ChapterPDF Available

Voronoi Maps for Planar Sensor Networks Visualization: Second International Symposium, MobiSec 2017, Jeju Island, Republic of Korea, October 19–22, 2017, Revised Selected Papers

Authors:
  • St. Petersburg Federal Research Center of the Russian Academy of Sciences (SPC RAS)

Abstract and Figures

The paper describes Voronoi Maps – a new technique for visualizing sensor networks that can reduced to planar graph. Visualization in the form of Voronoi Maps as well as TreeMaps provides a great use of screen space, and at the same time allows us to visualize planar non-hierarchical decentralized topology. The paper provides an overview of existing techniques of information security visualization, the Voronoi Maps concept, Voronoi Maps mapping technique, Voronoi Maps cell area resizing technique and Voronoi Map usage examples for visualization of sensor network analysis processes.
Content may be subject to copyright.
Voronoi Maps for Planar Sensor Networks
Visualization
Maxim Kolomeets
1,2
, Andrey Chechulin
1,2(&)
,
Igor Kotenko
2
, and Martin Strecker
2,3
1
St. Petersburg Institute for Informatics and Automation of the Russian
Academy of Sciences, Saint-Petersburg 199178, Russia
{kolomeec,chechulin}@comsec.spb.ru
2
ITMO University, Saint-Petersburg 197101, Russia
ivkote@comsec.spb.ru, martin.strecker@irit.fr
3
Paul Sabatier University, Toulouse, France
Abstract. The paper describes Voronoi Maps a new technique for visualizing
sensor networks that can reduced to planar graph. Visualization in the form of
Voronoi Maps as well as TreeMaps provides a great use of screen space, and at
the same time allows us to visualize planar non-hierarchical decentralized
topology. The paper provides an overview of existing techniques of information
security visualization, the Voronoi Maps concept, Voronoi Maps mapping
technique, Voronoi Maps cell area resizing technique and Voronoi Map usage
examples for visualization of sensor network analysis processes.
Keywords: Security data visualization !Sensor networks
Security analysis of sensor networks !Voronoi Maps !TreeMaps
Graph structures
1 Introduction
Nowadays due to the complexity of current attacks, the detection and reaction process
requires additional tools to help security analysts in the decision-making process. For
faster and better analysis and visual monitoring of information, analysts have to take
into account the three basic needs. The rst its breadth of graphical model for the
ability to visualize data from different sources and security sensors. The second is a
graphical model`s capacity of security metrics. And the third is simplicity of data
perception. Graphs and TreeMaps (in the case of hierarchical structures) are usually
used for visualization of security network data that has dependencies (linked data), for
example network topology. The TreeMaps were further developed in the form of the
Voronoi TreeMaps, which are based on the Voronoi Diagram. TreeMaps and Voronoi
TreeMaps more effectively display metrics in comparison with graphs, but they have
two main drawbacks that signicantly limit their usage: (1) they can display only the
leaf metrics of the tree if the metrics of the nodes dont depend on each other; (2) they
can only display a hierarchical topology.
In this paper, we propose the development of Voronoi Maps graphical model for
security analysis of sensor networks that can be presented as planar structure. Voronoi
AQ1
©Springer Nature Singapore Pte Ltd. 2019
I. You et al. (Eds.): MobiSec 2017, CCIS 971, pp. 114, 2019.
https://doi.org/10.1007/978-981-13-3732-1_7
Author Proof
Maps can display the metrics of sensors, as well as planar topologies, using the same
area attributes as the TreeMaps and Voronoi TreeMaps. We suppose that the use of
Voronoi Maps will allow us to enhance performance of visual analysis and monitoring
of information security data that have planar structure. We also give example sensor
network visualization for analysis of sensorscharge level.
The novelty of the paper is the application of Voronoi Maps to visualize the sensor
network analysis and its evaluation. The contribution of this paper is a description of
the generation and polymorphism techniques for the Voronoi Maps graphical model.
The paper consists of the following sections. First section shows relevance of this
paper for improvement the effectiveness of visual analytics of sensor networks security.
Second section shows existing security visualization models, their possibilities and
limitations. Third section shows the concept of Voronoi Maps and technique of gen-
eration in the form of algorithms, we outline how to generate Voronoi Maps and what
problems arise during polymorphism of cells. Fourth section describes how the pro-
totype was implemented, what libraries were used, and shows Voronoi Maps use case:
sensor network visualization for analysis of sensorscharge level. In fth section we
compare the proposed model with analogs, evaluate its capabilities and describe plans
for further research. The last section summarizes the results.
2 Review of Visualization Techniques
When analyzing security data, two types of models are usually used: geometrical [1] (to
calculate the impact of cyber events or select countermeasures) and graphical [2] (to
analyze the topology or other linked security data). Great difculty is represented by
linked security data structures, such as computer networks [3,4], attack trees [5],
service dependencies [6] and other.
