{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,13]],"date-time":"2026-01-13T14:38:14Z","timestamp":1768315094998,"version":"3.49.0"},"reference-count":349,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"1","license":[{"start":{"date-parts":[[2016,1,1]],"date-time":"2016-01-01T00:00:00Z","timestamp":1451606400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Commun. Surv. Tutorials"],"published-print":{"date-parts":[[2016]]},"DOI":"10.1109\/comst.2015.2450538","type":"journal-article","created":{"date-parts":[[2015,7,24]],"date-time":"2015-07-24T18:36:14Z","timestamp":1437762974000},"page":"285-323","source":"Crossref","is-referenced-by-count":54,"title":["A Survey on Information Visualization for Network and Service Management"],"prefix":"10.1109","volume":"18","author":[{"given":"Vinicius Tavares","family":"Guimaraes","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Carla Maria Dal Sasso","family":"Freitas","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ramin","family":"Sadre","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Liane Margarida Rockenbach","family":"Tarouco","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Lisandro Zambenedetti","family":"Granville","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref275","doi-asserted-by":"publisher","DOI":"10.1145\/1179576.1179598"},{"key":"ref274","doi-asserted-by":"publisher","DOI":"10.1145\/1179576.1179578"},{"key":"ref277","doi-asserted-by":"publisher","DOI":"10.1145\/1179576.1179584"},{"key":"ref276","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijhcs.2005.04.021"},{"key":"ref271","first-page":"131","article-title":"STARMINE: A visualization system for cyber attacks","volume":"60","author":"hideshima","year":"0","journal-title":"Proc APVis Symp Inf"},{"key":"ref270","doi-asserted-by":"publisher","DOI":"10.1145\/1179576.1179583"},{"key":"ref273","doi-asserted-by":"publisher","DOI":"10.1145\/1179576.1179589"},{"key":"ref170","first-page":"305","article-title":"FlowScan: A network traffic flow reporting and visualization tool","author":"plonka","year":"0","journal-title":"Proc 14th USENIX Conf LISA"},{"key":"ref272","doi-asserted-by":"publisher","DOI":"10.1145\/1179576.1179587"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.1145\/2517957.2517960"},{"key":"ref171","doi-asserted-by":"publisher","DOI":"10.1145\/2517957.2517965"},{"key":"ref174","doi-asserted-by":"publisher","DOI":"10.1145\/2379690.2379696"},{"key":"ref173","doi-asserted-by":"publisher","DOI":"10.1145\/2517957.2517959"},{"key":"ref176","doi-asserted-by":"publisher","DOI":"10.1145\/2517957.2517963"},{"key":"ref175","doi-asserted-by":"publisher","DOI":"10.1145\/2517957.2517966"},{"key":"ref178","doi-asserted-by":"publisher","DOI":"10.1109\/WAINA.2013.185"},{"key":"ref177","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-35404-5_10"},{"key":"ref168","first-page":"159","article-title":"VisAlert: From idea to product","author":"foresti","year":"2007","journal-title":"VizSEC"},{"key":"ref169","first-page":"39","article-title":"Adapting personas for use in security visualization design","author":"stoll","year":"2007","journal-title":"VizSEC"},{"key":"ref39","doi-asserted-by":"crossref","first-page":"13","DOI":"10.1145\/330572.330576","article-title":"Large-scale network visualization","volume":"33","author":"abello","year":"0","journal-title":"ACM Comput Graph"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/38.486685"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/65.10027"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/318951.319049"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/1866029.1866049"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.7155\/jgaa.00102"},{"key":"ref267","doi-asserted-by":"publisher","DOI":"10.1007\/11875581_169"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/INFVIS.1995.528697"},{"key":"ref268","first-page":"3","article-title":"Processing data to construct practical visualizations for network security","volume":"9","author":"abdullah","year":"2006","journal-title":"Inf Assurance Newslett"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.1993.397410"},{"key":"ref269","doi-asserted-by":"publisher","DOI":"10.1145\/1179576.1179580"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/VISUAL.1990.146369"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/LCN.1989.65250"},{"key":"ref288","doi-asserted-by":"publisher","DOI":"10.1109\/IAW.2005.1495932"},{"key":"ref287","doi-asserted-by":"publisher","DOI":"10.1145\/1056808.1056927"},{"key":"ref286","first-page":"2056","article-title":"A study of analyzing network traffic as images in real-time","author":"kim","year":"0","journal-title":"Proc IEEE InfoCom"},{"key":"ref285","first-page":"18","article-title":"NetViewer: A network traffic visualization and analysis tool","volume":"19","author":"kim","year":"0","journal-title":"Proc 19th Conf