Visual correlation for situational awareness

Abstract

We present a novel visual correlation paradigm for situational awareness (SA) and suggest its usage in a diverse set of applications that require a high level of SA. Our approach is based on a concise and scalable representation, which leads to a flexible visualization tool that is both clear and intuitive to use. Situational awareness is the continuous extraction of environmental information, its integration with previous knowledge to form a coherent mental picture, and the use of that picture in anticipating future events. In this paper we build on our previous work on visualization for network intrusion detection and show how that approach can be generalized to encompass a much broader class of SA systems. We first propose a generalization that is based on what we term, the w/sup 3/ premise, namely that each event must have at least the what, when and where attributes. We also present a second generalization, which increases flexibility and facilitates complex visual correlations. Finally, we demonstrate the generality of our approaches by applying our visualization paradigm in a collection of diverse SA areas.