Security Visualization

What is the right graph to use in what situation?

Do you like pie charts? Have you ever thought about replacing them with a bar chart? Or a line chart? Do you know when to use what chart? Here is a little table that you can use to make your choice:

Pie chart - Just don't use them. Use a bar or line chart instead. If you have to, use them to compare values of a field as proportions of percentages of the whole.

Bar chart - Use bar charts to show the frequency of the values of a field or the output of an aggregation function. Each bar represents a value. You want to use a categorical field, or you bin a continuous value. For example, show the number of logins per user.

Line chart - Use line charts to show the frequency of the values of a field or the output of an aggregation function. The data points are connected by lines to help display patterns or trends. Make sure that your field is ordinal or an interval. Meaning that there is order defined on your values. Time is a great example. You count the number of logins for every day of a week and display that. This can help seeing trends.

Link graph - This type of graph is sometimes called a network chart also. Use link graphs to show relationships. For example, the communication between different machines on the network.

There are more complicated graphs that are sometimes needed to visualize your data. For example, if you need to display more than 3 or 4 data fields (or dimensions) in your graph, you cannot use any of the above mentioned graphs. However, you can use one of the following graphs:

• parallel coordinates or
• treemap

On the left hand side you see an example of a parallel coordinate plot. Each data field or dimension is mapped to a vertical axis. A line represents a single event or data entry. On the right side you see a treemap. Treemaps are used to visualize hierarchical structures and enable the comparison of multiple data fields at once.

Make sure you think hard about what type of chart to use for your data and use-case at hand. Never use a line chart for categorical data, for example.

These examples should help you choose the right graphs. You can find more information about charts and when to use them in chapter 3 of Applied Security Visualization. A fun Web site that guides you through the process of choosing the right graphs is: Chart Chooser

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world