Cyber attacks cause great damage to our national security, ranging from individual internet user to biggest governmental/industrial organizations, such as Equifax (Data Breach 145.5 Million Accounts, reported in July 2017) or Uber (Data Breach 57 Million Records, reported in November 2017). The cyber assault has significantly increased in breadth and depth. This paper introduces CVExplorer, a novel interactive system for visualizing cybersecurity threats reported in the National Vulnerability Database. The proposed system aims to work as a reporting and alerting tool that can help enhance the security against cyber attacks can potentially reduce network vulnerabilities. The CVExplorer system containing multiple linked views allows users to visualize the relationships of various dimensions in the large number of vulnerability reports, such as types and levels of vulnerability, vendors, and products. The CVExplorer provides an intuitive interface and supports a range of interactive features, such as filtering and ordering by vulnerability severity ratings, allowing users to narrow down topics of interest quickly. To demonstrate the effectiveness of the proposed system, we demonstrate the CVExplorer on two case studies of Common Vulnerabilities and Exposures retrieved from the National Vulnerability Database.

To enable Industry 4.0 successfully, there is a need to build a resilient automation system that can quickly recover after having been attacked or robustly sustain continued operations while being threatened, enable an automated monitoring evolution via various sensor channels in real time, and use advanced machine learning and data analytics to formulate strategies to mitigate and eliminate faults, threats, and malicious attacks. It is envisioned that if we can develop an intelligent model that (a) represents a meaningful, realistic environment and complex entity containing manufacturing Internet of Things interdependent and independent properties that are stepping-stones of the cyber kill chain or precursors of the onset of cyberattacks; (b) can learn and predict potential errors and formulate offense/defense strategies and healing solutions; (c) can enable cognitive ability and human-in-the-loop analytics in real time; and (d) can facilitate system behavior changes to disrupt the attack cascade, then the hosting system can learn how to neutralize threats and attacks and self-repair infected or damaged links autonomously. In this article, our preliminary work presents a visual analytics framework and technique for situational awareness, including autonomously monitoring, diagnosing, and prognosticating the state of cyber-physical systems. Our approach, presented in this article, relies on visual characterizations of multivariate time series and real-time predictive analytics to highlight potential faults, threats, and malicious attacks. To validate the usefulness of our approach, we demonstrate the developed technique using various aviation datasets obtained from the Prognostics Center of Excellence at the National Aeronautics and Space Administration Ames.

Detecting outliers is one of the fundamental tasks in visual analytics and valuable in many application domains, such as suspicious network cyberattack recognition. This paper introduces an approach to analyzing and visualizing high-dimensional time series, focusing on identifying multivariate observations that are significantly different from the others. We also propose a prototype, called MTSAD, to guide users when interactively exploring abnormalities in large time series. The prototype contains two views: the main window provides an overview of identified outliers overtime, the detail window investigates and explores the ranked temporal data entries based on their outlying contributions to the overall plots. The visual interface supports a full range of interactions, such as lensing, brushing and linking, ranking, and filtering. To validate the benefits and usefulness of our approach, we demonstrate MTSAD on real-world datasets of different numbers of attributes.

Malicious applications are usually comprehended through two major techniques, namely static and dynamic analyses. Through static analysis, a given malicious program is parsed, and some representative artifacts (e.g., control-flow graphs) are produced without any execution; whereas, the given malicious application needs to be executed when conducting dynamic analysis. These two mainstream techniques for analyzing the given software are effective in detecting certain classes of malware. More specifically, through static analysis, the patterns and signature of the malware are exposed, helping in detecting any known malicious payload hidden in or injected into the code. On the other hand, behavioral and run-time execution patterns of software are explored through dynamic analysis. To ease the analysis process, a third analysis approach, known as the visual representation of the artifacts created by both static and dynamic analysis tools, would also be a supplementary asset for malware experts. This paper introduces “ MalView ”, an interactive visualization platform, for malware analysis by which pattern matching techniques on both signature-based and behavioral analysis artifacts can be utilized to 1) classify malware, 2) identify the intention and location of the malicious payload in the artifacts, 3) analyze unknown malware (i.e., zero-day malware) by recognizing any unusual signature or behavior, and 4) explore the time dependencies and thus the system components affected or tampered by the underlying malware. The results of several case studies conducted in this work show that MalView offers more features and information compared to some other visualization tools, facilitating the malware analysis process.

This paper describes a machine learning approach to the solar flare prediction competition, a track in IEEE Big Data 2019 Big Data Cup. The competition task is to predict whether or not there is a solar flare event basing on a given time series of solar magnetic field parameters. Our method involves exploring and constructing data-driven machine learning models for the classification task of two imbalanced class labels from time series. Specifically, the investigated models include boosting, logistic regression, multilayer perceptron neural network, and long short-term memory neural network. These models have been successfully deployed and combined in an ensemble framework with two tiers in our final proposed solution for this competition. Our proposed approach ranked at the second place in the competition (the first on the private board and the eleventh on the public board).