Sensor networks topology can be represented as a linked data too. Also, sensor
networks can be represented as graphs with reduced planar topology, that used to
conserve energy and reduce interference. Let us look which visualization techniques of
security network visualization can be used for visual representation and analysis of
planar sensor networks.
One of the most common ways to visualize dependent or related structures are
graphs. Graphs are the best option to analyze the topology and common way for
visualization of networks security [7]. Advantage of graphs is that they can visualize
any type of sensor network topology. At the same time, they cant effectively visualize
link metrics (as communication channels) and object metrics (as sensors).
TreeMaps [8] are used to visualize the metrics of objects that are linked hierar-
chically in form of tree. So TreeMaps can be used for visualization for multilevel
centralized sensor networks. At the same time, TreeMaps have disadvantages. First, the
area of the rectangle-ancestor is equal to the sum of the rectangles-descendants. As a
consequence, we can visualize only the metrics of the leaves of a tree. In many cases,
the visualization of not leavesmetrics is not required.
For example, when leaves in multilevel centralized sensor networks are presented
as physical sensors and other nodes are presented as hubs that helps to process and to
transport data to central host, we need to visualize only metrics of leaves-sensors. On
2 M. Kolomeets et al.
Author Proof
the other hand, when sensors act as hubs, we need to visualize metrics of leaves-sensors
and nodes-sensors that cannot be done using TreeMaps. Secondly, TreeMaps can only
display hierarchical structures and in case of decentralized sensor network they cant be
used.
TreeMaps were further developed in the form of the Voronoi TreeMaps [9], which
are based on the Voronoi Diagram [10]. The Voronoi diagram is generated on the basis
of points and represents a partition of a plane or space into polygons. The distance from
any dot inside the polygon to the point (on the basis of which the given polygon was
generated) always less than to the other point.
For example, Voronoi diagrams can be used to analyze the movement of a person
on the signal of his cell phone (see Fig. 1). By exploiting the SS7 vulnerability [11],
one can obtain the base station number to which the phone is connected. Having
formed the Voronoi Diagram on the basis of the coordinates of the base stations, one
can nd out the area in which the person is located.
Voronoi TreeMaps [9] (Fig. 2) are interpreted differently from Voronoi diagram.
Like the TreeMaps, Voronoi TreeMaps consist of nested areas that can be specied in
color, size, and opacity. By using polygons, it is easier to analyze the data and rec-
ognize the nesting.
Each visualization model has its own advantages of application and can be used for
visualization of sensor networks with limitations. Therefore, they are usually used
together (according to the multiple-view paradigm [12]) in order to increase situational
awareness.
However, the limitations of the TreeMaps and the Voronoi TreeMaps dont allow
them to be used for non-hierarchical sensor networks. At the same time, limitations of
the graphs dont allow them to be used for effective analysis of metrics of sensors and
communication channels.
Fig. 1. The Voronoi diagram based on the
mobile base stations in St. Petersburg.
Fig. 2. Voronoi TreeMaps.
Voronoi Maps for Planar Sensor Networks Visualization 3
Author Proof
The proposed approach allows us to visualize sensor networks on principles that are
similar to the graphs and Voronoi TreeMaps, thereby inheriting their advantages.
3 Proposed Graphical Model
Conceptually, Voronoi Map is a structure of related objects with a planar topology in
which the object is represented by a polygon, and the connections between objects are
edges between polygons. In this structure, delimiters can also arise some edges can
separate objects. Voronoi Map is built on the basis of a planar graph. The graph and the
corresponding Voronoi Map are shown in Fig. 3.
This way of visualization of graph structures is conceptually different from the
Voronoi diagram and Voronoi TreeMaps. The Voronoi diagram is a partition of the
space and does not contain related structures. Voronoi TreeMaps are extension of the
TreeMaps, and they can display only hierarchical topology. Thus, the resemblance to
Voronoi diagram and Voronoi TreeMaps is only visual.
A good analogy of the Voronoi Maps is a labyrinth. Each cell of the map (object
sensor) is a room of the labyrinth, some edges of cells (connections between objects
connections between sensors) are doors, and other edges-separators of cells (no relations
between objects no connection between sensors) are walls. The topology of the
structure is perceived as the ability to move between rooms, while the various indicators
of rooms and doors (colors, sizes, position) perceive the attributes of objects (sensors
data) and their relationships.
Fig. 3. The Voronoi Map and the corresponding graph.
