Team Members:

Prince Owusu Attah, Interaction Design, Purdue University, powusuat@purdue.edu   PRIMARY
Lu Ding, Intelligent Visualization and Interaction Lab, Computer Graphics Technology, Purdue University, ding241@purdue.edu
Xiaolei Guo, Intelligent Visualization and Interaction Lab, Computer Graphics Technology, Purdue University, guo579@purdue.edu
Tianyi Zhang, College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, zhangtianyi@nuaa.edu.cn
Weiyue Deng, Intelligent Visualization and Interaction Lab, Computer Graphics Technology, Purdue University, deng161@purdue.edu
Xuan Thao Nguyen, School of Media Arts & Design, James Madison University, nguyenxx@dukes.jmu.edu
Yunran Ju, Interaction Design, Purdue University, ju27@purdue.edu
Dr. Jieqiong Zhao, Electrical and Computer Engineering, Purdue University, zhao413@purdue.edu
Dr. Chen Guo, School of Media Arts & Design, James Madison University, guo4cx@jmu.edu
Dr. Zhenyu Cheryl Qian, Art and Design, Purdue University, qianz@purdue.edu
Dr. Yingjie Victor Chen, Intelligent Visualization and Interaction Lab, Computer Graphics Technology, Purdue University, victorchen@purdue.edu

Student Team: YES

Tools Used:

Adobe Illustrator, Adobe AfterEffects

Approximately how many hours were spent working on this submission in total?

200 hours

May we post your submission in the Visual Analytics Benchmark Repository after VAST Challenge 2019 is complete?YES

Video

https://www.youtube.com/watch?v=lLAW_XnvfgM

---

A high-resolution image of our design.

Description
Please describe your design. How does it support situation awareness and rapid team assembly? How do interactive visual interfaces and machine learning complement one another? Respond using either a set of storyboards or a text description accompanied by supporting images. Please limit your response to 12 images and 800 words.

We present ConstellationBuilder, a high-level situation-awareness and team assembly interface for cyber events. ConstellationBuilder aims to identify a range of different cyber-attack events as early as possible, determine their characteristics, and quickly assemble a team of white hat members with complementary skills to respond to each event. Specifically, the system clusters massive past reports and distills events based on their similarity of reports (Fig. 1 left), then adopts collaborative filtering recommendations to suggest the most relevant events. After exploring the connection between historical events and team members who resolved the issues, our system recommends the most suitable team/constellation to handle each event (Fig. 1 right). We call a team “constellation” because they shine like stars on solving cyber problems.

Fig. 1 The overall framework of ConstellationBuilder.

ConstellationBuilder is comprised of three core displays: a report view, an event view, and a team constellation view (Fig. 2). All the views are visually linked by highlighting instances of the same object in one view.

Fig. 2 An overview of the system: a report view, an event view, and a team constellation view.

Fig. 3 Mind map of Machine learning in (a) high-level situation awareness, (b) report clustering and classification, and (c) team assembly.

Fig. 3 illustrates how ConstellationBuilder incorporates machine learning into the system and shows what uncertainties exist in both the data and the algorithms. For related reports, events, and experts, the uncertainties can be reflected in the similarity calculation. Therefore, our system recommends a list of reports, events, or experts ranking by similarity scores. Analysts can review the results and choose the most appropriate ones based on their knowledge.

The report view consists of a map view (Fig. 4 top right), characteristics of reports view (Fig. 4 middle right), report cluster view (Fig. 4 bottom left), list of reports (Fig. 4 bottom right), and detailed report view (Fig. 4 top left). Various new reports will flash in the report cluster view. Different icons represent different types of reports. ConstellationBuilder automatically clusters the reports based on the similarity measures with past reports. Different colors are used to differentiate the report clusters. The color saturation indicates the time.

The map view shows the geographical distributions of these reports. From the combined functionalities of reports view, the analyst can tell the difference between characteristics of reports from new events, past events, and predicted ones.

