Comparative Evaluation of Node-Link and Sankey Diagrams for the Cyber Security Domain

Rotem Blinder; Ofer Biller; Adir Even; Oded Sofer; Noam Tractinsky; Joel Lanir; Peter Bak

doi:10.1007/978-3-030-29381-9_31

Comparative Evaluation of Node-Link and Sankey Diagrams for the Cyber Security Domain

Rotem Blinder, Ofer Biller, Adir Even, Oded Sofer, Noam Tractinsky, Joel Lanir, Peter Bak

Department of Information Systems

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

Visualization tools are critical components of cyber security systems allowing analyzers to better understand, detect and prevent security breaches. Security administrators need to understand which users accessed the database and what operations were performed in order to detect irregularities. The current work compares the Sankey diagram with the more commonly used node-link diagram as an alternative visualization technique for cyber security tasks in a controlled experiment. The results indicate, that the Sankey tool showed a consistent advantage in task completion time and was more effective (measured by the percent of correct answers) in synoptic tasks, while the Node-link diagram was more effective in basic, elementary tasks. Further results revealed that performance had only a small effect on user satisfaction and preferences. Our results suggest that the Sankey tool may be a viable option for cyber security visualization tools and strengthens the need to provide personalized visualization tools based on user preferences.

Original language	English
Title of host publication	Human-Computer Interaction – INTERACT 2019 - 17th IFIP TC 13 International Conference, Proceedings
Editors	David Lamas, Fernando Loizides, Lennart Nacke, Helen Petrie, Marco Winckler, Panayiotis Zaphiris
Publisher	Springer Verlag
Pages	497-518
Number of pages	22
ISBN (Print)	9783030293802
DOIs	https://doi.org/10.1007/978-3-030-29381-9_31
State	Published - 2019
Event	17th IFIP TC13 International Conference on Human-Computer Interaction, INTERACT 2019 - Paphos, Cyprus Duration: 2 Sep 2019 → 6 Sep 2019

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	11746 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	17th IFIP TC13 International Conference on Human-Computer Interaction, INTERACT 2019
Country/Territory	Cyprus
City	Paphos
Period	2/09/19 → 6/09/19

Bibliographical note

Publisher Copyright:
© IFIP International Federation for Information Processing 2019.

Keywords

Cyber security
Sankey diagram
Visualization

ASJC Scopus subject areas

Theoretical Computer Science
General Computer Science

Access to Document

10.1007/978-3-030-29381-9_31

Cite this

Blinder, R., Biller, O., Even, A., Sofer, O., Tractinsky, N., Lanir, J., & Bak, P. (2019). Comparative Evaluation of Node-Link and Sankey Diagrams for the Cyber Security Domain. In D. Lamas, F. Loizides, L. Nacke, H. Petrie, M. Winckler, & P. Zaphiris (Eds.), Human-Computer Interaction – INTERACT 2019 - 17th IFIP TC 13 International Conference, Proceedings (pp. 497-518). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 11746 LNCS). Springer Verlag. https://doi.org/10.1007/978-3-030-29381-9_31

Blinder, Rotem ; Biller, Ofer ; Even, Adir et al. / Comparative Evaluation of Node-Link and Sankey Diagrams for the Cyber Security Domain. Human-Computer Interaction – INTERACT 2019 - 17th IFIP TC 13 International Conference, Proceedings. editor / David Lamas ; Fernando Loizides ; Lennart Nacke ; Helen Petrie ; Marco Winckler ; Panayiotis Zaphiris. Springer Verlag, 2019. pp. 497-518 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{4267e63f42634bc6bc7b136c95327c4c,

title = "Comparative Evaluation of Node-Link and Sankey Diagrams for the Cyber Security Domain",

abstract = "Visualization tools are critical components of cyber security systems allowing analyzers to better understand, detect and prevent security breaches. Security administrators need to understand which users accessed the database and what operations were performed in order to detect irregularities. The current work compares the Sankey diagram with the more commonly used node-link diagram as an alternative visualization technique for cyber security tasks in a controlled experiment. The results indicate, that the Sankey tool showed a consistent advantage in task completion time and was more effective (measured by the percent of correct answers) in synoptic tasks, while the Node-link diagram was more effective in basic, elementary tasks. Further results revealed that performance had only a small effect on user satisfaction and preferences. Our results suggest that the Sankey tool may be a viable option for cyber security visualization tools and strengthens the need to provide personalized visualization tools based on user preferences.",

keywords = "Cyber security, Sankey diagram, Visualization",

author = "Rotem Blinder and Ofer Biller and Adir Even and Oded Sofer and Noam Tractinsky and Joel Lanir and Peter Bak",

note = "Publisher Copyright: {\textcopyright} IFIP International Federation for Information Processing 2019.; 17th IFIP TC13 International Conference on Human-Computer Interaction, INTERACT 2019 ; Conference date: 02-09-2019 Through 06-09-2019",