4 M. Kolomeets et al.
Author Proof
Voronoi Maps have the ability to display metrics with the help of cells and edges:
the size, color, transparency or saturation of the cell; as well as color, thickness and
transparency or saturation of the edge. In security monitoring Voronoi Maps can be
used to analyze metrics and topologies. Objects of visualization can be not only sensor
networks, but also any planar structure: premises; computer networks on the physical
layer of the OSI model; graphs and attack trees; le systems, etc. The basis of Voronoi
Maps generations is the correspondence of the Delaunay triangulation and the Voronoi
diagram. The algorithm consists of four stages and is realized on the basis of a planar
graph.
The rst stage is to place the existing graph (Fig. 4) inside a shape of an arbitrary
shape (Fig. 5). In this case, the convex hull of the resulting vertex set should not
contain vertices belonging to the graph.
The second stage involves a restricted Delaunay triangulation (Fig. 6). Unlike
triangulation based on vertices, restricted triangulation takes into account the existing
edges of the graph and the edges of the outer gure. As a result, the resulting parti-
tioning contains both edges added as a result of the triangulation, as are the original
edges of the graph and the outer shape.
At the third stage Voronoi diagram is generated on the basis of Delaunay trian-
gulation. This can be done in several ways. To uniquely match the vertices of the graph
to the cells of the diagram, we propose to form cells of the Voronoi diagram on the
basis of the weight centers of the triangles (Fig. 7): for each vertex of the original
graph, a set of triangles is determined from the Delaunay triangulation in such a way
that each triangle contains a given vertex.
Having determined the weight centers of these vertices, connect them clockwise or
counterclockwise relative to the top of the graph. The resultant polygon is the cell of
the Voronoi diagram, which uniquely corresponds to the vertex of the graph on the
basis of which it was constructed. The set of polygons (Fig. 8) forms a Voronoi
diagram whose cells correspond to the original graph.
At the fourth stage, it is necessary to create a Voronoi Map by designating a
topology based on the original graph. Each edge, except the outer, belongs simulta-
neously to two cells of the diagram. Since the cells correspond to the vertices of the
Fig. 4. Input graph. Fig. 5. Graph inside gure
similar to graphs convex
hull.
Fig. 6. Result of restricted
delaunay triangulation.
Voronoi Maps for Planar Sensor Networks Visualization 5
Author Proof
original graph, they can be compared. If there is no edge between two vertices on the
graph, and there is an edge on the map belonging to two corresponding cells, the edge
of the cells must be replaced by a separator. Also, on the dividers, all edges that belong
exclusively to one cell - all external edges - should be replaced.
In order to put sensorsmetrics in the area of cells, we have to implement a
polymorphism algorithm that will allow us to change the cell areas to the required ones.
The problem of polymorphism is a consequence of the dependence of cell areas on
each other. Since the points and edges (except for the outer edges) are common for at
least two cells, changing one cell leads to a change in the neighboring cells.
So, if one reduce the area of cell 1 (see Fig. 9) in the map by moving the blue dot
along the arrow shown, this will increase the cell 2 and reduce cell 3. After the cell
polymorphism, one can block its points in order to keep the required size, but if the
bypassing order of cells is incorrect, one can get cell in which all points are blocked in
case of blocking of points of previous cells. Consider the example with the map shown
in Fig. 10 and the order of the bypass 1-2-3-4.
After polymorphism of cell 2, all map points are blocked. On the third cell, one can
create new points on the edges 4/3 or 3/0 and continue their movement. However, after,
cell 4 is blocked it does not have free points, and the creation and movement of points
on the edges 4/1, 4/2, 4/3 will violate the area of other cells that are already reduced to
the required size. With a different order of traversal, for example 1-4-2-3, only after
Fig. 7. Cells are formed from the centers
of triangles around the graph vertexes.
Fig. 8. Result of Voronoi Maps
forming.
Fig. 9. Dot moving change
cells area. (Color gure online) Fig. 10. Example of cell lock.
6 M. Kolomeets et al.
Author Proof
changing cell 2 all the points are blocked, but the change of cell 3 is possible, by
creating a 3/0 point, since its movement will not affect the area of cells already formed.
Potentially, polymorphism can be implemented in a variety of ways. We propose
a solution based on the movement of cell points. The proposed solution consists of two
parts: cells bypassing order and sequential polymorphism.
The basis of the bypassing order algorithm is the division of the Voronoi Map into
layers with nding in each layer of the Hamiltonian path. The result of the algorithm is
an ordered sequence of cells.
Each layer is dened by cells that contain edges belonging to only one cell after
removing the edges of the previous layer. In fact, in this way, the outer cells of the map
are dened by its hull. The selected set is a separate layer. The rst layer of the map is
highlighted in Fig. 11 as blue.