Fig. 4 The report view is comprised of the map view, characteristics of reports view, report cluster view, list of reports, and detailed report view.

In the list of reports view, ConstellationBuilder shows all the unidentified new reports and their severities. The analyst can highlight one report, check the past reports that are most relevant to this one, and read detailed content in the detailed report view. The detailed report view automatically highlights all the keywords in each report. The colors of the keywords are consistent with those in the report cluster view. As is seen in Fig. 5, the analyst can change, add, or delete colors and highlights of individual keywords, as well as add a new category of keywords. In the list of related reports view, ongoing reports that are assigned with events will be ordered by their similarity scores. If none of the events match this new report, ConstellationBuilder allows the analysts to create a new event to classify this report.

From Fig. 5, we can see that the analyst has determined this new report as part of the ongoing event “Dyn cyberattack" and categorized it in the list of reports view.

Fig. 5 Review and classify the unidentified new report based on a list of related past reports

The event view (Fig. 6) consists of a list of ongoing events, an event cluster view, and a close related events view. The events that need to be processed are displayed in the list of ongoing events according to their severity levels. In the event cluster view, events are clustered based on their similarity level and the size of the circle decodes the level of severity.

Fig. 6 The event view: ongoing events, an event cluster view, and a close related events view.

Once an ongoing event is selected in the list, the other two views are activated simultaneously (Fig. 7). The past events associated with this selected event are displayed in the close related view (Fig. 7 closed related events) by the degree of association. Meanwhile, the experts who have been involved in handling the event are shown below the past events.

Fig. 7 Selecting an ongoing event in the list view highlights the past associated events and the involved experts.

By matching the keywords from the event cluster view and the skills required to resolve these events, ConstellationBuilder recommends a list of potential team members based on their previous performance, experience in solving similar past events, and their resumes, publications, etc.

In the expert cluster view (Fig. 8), the recommended white hat members are grouped based on the similarity of their skillsets. The size of each node represents the strength of overall skills. Interactions between white hat members are depicted as links between the nodes. We use different colors to show different skills and the color of each node represents the most dominant skill of a member. The skill colors are consistent with those in the event cluster view. Analysts can click on each node to examine the detailed information of each white hat member.

Fig. 8 The expert cluster view clusters white hat members based on the similarity of their skillsets.

ConstellationBuilder views each possible team as a constellation (Fig. 9). It recommends several constellations based on members’ skill sets and experiences that can fulfill the needs of solving the cyber event as well as the strengths of social ties. The team constellation view displays and ranks all the possible teams/constellations and their candidates (Fig. 9). Members who have served as team leaders are highlighted in the team constellation view. When a constellation is selected, the rose chart at the bottom stacks all the experts in the constellation together and shows each member’s expertise as a ribbon.

Fig. 9 The team constellation view recommends and ranks all the possible team constellations and their candidates.

By selecting the recommended constellation 1, and then a team leader (the blue one), analysts can explore all this leader’s constellations and relevant team members based on their past collaborations in the expert cluster view (Fig. 9). Analysts can also pick members from different clusters to compose a team with complementary skills that are recommended by a systematic review of relevant events and their outcomes (Fig. 10). For future team building purposes, new white hat members with strong skills can be added or removed for training and mentoring for new members (Fig. 11).

If no one can be picked, ConstellationBuilder will recommend one leadership to assemble a team.

Fig. 10 Interactions on how to assemble a team
Fig. 11 Team expertise judgement

Everyone's performance is quantitively measured based on the number of solved exploits, average time, false-positive rate, ranking, and evaluation. The assessment details are demonstrated in Fig. 12. According to the final report, each person will get a quantitive evaluation of their qualified skills. The preliminary evaluation of each person is based on the level of completion. But the evaluator can adjust the rating scores after reading the details in the report. The expertise levels of white hat members for this completed event are automatically recorded in the system after submitted feedback, and all other views will change accordingly.

Fig. 12 Team evaluation feedback after the event.