LISA"},{"key":"ref284","doi-asserted-by":"publisher","DOI":"10.1145\/1179576.1179582"},{"key":"ref181","doi-asserted-by":"publisher","DOI":"10.1109\/ComComAp.2013.6533610"},{"key":"ref283","doi-asserted-by":"publisher","DOI":"10.1145\/1179576.1179596"},{"key":"ref180","doi-asserted-by":"publisher","DOI":"10.1117\/12.2013675"},{"key":"ref282","doi-asserted-by":"publisher","DOI":"10.1007\/1-4020-8143-X_17"},{"key":"ref281","doi-asserted-by":"publisher","DOI":"10.1109\/IV.2005.67"},{"key":"ref280","doi-asserted-by":"publisher","DOI":"10.1145\/1179576.1179579"},{"key":"ref185","doi-asserted-by":"crossref","first-page":"67","DOI":"10.1109\/CC.2013.6488831","article-title":"Visualization framework for inter-domain access control policy integration","volume":"10","author":"li","year":"2013","journal-title":"Chinese Journal of Communication"},{"key":"ref184","doi-asserted-by":"publisher","DOI":"10.1145\/2517957.2517958"},{"key":"ref183","first-page":"1","article-title":"Traffic flow optimization and visualization in MPLS networks","volume":"2","author":"hruby","year":"0","journal-title":"Proc World Congr Eng"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.1080\/01969722.2013.803903"},{"key":"ref189","first-page":"1008","article-title":"Intelligent network management using graph differential anomaly visualization","author":"liao","year":"0","journal-title":"Proc IEEE NOMS"},{"key":"ref188","doi-asserted-by":"publisher","DOI":"10.1145\/2016904.2016910"},{"key":"ref187","doi-asserted-by":"crossref","first-page":"165","DOI":"10.1108\/IJWIS-12-2012-0036","article-title":"Visualization of web form submissions for security analysis","volume":"9","author":"dang","year":"0","journal-title":"Int J Web Inf Syst"},{"key":"ref186","first-page":"2741","article-title":"Visualization of abnormal behavior detection using parallel coordinate and correspondence analysis","volume":"15","author":"cho","year":"2012","journal-title":"Int J Inf"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/2.755008"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/2379690.2379692"},{"key":"ref179","doi-asserted-by":"publisher","DOI":"10.1007\/s00607-013-0282-8"},{"key":"ref29","article-title":"A visual technique for internet anomaly detection","author":"teoh","year":"0","journal-title":"Proc Int Conf IASTED"},{"key":"ref348","doi-asserted-by":"publisher","DOI":"10.1145\/331770.331785"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/2379690.2379702"},{"key":"ref349","doi-asserted-by":"publisher","DOI":"10.1109\/TST.2013.6509102"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/VIZSEC.2009.5375543"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/ECTICon.2012.6254335"},{"key":"ref344","doi-asserted-by":"publisher","DOI":"10.1145\/2484417.2484421"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/1821748.1821834"},{"key":"ref345","doi-asserted-by":"publisher","DOI":"10.1109\/LCN.2012.6423586"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/NBiS.2012.23"},{"key":"ref346","doi-asserted-by":"publisher","DOI":"10.1109\/PDP.2013.84"},{"key":"ref278","doi-asserted-by":"publisher","DOI":"10.1145\/1179576.1179592"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/NBiS.2013.29"},{"key":"ref347","doi-asserted-by":"publisher","DOI":"10.1145\/2016904.2016909"},{"key":"ref279","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2005.57"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/WAINA.2011.30"},{"key":"ref293","doi-asserted-by":"publisher","DOI":"10.1109\/IAW.2005.1495979"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/INFVIS.1996.559226"},{"key":"ref292","first-page":"29","article-title":"A visualization methodology for characterization of network scans","author":"muelder","year":"0","journal-title":"Proc IEEE Workshop VizSEC"},{"key":"ref51","first-page":"141","article-title":"MRTG: The multi router traffic grapher","author":"oetiker","year":"0","journal-title":"Proc LISA"},{"key":"ref295","first-page":"121","article-title":"Designing visualization capabilities for IDS challenges","author":"erbacher","year":"0","journal-title":"Proc IEEE Workshop VizSEC"},{"key":"ref294","first-page":"11","article-title":"Visual correlation of host processes and network traffic","author":"fink","year":"0","journal-title":"Proc IEEE Workshop VizSEC"},{"key":"ref297","first-page":"83","article-title":"Visual exploration of malicious network objects using semantic zoom, interactive encoding and dynamic queries","author":"conti","year":"0","journal-title":"Proc IEEE Workshop VizSEC"},{"key":"ref296","first-page":"113","article-title":"Exploring three-dimensional visualization for intrusion detection","author":"oline","year":"0","journal-title":"Proc IEEE Workshop VizSEC"},{"key":"ref299","doi-asserted-by":"publisher","DOI":"10.1109\/VIZSEC.2005.1532075"},{"key":"ref298","first-page":"5","article-title":"IDGraphs: Intrusion detection and analysis using