Collapses and Filters
Prov Viewer provides a vertex collapse feature to aid in the analysis of the graph, allowing a manual collapse of selected vertices in order to compact the graph size by grouping the selected vertices together in a single summarized vertex. Another usage of the collapse feature is to group activities related to the same agent, allowing the user to see all the influences and changes that the agent did throughout his tasks.
The summarize vertex has its size and shape based on the original vertices. If all the vertices belong to the same type, then the summarized vertex will use the same shape. However, if there is an agent vertex in the collapsed group, then the summarized vertex shape will be of an agent vertex. Otherwise (if there are activities and entities vertices) the shape will be of an activity vertex. The size of the collapsed vertex is related to the number of vertices that composes the summarized vertex. The more vertices in the collapse group, the bigger the resulting summarized vertex will be.
The summarized information is displayed as follow: For String values, it shows all different values separated by a comma (e.g., String_Value1, String_Value2, String_Value3). For attributes with numeric values in a collapse group composed of two vertices, Prov Viewer shows the average value for that attribute followed by the minimum and maximum values. Otherwise (collapse group containing more than two vertices), it displays the average value followed by the five-number summary (minimum value, 1st quartile, median, 3rd quartile, maximum value). The summarization information also includes the types of vertices and their respective numbers that composes the summarized vertex. The figures below illustrate the tooltip for a single vertex, for two vertices, and for more than two vertices:
Similar edges (i.e., same type) that have the same target and type are also grouped together when collapsing vertices. The collapsed edge’s information (i.e., color, thickness, and value) is computed by summing or averaging the values of the participating edges, depending on their type. For example, Prov Viewer can use the sum function for edges representing expenses and the average function for edges representing percentage. However, the user needs to parameterize each edge. Otherwise, Prov Viewer will always use the default sum function. The figure below shows an example of collapsing edges that occurred when collapsing two different groups of vertices. Note that the colors for each edge changed after the collapse due to the new maximum value (from the sum of the collapsed edges).
The following subsection describes how to use the collapse and filters features.
Collapsing all the agent's activities into a single vertex:
-
Selected the desired Agent vertex
-
Press the CollapseAgent button in the interface
The figure below illustrates an example of this type of collapse. Notice that all activities related to the agent was merged with the agent vertex. The agent vertex size changed after the collapse. The size is related to the number of vertices that compose the summarized vertex.
Do the following steps in order to use the manual collapse function:
-
Set the Mouse Mode to Picking
-
Select the desired vertices by dragging the mouse to select a group of vertices or adding one by one by holding the SHIFT key from the keyboard
-
Press the Collapse button in the interface
-
(Optional) In order to undo a collapse, select the desired collapsed vertex and press the Expand button in the interface
Prov Viewer also offers another simple vertex filter based on temporal information. The user defines the desired temporal range (e.g., start time and end time) for visualization and it hides all vertices that are outside the selected range. The figure below shows an example of the temporal filter, hiding vertices from the original graph (left) with time (which can be seen by the rows) greater than four and lesser than two.
The following steps are required to use the temporal filter:
-
Activate the Temporal Filter button in the interface
-
Set the lower limiter in the corresponding text box
-
Set the upper limiter in the corresponding text box
Prov Viewer offers an automatic collapse feature to highlight the relevant information in the provenance graph by summarizing the tracked data. This automatic collapse groups sequential information that has similar values or represents the same state, allowing the user to quickly identify relevant information or state transitions. However, this collapse currently uses only one vertex attribute (the same attribute used in the displayed color scheme) to define similarity.
The collapse process compares each vertex with its neighbor to omit similar states. If the vertices’ values are similar for the specific attribute being analyzed, then they can be collapsed into a single vertex. Vertices are considered similar if they are neighbors and their values for the specified attribute are within one standard deviation difference. Since the goal is to combine all similar states, it is necessary to go beyond the vertex direct neighbor. If any of the vertices in the collapse group have an edge to a vertex outside of the collapse group and that vertex has a similar attribute value to those in the group, then it is added to the collapse group. Thus, the collapse group will keep growing until a significant change of state is detected. The figures below illustrate an example of our similarity collapse for the gathered provenance data from a racing car doing multiple laps in a racing-track. Note that the collapse preserves the notion of different laps (differently from the merge feature) and that the collapsed vertices (with varying sizes according to the number of collapsed vertices) have similar speeds. This allows the analyst to detect behavior patterns and locations where the driver had more difficulties.
Original Graph:
Collapsed Graph:
It is necessary to follow the steps below in order to use the similarity collapse offered by Prov Viewer:
-
Generate Facts: Click the Generate Facts button in the interface. This step will generate the facts base in prolog based in the current displayed graph.
-
Initialize Prolog: Click the Initialize Prolog button in the interface. This step will load the generated fact base from step 1 and Prov Viewer's rule base.
-
Set the desired attribute: Select the desired attribute to be evaluated by changing the Attribute Status to the corresponding attribute. The Attribute Status defines the attribute to be used in the similarity collapse.
-
Set the edge type: Write the name of the type of edge to be used for the collapse. Only one type is allowed. This field is case sensitive.
-
Similarity Collapse: Click the Similarity Collapse button to make the collapse.