In the second stage, Hamiltonian paths are selected for each layer, on the basis of
which a sequence of cells bypassing will be singled out. Each layer consisting of their
cells can be represented in the form of a graph in which the vertices of the graph are the
cells of the map, and the edges of the graph are the common edges of the cells. In the
graph on the basis of the layer, it is necessary to single out the Hamiltonian path. The
path found by the Hamiltonian is the desired sequence of cells, the bypass of which will
not lead to locks in the process of polymorphism.
If the Hamiltonian path in the layer-graph does not exist (see Fig. 12), the layer
must be broken down into several layers. This can be done by adding a graph to virtual
vertices (see Figs. 13 and 14) that are linked to all vertices except virtual ones, until
there is a Hamiltonian path (see Fig. 15). If we divide the resulting Hamiltonian path in
places where the vertices are virtual edges (see Fig. 16), the resulting sequences will be
sublayers of the layer, each of which forms a Hamiltonian path (see Fig. 17) whose
sequence does not lead to locks in the process of polymorphism.
As a result, there is an order of layers, each of which contains the Hamiltonian path -
the order of the cells. To start the bypassing follows from the last layer, according to the
sequence of cells dened as a result of nding the Hamiltonian path.
Fig. 11. First, second and third (with Hamiltonian path) layer of Voronoi Map. (Color gure
online)
Voronoi Maps for Planar Sensor Networks Visualization 7
Author Proof
After determining the bypassing order, we have to implement polymorphism of
each cell. Each cell is given a numerical metric. Metrics are normalized in such a way
that the largest value of the metric from the set becomes equal to the area of the
smallest cell. Thus, the cells need only be reduced, bypassing their increase.
Fig. 12. Orange layer that
doesnt have a Hamiltonian
path. (Color gure online)
Fig. 13. Adding of virtual node
for nding Hamiltonian path.
Fig. 14. Adding another
virtual node for nding
Hamiltonian path.
Fig. 15. Hamiltonian path
exists in that conguration.
Fig. 16. Cut Hamiltonian
path by virtual nodes.
Fig. 17. Forming Voronoi
slices.
8 M. Kolomeets et al.
Author Proof
Reducing the cells occurs by moving the polygon points according to the following
rules:
1. Cells are subjected to polymorphism by moving points of a polygon that forms a
cell;
2. Polymorphism is complete if LieFactor ¼required area
current area
!
!!
!of cell is less than 1.1 it has
been experimentally established that a person perceives cells as approximately
equal, even if their area differs by 10%;
3. The points move in turn clockwise or counterclockwise relative to the center of the
cell, which ensures uniformity of the cell decrease;
4. The points move along the bisector of the angle formed from the movable point and
the neighboring ones, so the movement of the point will not violate the planarity of
the cell.
5. Points move to a distance equal to 1% of the distance when moving to which the
planarity of the gure is violated provided that the angle on the left is greater and
the angle on the right is less than the angle formed from the movable point and the
neighboring ones; 3% if the right and left angles are greater; by 0.5% if the right and
left angles are less; experimentally, it is established that such a combination is
optimal for smoothing acute angles and bringing the cell to a symmetrical form;
Fig. 18. Four snapshots of the polymorphism algorithm. (Color gure online)
Voronoi Maps for Planar Sensor Networks Visualization 9
Author Proof
6. After one circle of motion (one iteration over all points of the cell), the curve from
the movable points is normalized in such a way that the faces of the curve have the
same length; this does not allow the edges to be reduced so much, so their length
cant be distinguish by user.
7. If the point is close to the violation of planarity, it stops, and the neighboring edges
break up into 2, thus forming 2 additional points; this makes it possible to reduce
complex nonconvex gures when a small number of points can move.
The result of the algorithm at various stages is shown in Fig. 18. The locked points
are highlighted in red and blue represent point that is moving at the moment.
4 Voronoi Maps Implementation and Examples
of Application
To perform experiments on visualization with the use of Voronoi Maps, we imple-
mented a prototype using Java, which consists of three modules: generation, rendering,
and polymorphism.
At the input of the generation module, a topology structure is provided in the form
of a planar graph or a matrix of tree contiguities, as well as a set of metrics for
visualizing links and objects. The module calculates the coordinates of polygon, edge,
and delimiter points, and returns them as a structure.
The rendering module is designed to render the resulting structure. Rendering is
performed using JavaScript D3.js. The polymorphism module allows one to resize the
cells. The following libraries and modules are used in the prototype: GraphViz [13]
transforms the matrices of contiguities into planar structures; Triangle [14]performs a
restricted Delaunay triangulation and nding a convex hull; D3.js [15]rendering of
the Voronoi Map.
This prototype is used to monitor statement of sensor networks. Also, it can be used
to visualize any security processes that are represented as planar graphs.