histographs","author":"ren","year":"0","journal-title":"Proc VizSEC"},{"key":"ref154","doi-asserted-by":"publisher","DOI":"10.1145\/1168149.1168168"},{"key":"ref153","doi-asserted-by":"publisher","DOI":"10.1006\/jvlc.1993.1015"},{"key":"ref156","doi-asserted-by":"publisher","DOI":"10.1109\/2945.981847"},{"key":"ref155","doi-asserted-by":"publisher","DOI":"10.1109\/INFVIS.2000.885092"},{"key":"ref150","author":"marty","year":"2008","journal-title":"Applied Security Visualization"},{"key":"ref291","doi-asserted-by":"publisher","DOI":"10.1007\/11556992_2"},{"key":"ref152","year":"2013","journal-title":"Network and Services Management Taxonomy"},{"key":"ref290","first-page":"21","article-title":"A user-centered look at glyph-based security visualization","author":"komlodi","year":"0","journal-title":"Proc IEEE Workshop VizSEC"},{"key":"ref151","doi-asserted-by":"publisher","DOI":"10.1007\/s10922-010-9161-1"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.1145\/2517957.2517962"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.1177\/1473871613488572"},{"key":"ref148","first-page":"257","article-title":"BANKSAFE: A visual situational awareness tool for large-scale computer networks","author":"fischer","year":"0","journal-title":"Proc IEEE Conf VAST"},{"key":"ref149","author":"gort","year":"2007","journal-title":"Survey of network visualization tools"},{"key":"ref289","first-page":"55","article-title":"Root polar layout of Internet address data for security administration","author":"fink","year":"0","journal-title":"Proc IEEE Workshop VizSEC"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/VAST.2006.261436"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2006.108"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1002\/nem.511"},{"key":"ref56","first-page":"505","article-title":"Case study: Interactive visualization for Internet security","author":"teoh","year":"0","journal-title":"Proc Vis"},{"key":"ref55","first-page":"1","article-title":"Mapping and visualizing the Internet","author":"cheswick","year":"0","journal-title":"Proc USENIX Annu Tech Conf"},{"key":"ref54","first-page":"19","article-title":"An eye on network intruder-administrator shootouts","author":"girardin","year":"0","journal-title":"Proc Workshop on Intrusion Detection and Network Monitoring Proceedings"},{"key":"ref53","first-page":"299","article-title":"A visual approach for monitoring logs","author":"girardin","year":"0","journal-title":"Proc 12th LISA Conf"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/38.708554"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/VISUAL.1999.809930"},{"key":"ref167","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4614-7485-2_12"},{"key":"ref166","year":"2014","journal-title":"Software-Defined Networking (SDN) Definition"},{"key":"ref165","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2014.012214.00180"},{"key":"ref164","doi-asserted-by":"publisher","DOI":"10.1007\/s13174-010-0007-6"},{"key":"ref163","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2008.12.001"},{"key":"ref162","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2014.2332453"},{"key":"ref161","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2010.05.010"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2013.01.010"},{"key":"ref4","year":"2004","journal-title":"Visualization for Cyber Security (VizSec)"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2007.4342832"},{"key":"ref6","author":"keele","year":"2007","journal-title":"Guidelines for Performing Systematic Literature Reviews in Software Engineering"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2011.144"},{"key":"ref8","year":"1992"},{"key":"ref159","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2013.042313.00197"},{"key":"ref7","year":"1989"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/65.620520"},{"key":"ref157","doi-asserted-by":"crossref","DOI":"10.1201\/b17511","author":"munzner","year":"2014","journal-title":"Visualization Analysis and Design"},{"key":"ref9","author":"pras","year":"1995","journal-title":"Network Management Architectures"},{"key":"ref158","year":"2014","journal-title":"Gartner's hype cycle special report for 2014"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/VRAIS.1993.380798"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/HPDC.1993.263829"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1016\/0169-7552(96)00055-4"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS.1994.643479"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/144191.144303"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/38.761543"},{"key":"ref44","first-page":"725","article-title":"Supporting network management through declaratively specified data visualizations","author":"consens","year":"0","journal-title":"Proc IEEE\/IFIP Int Symp Integr Netw Manage"},{"key":"ref43","first-page":"450","article-title":"Using Hy+ for network management