 11(1), 22\u201343 (2002)","journal-title":"J. Comput. Graph. Stat."},{"key":"504_CR73","doi-asserted-by":"publisher","first-page":"135","DOI":"10.5195\/JMLA.2018.346","volume":"106","author":"N Reid","year":"2018","unstructured":"Reid, N.: Data visualization: a guide to visual storytelling for libraries. J. Med. Libr. Assoc. 106, 135 (2018). https:\/\/doi.org\/10.5195\/JMLA.2018.346","journal-title":"J. Med. Libr. Assoc."},{"issue":"1","key":"504_CR74","doi-asserted-by":"publisher","first-page":"24","DOI":"10.1109\/2945.841119","volume":"6","author":"I Herman","year":"2000","unstructured":"Herman, I., Melancon, G., Marshall, M.S.: Graph visualization and navigation in information visualization: a survey. IEEE Trans. Vis. Comput. Graph. 6(1), 24\u201343 (2000). https:\/\/doi.org\/10.1109\/2945.841119","journal-title":"IEEE Trans. Vis. Comput. Graph."},{"key":"504_CR75","volume-title":"Parallel Coordinates: Visual Multidimensional Geometry and Its Applications","author":"A Inselberg","year":"2017","unstructured":"Inselberg, A.: Parallel Coordinates: Visual Multidimensional Geometry and Its Applications, 1st edn. Springer, Berlin (2017)","edition":"1"},{"key":"504_CR76","doi-asserted-by":"publisher","unstructured":"Heinrich, J., Weiskopf, D.: State of the art of parallel coordinates. In: Sbert, M., Szirmay-Kalos, L. (eds.) Eurographics 2013-State of the Art Reports. The Eurographics Association (2013). https:\/\/doi.org\/10.2312\/conf\/EG2013\/stars\/095-116","DOI":"10.2312\/conf\/EG2013\/stars\/095-116"},{"key":"504_CR77","doi-asserted-by":"publisher","unstructured":"Komlodi, A., Rheingans, P., Goodall, J.R.: A user-centered look at glyph-based security visualization. In: IEEE Workshop on Visualization for Computer Security, 2005. (VizSEC 05), pp. 21\u201328 (2005). https:\/\/doi.org\/10.1109\/VIZSEC.2005.1532062","DOI":"10.1109\/VIZSEC.2005.1532062"},{"key":"504_CR78","doi-asserted-by":"publisher","unstructured":"Kintzel, C., Fuchs, J., Mansmann, F.: Monitoring large IP spaces with clockview. In: Proceedings of the 8th International Symposium on Visualization for Cyber Security, VizSec \u201911, pp. 2:1\u20132:10. ACM, New York (2011). https:\/\/doi.org\/10.1145\/2016904.2016906","DOI":"10.1145\/2016904.2016906"},{"key":"504_CR79","doi-asserted-by":"publisher","unstructured":"Fischer, F., Fuchs, J., Vervier, P.A., Mansmann, F., Thonnard, O.: Vistracer: A visual analytics tool to investigate routing anomalies in traceroutes. In: Proceedings of the Ninth International Symposium on Visualization for Cyber Security, VizSec \u201912, pp. 80\u201387. ACM, New York (2012). https:\/\/doi.org\/10.1145\/2379690.2379701","DOI":"10.1145\/2379690.2379701"},{"issue":"1","key":"504_CR80","doi-asserted-by":"publisher","first-page":"20","DOI":"10.1016\/j.laa.2005.07.021","volume":"415","author":"M Brand","year":"2006","unstructured":"Brand, M.: Fast low-rank modifications of the thin singular value decomposition. Linear Algebra Appl. 415(1), 20\u201330 (2006)","journal-title":"Linear Algebra Appl."},{"issue":"3","key":"504_CR81","doi-asserted-by":"publisher","first-page":"871","DOI":"10.1111\/j.1467-8659.2011.01936.x","volume":"30","author":"D Oelke","year":"2011","unstructured":"Oelke, D., Janetzko, H., Simon, S., Neuhaus, K., Keim, D.A.: Visual boosting in pixel-based visualizations. Comput. Graph. Forum 30(3), 871\u2013880 (2011). https:\/\/doi.org\/10.1111\/j.1467-8659.2011.01936.x","journal-title":"Comput. Graph. Forum"},{"key":"504_CR82","doi-asserted-by":"publisher","first-page":"27","DOI":"10.1016\/j.cag.2013.10.006","volume":"38","author":"H Janetzko","year":"2014","unstructured":"Janetzko, H., Stoffel, F., Mittelst\u00e4dt, S., Keim, D.A.: Anomaly detection for visual analytics of power consumption data. Comput. Graph. 38, 27\u201337 (2014). https:\/\/doi.org\/10.1016\/j.cag.2013.10.006","journal-title":"Comput. Graph."},{"issue":"3","key":"504_CR83","doi-asserted-by":"publisher","first-page":"439","DOI":"10.1109\/TVCG.2009.84","volume":"16","author":"N Elmqvist","year":"2010","unstructured":"Elmqvist, N., Fekete, J.D.: Hierarchical aggregation for information visualization: overview, techniques, and design guidelines. IEEE Trans. Vis. Comput. Graph. 16(3), 439\u2013454 (2010). https:\/\/doi.org\/10.1109\/TVCG.2009.84","journal-title":"IEEE Trans. Vis. Comput. Graph."},{"issue":"1178\u20135608","key":"504_CR84","doi-asserted-by":"publisher","first-page":"537","DOI":"10.21307\/ijssis-2017-883","volume":"9","author":"PR Vamsi","year":"2016","unstructured":"Vamsi, P.R., Kant, K.: Trust aware data aggregation and intrusion detection system for wireless sensor networks. Int. J. Smart Sens. Intell. Syst. 9(1178\u20135608), 537\u2013562 (2016). https:\/\/doi.org\/10.21307\/ijssis-2017-883","journal-title":"Int. J. Smart Sens. Intell. Syst."