4.1 Example Based on Decentralized Sensor Network
In the experiment we used the data about decentralized sensor network that consist of
autonomous devices [1618]. Devices have multiple sensors; some of them are located
outdoor and have remote charging systems, including solar panels for charging. The
network of these devices can be shown as a graph or a Voronoi Map (Fig. 19).
Each device has criticality level that have been calculated based on the criticality of
assets which are located in this area. Therefore, the loss of the sensor will mean the loss
of monitoring of these assets. Since the devices are autonomous, they are discharging,
but they can be charged using solar panels.
Sensor network in form of Voronoi Map with metrics is shown in Fig. 20.
Cell size shows the criticality of sensor. Grey color shows that in the last 24 h
sensor gets more energy than used up. Blue color shows that in the last 24 h sensor
used up more energy than get, but they still have enough power. Red color shows that
more than in the last 24 h sensor used up more energy than get, and now they dont
10 M. Kolomeets et al.
Author Proof
have enough power and will disconnect soon. Opacity shows speed of charging or
discharging.
5 Discussion
To assess the possibilities of using Voronoi Maps for visualization of sensor networks,
we compare the capabilities of Voronoi Maps and the most used models of visual-
ization of linked data: Graphs, TreeMaps/Voronoi TreeMaps (have the same indica-
tors), Matrices. The results of the comparison are presented in Table 1.
Fig. 19. Sensor network in form of graph (in the left) and in form of Voronoi Map (in the right).
Fig. 20. Sensor network in form of Voronoi Map with metrics. (Color gure online)
Voronoi Maps for Planar Sensor Networks Visualization 11
Author Proof
The table contains seven elds for comparison. Topology support (1) shows which
sensor networks topology can visualize the model. Visualization of objects (2) and
links (3) shows what types of objects and relationships the model can visualize. In the
rows of object metrics(4) and link metrics(5), graphical ways of visualizing
metrics of sensor by models are listed. In the same elds, the +sign indicates the
most effective ways to visualize metrics. Application (6) areas of application in which
the model most effectively manifests itself. The complexity of the implementation
(7) shows the complexity of the algorithms used in constructing the model. Also, the
worst indicators in the table eld are highlighted in red, and the best in blue. The
remaining indicators, as well as indicators whose results are not obvious, are high-
lighted in yellow.
On the basis of Table 1, it can be concluded that Voronoi Maps can be an alter-
native when visualizing sensor networks with a planar topology. This is due to the fact
that they effectively display metrics due to the size and color of the elements. Visu-
alization of metrics is necessary for making decisions in many information security
processes. If previously the most appropriate model for visualizing metrics were
TreeMaps, Voronoi Maps are an alternative that can visualize not only hierarchical
structures. At the same time, if TreeMaps are able to visualize only the metrics of
leaves that can be used in multilevel centralized sensor networks, Voronoi Maps can
visualize the parent elements of the tree, thereby providing more analysis capabilities
and expanding application possibilities including capability of visualization of cen-
tralized and decentralized planar sensor networks.
From the obvious drawbacks, one can single out the possibility of constructing the
Voronoi Map only for sensor networks with a planar topology, while graphs and
matrices do not have such limitations. Another drawback is the complexity of the
construction and the even greater complexity of the polymorphism of Voronoi cells in
Table 1. Capabilities of Voronoi Maps and other graphical models
12 M. Kolomeets et al.
Author Proof
comparison with graphs, TreeMaps and matrices. It is important to node, that Voronoi
Maps can be used to visualize any structures and processes that can be represented in
the form of a planar graph. Thus, the potential of using Voronoi Maps goes far beyond
information security.
6 Conclusion
This paper describes a new way to visualize sensors network which can be represented
as a planar graph. Visualization in the form of Voronoi Maps provides effective
visualization of metrics due to the use of screen space and allows one to visualize data
with a planar non-hierarchical and hierarchical structure for centralized and reduced to
planar decentralized sensor networks. An overview was given of the existing methods
to visualize sensors networks, such as graphs, TreeMaps, Voronoi diagrams and
Voronoi TreeMaps. The Voronoi Map concept is presented, explaining the way of its
interpretation. The technique for constructing the Voronoi Map from a planar graph in
the form of algorithms is given. The technique of resizing the cells of the Voronoi Map
in the form of algorithms is presented. Example of visualization of sensor network in
form of the Voronoi Map is given. The polymorphism algorithm presented in this paper
is only one of the potential ways of converting cells to the required size.
Future work will be devoted to the possibility of using approaches based on other
principles for polymorphism. For example, the size of the cells of the Voronoi Map
depends on the graph vertices positions. It is necessary to consider the approach to
setting the conguration parameters of power drawing (vertex charge, strength and
tensile strength of the ribs) or other physicalstructure to bring the size of the cells to
a given size. Also, the potential has an approach to setting cell sizes by means of an
S-decomposition of the Voronoi Map.
