From when and what to where: Linking spatio-temporal visualizations in visual analytics

This paper proposes an autolinking approach to help analysts investigate spatial details of suspicious sections from an overview temporal visualization. Analysis of spatial-temporal network security data takes place both conditionally and in sequence. Many systems use time-series curves to visualize the temporal perspectives of the data and maps to show the spatial information. To identify anomalies, the analysts frequently shift across different visualizations. In essence, time-series curves provide a temporal overview of data, and the map anchors the locations for the users to drill down for details. Anomalies may be reflected in a time-series curve as a jump, a dive, a peak, or a valley. With the autolinking mechanism, after the analyst selects a segment of a curve, the system can automatically highlight the related area on the map for further investigation. This approach adopts the slicing operation of the Online Analytical Process (OLAP) to find the basic granularities that contribute to the overall value change. This approach is implemented in our award-winning visual analytics system SemanticPrism. In this paper, we describe its structure and demonstrate three examples of use with the VAST 2012 Minichallenge 1 data.