},{"issue":"4","key":"504_CR85","doi-asserted-by":"publisher","first-page":"179","DOI":"10.1504\/IJSN.2013.058152","volume":"8","author":"D Zhang","year":"2013","unstructured":"Zhang, D., Ge, L., Yu, W., Zhang, H., Hardy, R.L., Reschly, R.J.: On effective data aggregation techniques in host-based intrusion detection in manet. Int. J. Secur. Netw. 8(4), 179\u2013193 (2013). https:\/\/doi.org\/10.1504\/IJSN.2013.058152","journal-title":"Int. J. Secur. Netw."},{"key":"504_CR86","doi-asserted-by":"crossref","unstructured":"Chou, J.K., Bryan, C., Li, J., Ma, K.L.: An empirical study on perceptually masking privacy in graph visualizations. In: 15th IEEE Symposium on Visualization for Cyber Security (2018)","DOI":"10.1109\/VIZSEC.2018.8709181"},{"key":"504_CR87","first-page":"62","volume":"20","author":"W Campbell","year":"2013","unstructured":"Campbell, W., Dagli, C., Weinstein, C.: Social network analysis with content and graphs. Lincoln Lab. J. 20, 62\u201381 (2013)","journal-title":"Lincoln Lab. J."},{"key":"504_CR88","doi-asserted-by":"publisher","unstructured":"Mansmann, F., Fischer, F., Keim, D.A., North, S.C.: Visual support for analyzing network traffic and intrusion detection events using treemap and graph representations. In: Proceedings of the Symposium on Computer Human Interaction for the Management of Information Technology, CHiMiT \u201909, pp. 3:19\u20133:28. ACM, New York (2009). https:\/\/doi.org\/10.1145\/1641587.1641590","DOI":"10.1145\/1641587.1641590"},{"issue":"4","key":"504_CR89","doi-asserted-by":"publisher","first-page":"281","DOI":"10.1057\/palgrave.ivs.9500162","volume":"6","author":"A Aris","year":"2010","unstructured":"Aris, A., Shneiderman, B.: A node aggregation strategy to reduce complexity of network visualization using semantic substrates. Inf. Vis. 6(4), 281\u2013300 (2010)","journal-title":"Inf. Vis."},{"key":"504_CR90","unstructured":"Mansmann, F.: Visual analysis of network traffic\u2014interactive monitoring, detection, and interpretation of security threats. Ph.D. dissertation, University of Konstanz (2008)"},{"key":"504_CR91","doi-asserted-by":"publisher","unstructured":"Noel, S., Jacobs, M., and: Multiple coordinated views for network attack graphs. In: IEEE Workshop on Visualization for Computer Security, 2005. (VizSEC 05), pp. 99\u2013106 (2005). https:\/\/doi.org\/10.1109\/VIZSEC.2005.1532071","DOI":"10.1109\/VIZSEC.2005.1532071"},{"key":"504_CR92","doi-asserted-by":"publisher","unstructured":"Harrison, L., Hu, X., Ying, X., Lu, A., Wang, W., Wu, X.: Interactive detection of network anomalies via coordinated multiple views. In: Proceedings of the Seventh International Symposium on Visualization for Cyber Security, VizSec \u201910, pp. 91\u2013101. ACM, New York (2010). https:\/\/doi.org\/10.1145\/1850795.1850806","DOI":"10.1145\/1850795.1850806"},{"key":"504_CR93","doi-asserted-by":"publisher","unstructured":"Karapistoli, E., Sarigiannidis, P., Economides, A.A.: Srnet: a real-time, cross-based anomaly detection and visualization system for wireless sensor networks. In: Proceedings of the Tenth Workshop on Visualization for Cyber Security, VizSec \u201913, pp. 49\u201356. ACM, New York (2013). https:\/\/doi.org\/10.1145\/2517957.2517964","DOI":"10.1145\/2517957.2517964"},{"key":"504_CR94","unstructured":"Grinstein, G., Trutschl, M., Cvek, U.: High-dimensional visualizations. In: Proceedings of the Data Mining Conference (KDD) (2001)"},{"key":"504_CR95","unstructured":"Putz, W.: The hierarchical visualization system. Master\u2019s thesis, Graz University of Technology (2005)"}],"container-title":["International Journal of Information Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-020-00504-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10207-020-00504-9\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-020-00504-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,10,24]],"date-time":"2022-10-24T17:13:57Z","timestamp":1666631637000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10207-020-00504-9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,5,22]]},"references-count":95,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2021,6]]}},"alternative-id":["504"],"URL":"https:\/\/doi.org\/10.1007\/s10207-020-00504-9","relation":{},"ISSN":["1615-5262","1615-5270"],"issn-type":[{"value":"1615-5262","type":"print"},{"value":"1615-5270","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,5,22]]},"assertion":[{"value":"22 May 2020","order":1,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Compliance with ethical standards"}},{"value":"Author Soo-Yeon Ji declares that she has no conflict of interest. Author Bong-Keun Jeong declares that he has no conflict of interest. Author Dong Hyun Jeong declares that he has no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"This article does not contain any studies with human participants performed by any of the authors.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethical approval"}}]}}