Acknowledgements. This work was partially supported by grants of RFBR (projects No.
16-29-09482, 18-07-01488), by the budget (the project No. AAAA-A16-116033110102-5), and
by Government of Russian Federation (Grant 08-08).
References
1. Granadillo, G.G., Garcia-Alfaro, J., Debar, H.: Using a 3D geometrical model to improve
accuracy in the evaluation and selection of countermeasures against complex cyber attacks.
In: Thuraisingham, B., Wang, X., Yegneswaran, V. (eds.) SecureComm 2015. LNICST, vol.
164, pp. 538555. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-28865-9_29
2. Kolomeec, M., et al.: Choosing models for security metrics visualization. In: Rak, J., Bay, J.,
Kotenko, I., Popyack, L., Skormin, V., Szczypiorski, K. (eds.) MMM-ACNS 2017. LNCS,
vol. 10446, pp. 7587. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-65127-9_7
3. Marty, R.: Applied Security Visualization. Addison-Wesley, Upper Saddle River (2009)
4. Kolomeec, M., Chechulin, A., Pronoza, A., Kotenko, I.: Technique of data visualization:
example of network topology display for security monitoring. J. Wirel. Mobile Netw.
Ubiquit. Comput. Dependable Appl. (JoWUA) 7(1), 5878 (2016)
Voronoi Maps for Planar Sensor Networks Visualization 13
Author Proof
5. Chechulin, A., Kotenko, I.: Attack tree-based approach for real-time security event
processing. Autom. Control Comput. Sci. 49, 701704 (2015)
6. Kotenko, I., Doynikova, E.: Selection of countermeasures against network attacks based on
dynamical calculation of security metrics. J. Defense Model. Simul. Appl. Methodol.
Technol. 15, 181204 (2017)
7. McGufn, M.: Simple algorithms for network visualization: a tutorial. Tsinghua Sci.
Technol. 17, 383398 (2012)
8. Harrison, L., Spahn, R., Iannacone, M., Downing, E., Goodall, J.: NV: Nessus vulnerability
visualization for the web. In: Proceedings of the Ninth International Symposium on
Visualization for Cyber Security - VizSec 2012 (2012)
9. Balzer, M., Deussen, O., Lewerentz, C.: Voronoi treemaps for the visualization of software
metrics. In: Proceedings of the 2005 ACM symposium on Software visualization - SoftVis
2005 (2005)
10. Aziz, N., Mohemmed, A., Alias, M.: A wireless sensor network coverage optimization
algorithm based on particle swarm optimization and Voronoi diagram. In: 2009 International
Conference on Networking, Sensing and Control (2009)
11. Signaling system 7 (SS7) security report. https://www.ptsecurity.com/upload/iblock/083/
08391102d2bd30c5fe234145877ebcc0.pdf
12. Roberts, J.: Guest editors introduction: special issue on coordinated and multiple views in
exploratory visualization. Inf. Vis. 2, 199200 (2003)
13. GraphViz Library. http://www.graphviz.org
14. Triangle Library. https://www.cs.cmu.edu/*quake/triangle.html
15. D3.js Library. https://d3js.org
16. Desnitsky, V., Levshun, D., Chechulin, A., Kotenko, I.: Design technique for secure
embedded devices: application for creation of integrated cyber-physical security system.
J. Wirel. Mobile Netw. Ubiquit. Comput. Dependable Appl. (JoWUA) 7(2), 6080 (2016)
17. Aram, S., Shirvani, R.A., Pasero, E.G., Chouikha, M.F.: Implantable medical devices;
networking security survey. J. Internet Serv. Inf. Secur. (JISIS) 6(3), 4060 (2016)
18. Bordel, B., Alcarria, R., Manso, M.A., Jara, A.: Building enhanced environmental
traceability solutions: from thing-to-thing communications to generalized cyber-physical
systems. J. Internet Serv. Inf. Secur. (JISIS). 7(3), 1733 (2017)
14 M. Kolomeets et al.
Author Proof
Author Query Form
Book ID : 477759_1_En
Chapter No : 7
Please ensure you fill out your response to the queries raised below
and return this form along with your corrections.
Dear Author,
During the process of typesetting your chapter, the following queries have
arisen. Please check your typeset proof carefully against the queries listed below
and mark the necessary changes either directly on the proof/online grid or in the
Authors responsearea provided below
Query Refs. Details Required Authors Response
AQ1 This is to inform you that corresponding author has been identified as per the
information available in the Copyright form.