and distributed debugging","volume":"1","author":"consens","year":"0","journal-title":"Proc Conf CASCON Collab Res —Softw Eng"},{"key":"ref320","doi-asserted-by":"publisher","DOI":"10.1109\/INM.2011.5990667"},{"key":"ref321","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-85933-8_3"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/38.974517"},{"key":"ref72","first-page":"153","article-title":"Visualising Internet traffic data with three-dimensional spherical display","volume":"45","author":"yip","year":"0","journal-title":"Proc APVis Symp Inf"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1016\/S1389-1286(03)00287-1"},{"key":"ref70","first-page":"33","article-title":"Network performance visualization: Insight through animation","author":"brown","year":"0","journal-title":"Proc Passive Active Meas Workshop"},{"key":"ref318","first-page":"550","article-title":"A framework to leverage domain expertise to support novice users in the visual exploration of home area networks","author":"song","year":"0","journal-title":"Proc IEEE NOMS"},{"key":"ref76","first-page":"55","article-title":"Visual behavior characterization for intrusion detection in large scale systems","author":"erbacher","year":"0","journal-title":"Proc IASTED Vis Imag Image Process Conf"},{"key":"ref317","doi-asserted-by":"publisher","DOI":"10.1145\/948449.948452"},{"key":"ref77","first-page":"153","article-title":"Visual traffic monitoring and evaluation","author":"erbacher","year":"0","journal-title":"Proc Conf Internet Perform Control Netw Syst II"},{"key":"ref316","first-page":"473","article-title":"Techniques for automated network map generation using SNMP","volume":"2","author":"mansfield","year":"0","journal-title":"Proc 15th IEEE INFOCOM"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/ICSMC.2003.1244260"},{"key":"ref315","first-page":"51","article-title":"Supporting intrusion detection by graph clustering and graph drawing","author":"tolle","year":"0","journal-title":"Proc 3rd Int Workshop RAID"},{"key":"ref75","first-page":"228","article-title":"Glyph-based generic network visualization","author":"erbacher","year":"0","journal-title":"Proc SPIE Conf Vis Data Anal"},{"key":"ref314","first-page":"111","article-title":"Visualisation for intrusion detection—Hooking the worm","author":"axelsson","year":"0","journal-title":"Proc 8th ESORICS"},{"key":"ref313","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-7091-6215-6_30"},{"key":"ref312","doi-asserted-by":"publisher","DOI":"10.1145\/990680.990699"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/IV.2000.859771"},{"key":"ref311","doi-asserted-by":"publisher","DOI":"10.1145\/1029208.1029232"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1145\/1029208.1029214"},{"key":"ref319","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS.2012.6211998"},{"key":"ref310","doi-asserted-by":"publisher","DOI":"10.1145\/1029208.1029227"},{"key":"ref60","first-page":"144","article-title":"NetFlow data visualization based on graphs","author":"minarik","year":"0","journal-title":"Proc 5th Int Workshop VizSec"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/LCN.2001.990769"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/VISUAL.2001.964541"},{"key":"ref305","doi-asserted-by":"publisher","DOI":"10.1109\/MCG.2004.26"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2003.1201471"},{"key":"ref304","doi-asserted-by":"publisher","DOI":"10.1145\/1029208.1029223"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/INM.2007.374797"},{"key":"ref307","doi-asserted-by":"publisher","DOI":"10.1145\/1029208.1029216"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS.2008.4575239"},{"key":"ref306","doi-asserted-by":"publisher","DOI":"10.1145\/1029208.1029217"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/ISCC.2008.4625672"},{"key":"ref301","doi-asserted-by":"publisher","DOI":"10.1109\/IAW.2005.1495940"},{"key":"ref67","first-page":"19","article-title":"Interactive network management visualization with SVG and AJAX","author":"douitsis","year":"0","journal-title":"Proc 20th LISA"},{"key":"ref300","first-page":"65","article-title":"Visualization of automated trust negotiation","author":"yao","year":"0","journal-title":"Proc IEEE Workshop VizSEC"},{"key":"ref68","first-page":"292","article-title":"Mesh topology viewer (MTV): An SVG-based interactive mesh network topology visualization tool","author":"de t valle","year":"0","journal-title":"Proc IEEE ISCC"},{"key":"ref303","doi-asserted-by":"publisher","DOI":"10.1145\/1029208.1029215"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/2.881696"},{"key":"ref302","first-page":"167","article-title":"A novel visualization technique for network anomaly detection","author":"onut","year":"0","journal-title":"Proc