Skip to main content

Research Repository

Advanced Search

Anomaly detection using pattern-of-life visual metaphors

Happa, Jassim; Bashford-Rogers, Thomas; Agrafiotis, Ioannis; Goldsmith, Michael; Creese, Sadie


Jassim Happa

Ioannis Agrafiotis

Michael Goldsmith

Sadie Creese


Complex dependencies exist across the technology estate, users and purposes of machines. This can make it difficult to efficiently detect attacks. Visualization to date is mainly used to communicate patterns of raw logs, or to visualize the output of detection systems. In this paper we explore a novel approach to presenting cybersecurity-related information to analysts. Specifically, we investigate the feasibility of using visualizations to make analysts become anomaly detectors using Pattern-of-Life Visual Metaphors. Unlike glyph metaphors, the visualizations themselves (rather than any single visual variable on screen) transform complex systems into simpler ones using different mapping strategies. We postulate that such mapping strategies can yield new, meaningful ways to showing anomalies in a manner that can be easily identified by analysts. We present a classification system to describe machine and human activities on a host machine, a strategy to map machine dependencies and activities to a metaphor. We then present two examples, each with three attack scenarios, running data generated from attacks that affect confidentiality, integrity and availability of machines. Finally, we present three in-depth use-case studies to assess feasibility (i.e. can this general approach be used to detect anomalies in systems?), usability and detection abilities of our approach. Our findings suggest that our general approach is easy to use to detect anomalies in complex systems, but the type of metaphor has an impact on user's ability to detect anomalies. Similar to other anomaly-detection techniques, false positives do exist in our general approach as well. Future work will need to investigate optimal mapping strategies, other metaphors, and examine how our approach compares to and can complement existing techniques.


Happa, J., Bashford-Rogers, T., Agrafiotis, I., Goldsmith, M., & Creese, S. (2019). Anomaly detection using pattern-of-life visual metaphors. IEEE Access, 7, 154018-154034.

Journal Article Type Article
Acceptance Date Sep 30, 2019
Online Publication Date Oct 21, 2019
Publication Date Oct 21, 2019
Deposit Date Oct 18, 2019
Publicly Available Date Dec 23, 2019
Journal IEEE Access
Electronic ISSN 2169-3536
Publisher Institute of Electrical and Electronics Engineers (IEEE)
Peer Reviewed Peer Reviewed
Volume 7
Pages 154018-154034
Keywords cyber security; visualization; anomaly detection; feasibility study; human factors
Public URL


You might also like

Downloadable Citations