Author Proof
View publication statsView publication stats
Chapter
Full-text available
In modern means of mobile Internet security, including those based on touch screens, various visualization models are used. However, with the increasing complexity of these models, the requirements for models of user interaction with visualization change, the need for their adaptability increases. The article proposes an adaptive approach to the formation of a user interface based on touch screens for managing mobile Internet security. The results of experiments on user interaction with visualization of a centralized and decentralized network of devices and user perception of certain gestures when using touch screens are also shown. The problems and advantages of this type of interface, identified during the tests are described.
Conference Paper
Full-text available
The paper discusses the use of virtual (VR) and augmented (AR) reality for visual analytics in information security. Paper answers two questions: “In which areas of information security visualization VR/AR can be useful?” and “What is the difference of the VR/AR from similar methods of visualization at the level of perception of information?”. The first answer is based on the investigation of information security areas and visualization models that can be used in VR/AR security visualization. The second answer is based on experiments that evaluate perception of visual components in VR.
Article
Full-text available
The stock market is an essential sub-sector in the financial area. Both understanding and evaluating the mountains of collected stock data has become a challenge in relevant fields. Data visualisation techniques can offer a practical and engaging method to show the processed data in a meaningful way, with centrality measurements representing the significant variables in a network, through exploring the aspects of the exact definition of the metric. Here, in this study, we conducted an approach that combines data processing, graph visualisation and social network analysis methods, to develop deeper insights of complex stock data, with the ultimate aim of drawing the correct conclusions with the finalised graph models. We addressed the performance of centrality metrics methods such as betweenness, closeness, eigenvector, PageRank and weighted degree measurements, drawing comparisons between the experiments’ results and the actual top 300 shares in the Australian Stock Market. The outcomes showed consistent results. Although, in our experiments, the results of the top 300 stocks from those five centrality measurements’ rankings did not match the top 300 shares given by the ASX (Australian Securities Exchange) entirely, in which the weighted degree and PageRank metrics performed better than other three measurements such as betweenness, closeness and eigenvector. Potential reasons may include that we did not take into account the factor of stock’s market capitalisation in the methodology. This study only considers the stock price’s changing rates among every two shares and provides a relevant static pattern at this stage. Further research will include looking at cycles and symmetry in the stock market over chosen trading days, and these may assist stakeholder in grasping deep insights of those stocks.
Conference Paper
Full-text available
This paper aims at finding optimal visualization models for representation and analysis of security related data, for example, security metrics, security incidents and cyber attack countermeasures. The classification of the most important security metrics and their characteristics that are important for their visualization are considered. The paper reviews existing and suggested research by the author’s data representation and visualization models. In addition, the most suitable models for different metric groups are outlined and analyzed. A case study is presented as an illustration on the way the visualization models are integrated with different metrics for security awareness.
Conference Paper
Full-text available
The selection of security countermeasures against current cyber attacks does not generally perform appropriate assessments of the attack and countermeasure impact over the system. In addition, the methodologies used to evaluate and select countermeasures are generally based on assumptions, estimations, and expert knowledge. A great level of subjectivity is considered while estimating parameters such as benefits and importance of the investment in cost sensitive models. We propose in this paper a decision support tool that uses a Return On Response Investment (RORI) metric, and a 3D geometrical model to simulate the impact of attacks and countermeasures on the system. The former is a cost sensitive model used to evaluate, rank and select security countermeasures against complex cyber attacks. The latter, is a tool that represents the impact of attacks and countermeasures in a three dimensional coordinate system. As a result, we are able to automatically select mitigation strategies addressing multiple and complex cyber attacks, that are efficient in stopping the attack and preserve, at the same time, the best service to legitimate users. The implementation of the tool and main results are detailed at the end of the paper to show the applicability of our model.
Article
Full-text available
The paper presents the results of research devoted to the development of an unified flexible visualization system for security monitoring of computer networks used in the SIEM systems. The developed models and technique of visualization are used for selection of methods of data collection, normalization, preprocessing and representation. The individual components of the proposed visualization system are described using set-theoretic models. To analyze the operability of the developed models and methodologies a software prototype of the visualization system is developed and experiments are conducted. © 2016, Innovative Information Science and Technology Research Group. All rights reserved.
Article
This paper considers the issue of countermeasure selection for ongoing computer network attacks. We outline several challenges that should be overcome for the efficient response: the uncertainty of an attacker behavior, the complexity of interconnections between the resources of the modern distributed systems, the huge set of security data, time limitations, and balancing between countermeasure costs and attack losses. Although there are many works that are focused on the particular challenges, we suppose that there is still a need for an integrated solution that takes into account all of these issues. We suggest a model-driven approach to the security assessment and countermeasure selection in the computer networks that takes into account characteristics of different objects of assessment. The approach is based on integration with security information and event management systems to consider the dynamics of attack development, taking into account security event processing. Open standards and databases are used to automate security data processing. The suggested technique for countermeasure selection is based on the countermeasure model that was defined on the basis of open standards, the family of interrelated security metrics, and the security analysis technique based on attack graphs and service dependencies. We describe the prototype of the developed system and validate it on several case studies.