PST"},{"key":"ref309","doi-asserted-by":"publisher","DOI":"10.1145\/1029208.1029228"},{"key":"ref308","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2004.1337733"},{"key":"ref197","doi-asserted-by":"publisher","DOI":"10.1145\/2379690.2379693"},{"key":"ref198","doi-asserted-by":"publisher","DOI":"10.1109\/IMCCC.2011.99"},{"key":"ref199","doi-asserted-by":"publisher","DOI":"10.1109\/IV.2011.41"},{"key":"ref193","first-page":"665","article-title":"The study on network topology discovery algorithm based on SNMP protocol and ICMP protocol","author":"yan","year":"0","journal-title":"Proc IEEE 3rd ICSESS"},{"key":"ref194","doi-asserted-by":"publisher","DOI":"10.1145\/2379690.2379701"},{"key":"ref195","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-21793-7_30"},{"key":"ref196","doi-asserted-by":"publisher","DOI":"10.1145\/2379690.2379699"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1145\/1377836.1377863"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/VAST.2007.4389007"},{"key":"ref190","doi-asserted-by":"publisher","DOI":"10.1109\/INM.2011.5990663"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-85933-8_5"},{"key":"ref191","first-page":"440","article-title":"Data visualization technique framework for intrusion detection","volume":"8","author":"riad","year":"2011","journal-title":"Int J Comput Sci Issues"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78243-8_15"},{"key":"ref192","doi-asserted-by":"publisher","DOI":"10.1007\/s11042-013-1673-8"},{"key":"ref342","doi-asserted-by":"publisher","DOI":"10.1145\/2517957.2517961"},{"key":"ref91","first-page":"60","article-title":"A graph-theoretic visualization approach to network risk analysis","author":"o'hare","year":"0","journal-title":"Proc VizSEC"},{"key":"ref343","doi-asserted-by":"publisher","DOI":"10.1109\/65.885665"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1145\/1029208.1029225"},{"key":"ref340","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2012.255"},{"key":"ref341","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCSW.2012.87"},{"key":"ref336","doi-asserted-by":"publisher","DOI":"10.1145\/1179576.1179585"},{"key":"ref335","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-85933-8_13"},{"key":"ref334","doi-asserted-by":"publisher","DOI":"10.1145\/1850795.1850806"},{"key":"ref333","first-page":"1","article-title":"An ontology-driven approach to support wireless network monitoring for home area networks","author":"song","year":"0","journal-title":"Proc 7th Int CNSM"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1145\/1029208.1029220"},{"key":"ref339","year":"2008","journal-title":"Using Visualization to Support Network and Application Management in a Data Center"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1007\/11663812_14"},{"key":"ref338","doi-asserted-by":"publisher","DOI":"10.1145\/2379690.2379698"},{"key":"ref96","first-page":"133","article-title":"MieLog: A highly interactive visual log browser using information visualization and statistical analysis","year":"0","journal-title":"Proc 16th USENIX Conf LISA"},{"key":"ref337","doi-asserted-by":"publisher","DOI":"10.1109\/VETECS.2004.1391396"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/IV.2002.1028831"},{"key":"ref82","first-page":"67","article-title":"Visual problem-solving support for new event triage in centralized network security monitoring: Challenges, tools and benefits","volume":"39","author":"stolze","year":"2003","journal-title":"Proceedings of the IMF"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/HAPTIC.2002.998969"},{"key":"ref84","first-page":"1","article-title":"Two visual computer network security monitoring tools incorporating operator interface requirements","author":"yurcik","year":"0","journal-title":"Proc ACM CHI Workshop HCISEC Syst"},{"key":"ref83","first-page":"1","article-title":"IDS RainStorm: Visualizing IDS alarms","author":"abdullah","year":"0","journal-title":"Proc IEEE Workshop VizSEC"},{"key":"ref330","doi-asserted-by":"publisher","DOI":"10.1145\/2517957.2517964"},{"key":"ref331","doi-asserted-by":"publisher","DOI":"10.1145\/1877972.1877992"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1145\/1029208.1029219"},{"key":"ref332","doi-asserted-by":"publisher","DOI":"10.1109\/CNSM.2010.5691252"},{"key":"ref323","doi-asserted-by":"publisher","DOI":"10.1145\/331770.331787"},{"key":"ref89","first-page":"99","article-title":"Multiple coordinated views for network attack graphs","author":"noel","year":"0","journal-title":"Proc IEEE Workshop VizSEC"},{"key":"ref322","doi-asserted-by":"crossref","first-page":"312","DOI":"10.1117\/12.378908","article-title":"Automatic construction of dynamic 3D metaphoric worlds: An application to network management","volume":"3960","author":"abel","year":"0","journal-title":"Proc SPIE Visual Data Analysis and