Evaluation of the presentation of network data via visualization tools for network analysts: Comparison of node-link, parallel coordinates, and tabular displays

Computer Network Defense (CND) analysts require tools that give accurate and current data information about the state of security for the networks they monitor. These reports of data usually generated by Intrusion Detection Systems (IDS) such as the U.S. Army Research Laboratory (ARL)'s Interrogator have traditionally been presented to the analysts via a tabular visual representation on a display. The increasing data fusion from myriad heterogeneous distributed network sensors requires visual displays that can effectively create cyberspace situational awareness. We plan to turn visual overload into an opportunity by enhancing the visual displays used by analysts. We do this by exploring other types of visual representations. Using graphical representations may provide more insight into big data inter-relationships, patterns, and finding areas of interest. In response, we have designed a user study that incorporates cyber network data to test the effectiveness of communicating suspicious activity on a computer network through visual displays.