Automated and Interactive Hierarchical Network Layouts for Cybersecurity Data

In the domain of network visualisation, the phenomenon known as the ‘hairball effect’ is a recurrent challenge that emerges during the process of graph visualisation. This problem, characterised by the dense packing of nodes and edges in a graph visualisation, hinders the interpretation of meaningful information. Existing solutions to this problem are often very time-consuming and scale badly with the graph’s size. To address this issue, hierarchical structures can be utilised to organise nodes into groups, enabling the identification of patterns and relationships within the graph. This thesis proposes a methodology for the automated construction of said hierarchies. This work represents a continuation of the development of NetCapVis, a tool designed for the visualisation and analysis of network traffic data within the domain of cybersecurity. The primary contribution of this thesis lies in the development of a methodology for the automated construction of hierarchies, grounded in graph features and domain-specific information, and the subsequent visualisation of these hierarchies in a node-link diagram. Furthermore, interaction techniques are implemented to allow users to explore and manipulate the visualisation. The effectiveness and usability of the implemented techniques are then evaluated through auser study. The results indicate that while the visualisation is an effective tool for analysing network traffic data, further enhancements are necessary to optimise the user experience and enhance the application’s accessibility.