year = "2019",

doi = "10.1007/978-3-030-29381-9_31",

language = "English",

isbn = "9783030293802",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Verlag",

pages = "497--518",

editor = "David Lamas and Fernando Loizides and Lennart Nacke and Helen Petrie and Marco Winckler and Panayiotis Zaphiris",

booktitle = "Human-Computer Interaction – INTERACT 2019 - 17th IFIP TC 13 International Conference, Proceedings",

address = "Germany",

}

Blinder, R, Biller, O, Even, A, Sofer, O, Tractinsky, N, Lanir, J & Bak, P 2019, Comparative Evaluation of Node-Link and Sankey Diagrams for the Cyber Security Domain. in D Lamas, F Loizides, L Nacke, H Petrie, M Winckler & P Zaphiris (eds), Human-Computer Interaction – INTERACT 2019 - 17th IFIP TC 13 International Conference, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 11746 LNCS, Springer Verlag, pp. 497-518, 17th IFIP TC13 International Conference on Human-Computer Interaction, INTERACT 2019, Paphos, Cyprus, 2/09/19. https://doi.org/10.1007/978-3-030-29381-9_31

Comparative Evaluation of Node-Link and Sankey Diagrams for the Cyber Security Domain. / Blinder, Rotem; Biller, Ofer; Even, Adir et al.
Human-Computer Interaction – INTERACT 2019 - 17th IFIP TC 13 International Conference, Proceedings. ed. / David Lamas; Fernando Loizides; Lennart Nacke; Helen Petrie; Marco Winckler; Panayiotis Zaphiris. Springer Verlag, 2019. p. 497-518 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 11746 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Comparative Evaluation of Node-Link and Sankey Diagrams for the Cyber Security Domain

AU - Blinder, Rotem

AU - Biller, Ofer

AU - Even, Adir

AU - Sofer, Oded

AU - Tractinsky, Noam

AU - Lanir, Joel

AU - Bak, Peter

N1 - Publisher Copyright: © IFIP International Federation for Information Processing 2019.

PY - 2019

Y1 - 2019

N2 - Visualization tools are critical components of cyber security systems allowing analyzers to better understand, detect and prevent security breaches. Security administrators need to understand which users accessed the database and what operations were performed in order to detect irregularities. The current work compares the Sankey diagram with the more commonly used node-link diagram as an alternative visualization technique for cyber security tasks in a controlled experiment. The results indicate, that the Sankey tool showed a consistent advantage in task completion time and was more effective (measured by the percent of correct answers) in synoptic tasks, while the Node-link diagram was more effective in basic, elementary tasks. Further results revealed that performance had only a small effect on user satisfaction and preferences. Our results suggest that the Sankey tool may be a viable option for cyber security visualization tools and strengthens the need to provide personalized visualization tools based on user preferences.

AB - Visualization tools are critical components of cyber security systems allowing analyzers to better understand, detect and prevent security breaches. Security administrators need to understand which users accessed the database and what operations were performed in order to detect irregularities. The current work compares the Sankey diagram with the more commonly used node-link diagram as an alternative visualization technique for cyber security tasks in a controlled experiment. The results indicate, that the Sankey tool showed a consistent advantage in task completion time and was more effective (measured by the percent of correct answers) in synoptic tasks, while the Node-link diagram was more effective in basic, elementary tasks. Further results revealed that performance had only a small effect on user satisfaction and preferences. Our results suggest that the Sankey tool may be a viable option for cyber security visualization tools and strengthens the need to provide personalized visualization tools based on user preferences.

KW - Cyber security

KW - Sankey diagram

KW - Visualization

UR - http://www.scopus.com/inward/record.url?scp=85072856761&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-29381-9_31

DO - 10.1007/978-3-030-29381-9_31

M3 - Conference contribution

AN - SCOPUS:85072856761

SN - 9783030293802

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 497

EP - 518

BT - Human-Computer Interaction – INTERACT 2019 - 17th IFIP TC 13 International Conference, Proceedings

A2 - Lamas, David

A2 - Loizides, Fernando

A2 - Nacke, Lennart

A2 - Petrie, Helen

A2 - Winckler, Marco

A2 - Zaphiris, Panayiotis

PB - Springer Verlag

T2 - 17th IFIP TC13 International Conference on Human-Computer Interaction, INTERACT 2019

Y2 - 2 September 2019 through 6 September 2019

ER -

Blinder R, Biller O, Even A, Sofer O, Tractinsky N, Lanir J et al. Comparative Evaluation of Node-Link and Sankey Diagrams for the Cyber Security Domain. In Lamas D, Loizides F, Nacke L, Petrie H, Winckler M, Zaphiris P, editors, Human-Computer Interaction – INTERACT 2019 - 17th IFIP TC 13 International Conference, Proceedings. Springer Verlag. 2019. p. 497-518. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-030-29381-9_31

Comparative Evaluation of Node-Link and Sankey Diagrams for the Cyber Security Domain

Abstract

Publication series

Conference

Bibliographical note

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this