Exploration"},{"key":"ref325","doi-asserted-by":"publisher","DOI":"10.1109\/VAST.2006.261438"},{"key":"ref324","doi-asserted-by":"publisher","DOI":"10.1145\/1080173.1080182"},{"key":"ref327","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-85933-8_15"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2003.1290234"},{"key":"ref326","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78243-8_5"},{"key":"ref86","first-page":"67","article-title":"A prototype tool for visual data mining of network traffic for intrusion detection","author":"yurcik","year":"0","journal-title":"Proc ICDM Workshop DMSEC"},{"key":"ref329","doi-asserted-by":"publisher","DOI":"10.1145\/2451716.2451720"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-85933-8_11"},{"key":"ref328","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-01604-7_37"},{"key":"ref88","first-page":"85","article-title":"Visual analysis of network flow data with timelines and event plots","author":"phan","year":"2007","journal-title":"VizSEC"},{"key":"ref200","doi-asserted-by":"publisher","DOI":"10.1016\/j.jvlc.2011.07.002"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/MCG.2006.31"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/VIZSEC.2005.1532065"},{"key":"ref209","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-009-0127-3"},{"key":"ref203","first-page":"15","article-title":"A typical behavior identification in large-scale network traffic","author":"best","year":"0","journal-title":"Proc IEEE Symp LDAV"},{"key":"ref204","doi-asserted-by":"publisher","DOI":"10.1109\/CNSR.2011.17"},{"key":"ref201","doi-asserted-by":"publisher","DOI":"10.1109\/SAINT.2011.79"},{"key":"ref202","doi-asserted-by":"publisher","DOI":"10.1109\/HICSS.2011.488"},{"key":"ref207","doi-asserted-by":"publisher","DOI":"10.1109\/APVIS.2007.329273"},{"key":"ref208","doi-asserted-by":"publisher","DOI":"10.1109\/SocialCom.2010.120"},{"key":"ref205","doi-asserted-by":"publisher","DOI":"10.1109\/ICCAIE.2011.6162171"},{"key":"ref206","doi-asserted-by":"publisher","DOI":"10.1016\/j.jvlc.2010.05.002"},{"key":"ref211","doi-asserted-by":"publisher","DOI":"10.1109\/PST.2010.5593242"},{"key":"ref210","doi-asserted-by":"publisher","DOI":"10.1145\/1850795.1850804"},{"key":"ref212","doi-asserted-by":"publisher","DOI":"10.1145\/1823854.1823872"},{"key":"ref213","doi-asserted-by":"publisher","DOI":"10.1145\/1850795.1850798"},{"key":"ref214","doi-asserted-by":"publisher","DOI":"10.1145\/1850795.1850796"},{"key":"ref215","doi-asserted-by":"publisher","DOI":"10.1109\/NETAPPS.2010.45"},{"key":"ref216","doi-asserted-by":"publisher","DOI":"10.1109\/CICSyN.2010.64"},{"key":"ref217","doi-asserted-by":"publisher","DOI":"10.1145\/1850795.1850802"},{"key":"ref218","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-17650-0_31"},{"key":"ref219","first-page":"v6-437","article-title":"Intelligent expertise classification approach: An innovative artificial intelligence approach to accelerate network data visualization","volume":"6","author":"wong","year":"0","journal-title":"Proc 3rd ICACTE"},{"key":"ref220","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-01970-8_44"},{"key":"ref222","doi-asserted-by":"publisher","DOI":"10.1109\/ICACTE.2010.5579362"},{"key":"ref221","first-page":"18","article-title":"NetVis: A network security management visualization tool based on treemap","volume":"4","author":"kan","year":"0","journal-title":"Proc 2nd ICACC"},{"key":"ref229","doi-asserted-by":"publisher","DOI":"10.1145\/1930286.1930289"},{"key":"ref228","doi-asserted-by":"publisher","DOI":"10.1109\/VIZSEC.2009.5375536"},{"key":"ref227","doi-asserted-by":"publisher","DOI":"10.1145\/1850795.1850797"},{"key":"ref226","doi-asserted-by":"publisher","DOI":"10.1145\/1850795.1850801"},{"key":"ref225","doi-asserted-by":"publisher","DOI":"10.1145\/1850795.1850807"},{"key":"ref224","doi-asserted-by":"publisher","DOI":"10.1109\/NSWCTC.2009.353"},{"key":"ref223","doi-asserted-by":"publisher","DOI":"10.1109\/ICFN.2010.85"},{"key":"ref127","first-page":"1","article-title":"Method for visualizing information from large-scale carrier networks","author":"tateishi","year":"0","journal-title":"Proc 15th APNOMS"},{"key":"ref126","first-page":"1","article-title":"Design and implementation of a network management system for service oriented network","author":"kim","year":"0","journal-title":"Proc WTC"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2012.6375892"},{"key":"ref124","first-page":"1","article-title":"Control and visualization system for managed self-organization network","author":"kamamura","year":"0","journal-title":"Proc 7th Int CNSM"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2008.12.033"},{"key":"ref128","first-page":"160","article-title":"Static validation of network device configurations in virtualized multi-tenant datacenters","author":"himura","year":"0","journal-title":"Proc IFIP\/IEEE Int Symp IM"},{"key":"ref130","doi-asserted-by":"publisher","DOI":"10.1145\/1641587.1641590"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2010.2041808"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.1109\/CATCH.2009.18"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2008.12.003"},{"key":"ref132","first-page":"454","article-title":"PCAV: Internet attack visualization on parallel coordinates","author":"choi","year":"0","journal-title":"Proc 7th ICICS"},{"key":"ref232","first-page":"111","article-title":"Secvizer: A security visualization tool for qualnet-generated traffic traces","author":"abuaitah","year":"0","journal-title":"Proc VisSec"},{"key":"ref233","doi-asserted-by":"publisher","DOI":"10.1109\/THS.2009.5168026"},{"key":"ref230","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-03552-4_15"},{"key":"ref231","doi-asserted-by":"publisher","DOI":"10.1109\/VIZSEC.2009.5375538"},{"key":"ref239","doi-asserted-by":"publisher","DOI":"10.1109\/SecTech.2008.47"},{"key":"ref238","doi-asserted-by":"publisher","DOI":"10.1109\/VIZSEC.2009.5375546"},{"key":"ref235","first-page":"237","article-title":"Intelligent classification and visualization of network scans","author":"muelder","year":"2007","journal-title":"VizSEC"},{"key":"ref234","doi-asserted-by":"publisher","DOI":"10.1109\/SC.2006.25"},{"key":"ref237","first-page":"1","article-title":"Visualization of network security traffic using hexagonal self-organizing maps","author":"langin","year":"0","journal-title":"Proc 22nd Int Conf CAINE"},{"key":"ref236","doi-asserted-by":"publisher","DOI":"10.1109\/VIZSEC.2009.5375527"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1145\/2016904.2016905"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1145\/2016904.2016906"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1145\/1357054.1357286"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1145\/1850795.1850805"},{"key":"ref139","doi-asserted-by":"crossref","first-page":"32","DOI":"10.1057\/ivs.2010.1","article-title":"Sybil attack detection through global topology pattern visualization","volume":"10","author":"lu","year":"2011","journal-title":"Inf Vis"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1145\/2397696.2397698"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1007\/s11432-013-4891-9"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.1145\/2379690.2379691"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.1145\/2379690.2379700"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/2945.468391"},{"key":"ref144","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2013.6654828"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.17487\/rfc3411"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1145\/2379690.2379694"},{"key":"ref241","first-page":"95","article-title":"BGPeep: An IP-space centered view for Internet routing data","volume":"5210","author":"shearer","year":"2008","journal-title":"VizSEC"},{"key":"ref242","first-page":"161","article-title":"Existence plots: A low-resolution time series for port behavior analysis","volume":"5210","author":"janies","year":"2008","journal-title":"VizSEC"},{"key":"ref243","doi-asserted-by":"publisher","DOI":"10.1145\/1268517.1268554"},{"key":"ref244","first-page":"68","article-title":"Improving attack graph visualization through data reduction and attack grouping","author":"homer","year":"0","journal-title":"Proc 5th Int Workshop VizSec"},{"key":"ref240","doi-asserted-by":"publisher","DOI":"10.1109\/ICIS.2008.42"},{"key":"ref248","first-page":"181","article-title":"Network traffic exploration application: A tool to assess, visualize, and analyze network security events","author":"vandenberghe","year":"0","journal-title":"Proc 5th Int Workshop VizSec"},{"key":"ref247","first-page":"255","article-title":"Using InetVis to evaluate Snort and Bro scan detection on a network telescope","author":"irwin","year":"2007","journal-title":"VizSEC"},{"key":"ref246","first-page":"461","article-title":"Modeling of network situation awareness","author":"wang","year":"0","journal-title":"Proc ICCCAS"},{"key":"ref245","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2008.16"},{"key":"ref249","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-85933-8_17"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2010.I9P0315"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-02627-0_12"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/INM.2009.5188876"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1057\/palgrave.ivs.9500144"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2007.70522"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2005.1605672"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/IAW.2005.1495939"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/MCG.2006.49"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.4108\/icst.simutools.2012.247758"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1109\/ICCA.2013.6564842"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-33191-6_69"},{"key":"ref250","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-85933-8_12"},{"key":"ref251","first-page":"147","article-title":"High