Article
As elements of complex information systems, embedded devices define informational and physical connections between the level of software control of the system on the one hand, and its technical environment and users on the other. Operating in a potentially volatile and untrusted cyber-physical environment, using insufficiently secure communication channels and sensors as well as various external influences cause such devices are subject to specific attacking actions. As a result the design of such systems is a challenging task often requiring expert based solutions. The main contribution of the paper is a design technique for secure embedded devices on the basis of combinations of security components, optimization approach and developed software tools for decision making support. The correctness of the technique is confirmed by its use in the development of the integrated cyberphysical security system. © 2016, Innovative Information Science and Technology Research Group. All rights reserved.
Article
This paper presents an approach to analytical attack modeling in near real-time information security systems.
Conference Paper
Network vulnerability is a critical component of network security. Yet vulnerability analysis has received relatively little attention from the security visualization community. This paper describes nv, a web-based Nessus vulnerability visualization. Nv utilizes treemaps and linked histograms to allow security analysts and systems administrators to discover, analyze, and manage vulnerabilities on their networks. In addition to visualizing single Nessus scans, nv supports the analysis of sequential scans by showing which vulnerabilities have been fixed, remain open, or are newly discovered. Nv operates completely in-browser, to avoid sending sensitive data to outside servers. We discuss the design of nv, as well as provide case studies demonstrating vulnerability analysis workflows which include a multiple-node testbed and data from the 2011 VAST Challenge.
Article
The graph drawing and information visualization communities have developed many sophisticated techniques for visualizing network data, often involving complicated algorithms that are difficult for the uninitiated to learn. This article is intended for beginners who are interested in programming their own network visualizations, or for those curious about some of the basic mechanics of graph visualization. Four easy-to-program network layout techniques are discussed, with details given for implementing each one: force-directed node-link diagrams, arc diagrams, adjacency matrices, and circular layouts. A Java applet demonstrating these layouts, with open source code, is available at http://www.michaelmcguffin.com/research/simpleNetVis/. The end of this article also briefly surveys research topics in graph visualization, pointing readers to references for further reading.
Article
APPLIED SECURITY VISUALIZATION Collecting log data is one thing, having relevant information is something else. The art to transform all kinds of log data into meaningful security information is the core of this book. Raffy illustrates in a straight forward way, and with hands-on examples, how such a challenge can be mastered. Let's get inspired. Andreas Wuchner, Head of Global IT Security, Novartis Use Visualization to Secure Your Network Against the Toughest, Best-Hidden Threats As networks become ever more complex, securing them becomes more and more difficult. The solution is visualization. Using todays state-of-the-art data visualization techniques, you can gain a far deeper understanding of whats happening on your network right now. You can uncover hidden patterns of data, identify emerging vulnerabilities and attacks, and respond decisively with countermeasures that are far more likely to succeed than conventional methods. In Applied Security Visualization, leading network security visualization expert Raffael Marty introduces all the concepts, techniques, and tools you need to use visualization on your network. Youll learn how to identify and utilize the right data sources, then transform your data into visuals that reveal what you really need to know. Next, Marty shows how to use visualization to perform broad network security analyses, assess specific threats, and even improve business compliance. He concludes with an introduction to a broad set of visualization tools. The books CD also includes DAVIX, a compilation of freely available tools for security visualization. You'll learn how to: Intimately understand the data sources that are essential for effective visualization Choose the most appropriate graphs and techniques for your IT data Transform complex data into crystal-clear visual representations Iterate your graphs to deliver even better insight for taking action Assess threats to your network perimeter, as well as threats imposed by insiders Use visualization to manage risks and compliance mandates more successfully Visually audit both the technical and organizational aspects of information and network security Compare and master todays most useful tools for security visualization Contains the live CD Data Analysis and Visualization Linux (DAVIX). DAVIX is a compilation of powerful tools for visualizing networks and assessing their security. DAVIX runs directly from the CD-ROM, without installation. Raffael Marty is chief security strategist and senior product manager for Splunk, the leading provider of large-scale, high-speed indexing and search technology for IT infrastructures. As customer advocate and guardian, he focuses on using his skills in data visualization, log management, intrusion detection, and compliance. An active participant on industry standards committees such as CEE (Common Event Expression) and OVAL (Open Vulnerability and Assessment Language), Marty created the Thor and AfterGlow automation tools, and founded the security visualization portal secviz.org. Before joining Splunk, he managed the solutions team at ArcSight, served as IT security consultant for PriceWaterhouseCoopers, and was a member of the IBM Research Global Security Analysis Lab.