Social Network Visualization Based on Security Logs

I have been experimenting with security logs and data visualization for the past few months. I am using Tableau 6.0 as the visualization tool and email server log files as the data source (Spector360). The problem with illustrating a social network is in calculating the geocodes for the network nodes. This is usually done using force algorithms, which are typically research by university programs and not embedded into commercial visualization tools.

After countless hours of research and some mathematical maneuvering I managed to calculate geocodes for internal email aliases and all external parties that had either sent to or received from an internal alias. I then merged geocodes and path data with email logs and uploaded them into Tableau.

The beauty of Spector360 log files is that they really have every key stroke. Some time ago Google announced how they could predict spread of the N1H1 epidemic based on search data. Well now it is possible to do the same within a corporation, but not limited only to web filter logs.

My next project will be to merge IM and Chat logs to the emails logs. I also intend to bring in web logs so that they can be visually searched, as a function of the email/IM/chat based social linkages.



5 Comments on “Social Network Visualization Based on Security Logs”

  1. I was wondering how this kind of visualization could be done through #tableau. Looks good but perhaps remains somewhat primitive

    • jmharkonen says:

      This was done with Tableau. The problem is that Tableau doesn’t bend to having the force algorithms inside the application. This means that the geo positions for the sender and reciever need to be calculated outside Tableau. This makes the image static. In a pro version the image would dynamically change with filter setting changes… i.e. the geo corodinates would be recalculated.

  2. Lyn Bartram says:

    Have you actually merged the activity logs in here now? We are dealing with a similar problem and interested in what you have done.

    • jmharkonen says:


      The above image uses activity logs from Spectorsoft’s Spector360. I used NodeXL to calculate the static positions for that dataset. The viz template is the generic Tableau example for logistical routing between cities.

  3. Kate says:

    What algorithm did you use to calculate the geocodes? Are there other vendors you’d recommend experimenting with a network visualization for?

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s