level Internet scale traffic visualization using Hilbert curve mapping","author":"irwin","year":"2007","journal-title":"VizSEC"},{"key":"ref254","doi-asserted-by":"publisher","DOI":"10.1109\/MCG.2006.30"},{"key":"ref255","first-page":"101","article-title":"NetBytes Viewer: An entity-based NetFlow visualization utility for identifying intrusive behavior","author":"taylor","year":"2007","journal-title":"VizSEC"},{"key":"ref252","doi-asserted-by":"publisher","DOI":"10.1145\/1179576.1179593"},{"key":"ref253","doi-asserted-by":"publisher","DOI":"10.1109\/E2EMON.2007.375319"},{"key":"ref257","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS.2006.1687547"},{"key":"ref256","first-page":"203","article-title":"Putting security in context: Visual correlation of network activity with real-world information","author":"pike","year":"2007","journal-title":"VizSEC"},{"key":"ref259","first-page":"261","article-title":"Grid based network address space browsing for network traffic visualization","author":"le","year":"0","journal-title":"Proc IEEE Inf Assurance Workshop"},{"key":"ref10","author":"clemm","year":"2006","journal-title":"Network Management Fundamentals"},{"key":"ref258","doi-asserted-by":"publisher","DOI":"10.1145\/1179576.1179597"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/VL.1996.545307"},{"key":"ref12","author":"card","year":"1999","journal-title":"Readings in Information Visualization Using Vision To Think"},{"key":"ref13","doi-asserted-by":"crossref","DOI":"10.1201\/b10683","author":"ward","year":"2010","journal-title":"Interactive Data Visualization Foundations Techniques and Applications"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/INFVIS.2004.59"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2010.07.002"},{"key":"ref16","article-title":"Information management-topic maps visualization","author":"le grand","year":"0"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1109\/ICCMS.2010.194"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/MCG.2006.34"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879202"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1093\/jopart\/mum015"},{"key":"ref19","first-page":"91","article-title":"Visualizing cyber attacks using IP matrix","author":"koike","year":"0","journal-title":"Proc IEEE Workshop VizSEC"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2010.07.015"},{"key":"ref114","first-page":"80","article-title":"Mesh net viewer: A visualization system for wireless mesh networks","author":"kumata","year":"0","journal-title":"Proc 8th Int Conf BWCCA"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1109\/GLOCOM.2010.5683876"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1109\/INM.2011.5990494"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-30376-0_31"},{"key":"ref120","first-page":"59","article-title":"ENAVis: Enterprise network activities visualization","author":"liao","year":"0","journal-title":"Proc LISA"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1145\/1850795.1850799"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS.2010.5488438"},{"key":"ref123","first-page":"1","article-title":"A web-based what-if scenario analysis tool for performance improvement of IT support organizations","author":"bartolini","year":"0","journal-title":"Proc 7th Int CNSM"},{"key":"ref260","first-page":"726","article-title":"Visualising communication network security attacks","author":"musa","year":"0","journal-title":"Information Visualization 2007 IV '07 11th International Conference"},{"key":"ref261","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2006.98"},{"key":"ref262","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78243-8_13"},{"key":"ref263","first-page":"131","article-title":"Visualizing network security events using compound glyphs from a service-oriented perspective","author":"pearlman","year":"2007","journal-title":"VizSEC"},{"key":"ref264","first-page":"123","article-title":"Interactively combining 2d and 3D visualization for network traffic monitoring","author":"le","year":"0","journal-title":"Proc 3rd Int Workshop VizSEC"},{"key":"ref265","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLC.2007.4370490"},{"key":"ref266","doi-asserted-by":"publisher","DOI":"10.1109\/VAST.2006.261437"}],"container-title":["IEEE Communications Surveys & Tutorials"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9739\/7393921\/7166305.pdf?arnumber=7166305","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,1,12]],"date-time":"2022-01-12T16:47:39Z","timestamp":1642006059000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/7166305\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016]]},"references-count":349,"journal-issue":{"issue":"1"},"URL":"https:\/\/doi.org\/10.1109\/comst.2015.2450538","relation":{},"ISSN":["1553-877X"],"issn-type":[{"value":"1553-877X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2016]]}}}