Dear testers, welcome to the data sonification experiment. Thank you for agreeing in taking part - your participation is very important to me. This page will give you more information on the testing procedure as well as examples of how the sonification will work during the test.
Let’s get started!
Overview of the project
This test aims to validate both the performance and the overall user experience of a data sonification prototype for the real-time monitoring of anomalous behaviour in Internet networks. Listening to the sounds generated by the application, the operator of a data center (in this case, you) should be able to disclose anomalous behaviour in the network, due to cyber-attacks. The sonification (i.e., the translation of data into sound) is based on the soundscape of a forest: you will hear birds, insects, other noises, rain and thunders - they all belong to the natural soundscape of a tropical rainforest (which works better because there is a higher variety of species than in European forests!). I will now give you an overview of the mapping strategy i.e., which data parameters correspond to sound parameters. It is the equivalent of a “legenda” in a data visualization and it will allow you to decode the information on the network’s behaviour when you hear the sound. The same legenda is displayed in the visual interface of the application.
Please note: during the test, you can come back to this page and refer to the legenda any time you want, if you have any doubt.
Mapping Strategy and Legenda
In general:
The elements of the Internet network you will be monitoring are clustered in groups. All elements that share a specific behaviour or specific characteristics belong to the same group. In our network, combinations of IP addresses (incoming and outgoing) and the communication protocols are clustered according to similar behaviour. Groups are decided by the anomaly detection algorithm.
In this sonification, the Internet network of Tecnalia is clustered around three groups.
Group 1 is represented by sounds of birds.
Groups 2 is represented by sounds of insects.
Groups 3 is represented by noises of the forest: footsteps, wind through the leaves, other strange animal sounds (neither birds nor insects) and so on.
The application monitors incoming data for each Group, in real-time. When data for a specific group are anomalous, the sounds in the corresponding category (birds, insects or noise) also change: they become more ‘dense’ i.e, there will be more sounds of that category in the same time interval. In practice, the perception will be of sound of that category that “accumulates”. I will later play an example for you, don’t worry.
There are two more sounds you will hear: the rain and the thunder. The rain is a simple background sound that helps us keeping your attention even when there is no incoming data. It does not mean anything in relation to the behaviour of the network.
The thunder is very important: it means that the anomaly detection algorithm that is supervising the network has identified a real cyber-attack. In fact, the network can show anomalous behaviour in the Groups even if there is no attack. As the author of the algorithm (Kaixo Aitor!) once told me, “networks are ‘a little bit’ anomalous all the time, like life is.” BUT, if the algorithm thinks that an anomaly is an attack, you will hear the sound of a thunder: a storm is coming to the network, pay attention!
Let’s have a closer look to the legenda, so that you can decipher what you hear during the test. Remember, the data category and the corresponding sounds are also indicated in the interface (see image below).
You can go back to the interface and check the mapping any time you need it during the test.
Sounds that belong to the category BIRDS represent Group 1 .
Sounds of INSECTS represent Group 2.
Sounds of other forest NOISE represent Group 3.
the RAIN is just a background, don’t pay attention.
the THUNDER represents the general alarm: there is a cyber-threat to the network.
Here you can hear a sample of how each group sounds like. Please note, there is the rain sound in the background. It is exactly as you will hear it during the test:
Here you can see a screenshot of the interface ‘Prototype 2’:
When a group is behaving anomalously, the Density parameter of the application gets higher. In the interface, you can see a little knob labeled “Density”: the higher it gets, the higher the anomaly.
IMPORTANT: during the test, you can look at the interface if you want to have a confirmation that Density is higher (you will see the little wheel - the knob - moving to the right, and the percentage of Density growing). You should be able to identify it only by hearing so, please, if you also go back to the interface to double check what you heard, note it down in the spreadsheet I will provide you!
On the left side of the interface (below “Alarm”), you can see a drop-down menu that says “Normal” when the algorithm does not find any attack. It becomes “Outlier” when there is an attack. You can look at it to double check what you hear, but please note it down in the spreadsheet if and when you do it. You can check the exact time from the interface ‘Data Simulation’ (see image below for details).
For each Group, there is a numerical display that shows a number: it is the actual incoming data for each group. Whenever the application receives a new data, the display becomes red for a moment. Data are received differently for each group (we don’t always have incoming data for each group at the same time), so don’t worry if only one group gets red. This is just to give you additional information, you can look at it if you want or not.
There are many other parameters in the interface: data interpolation, xfad, grain trigger, Groups input scale…please ignore them! When you will be expert users, you can use these parameters to adjust the soundscape quality and the data-to-sound mapping to your preferences, but not now!
Sonification examples
Here you can hear three examples of what the sonification will sound like:
1. Normal activity: the network is active but the level of anomaly is very very low. The operator can relax!
2. Anomaly: there is a higher level of anomalous behaviour, in this case in Group 1- birds.
3. Alarm: there is a cyber-attack! You can also distinguish that the attack is taking place in Group 1 - birds.
How to make the application work
By now, you will have received the installer for the application via email. Please have a look at the image which summarizes the main commands.
To launch the sonification, follow these steps:
Launch the application from your computer
Click on Audio Setup. A new window will open up: select your computer usual audio interface from the menu and switch on the main audio button.
2. Click on “Data Simulation. A new window will ope up (see image below). Click on “open file”, this will open your folders. Locate the application folder “DynAmb-exe”. Locate the “data” folder and select the .csv file you find inside (Anomalias_out_3-sel”.
Set the Data Simulator time at 8:0:0. Then click on “Start” (top left). You can stop the application from the Data Simulator. In that case, note down the time and then set it manually back where you stopped.
Lastly, go back to the main app and switch on the audio! It’s the big red button on the left (in the image it is OFF). Test has started!
How to do the test
Please fill in the following form with some preliminary questions: https://forms.gle/rkNjQ45rTJ2G8tvN9
Please take a picture of your setup, it will be for internal documentation only.
Switch on or wear your preferred sound diffusion system: headphones or earplugs, wireless or wired, are recommended.
Open the spreadsheet you received via email. You can also download it from here: https://drive.google.com/file/d/11LpLncIC6yIfMpvEVrRjdZJA9VXjAL_w/view?usp=sharing.
The questions you will have to answer are:
recognise if a group is behaving anomalously (i.e., it has a higher density of sound).
If yes, you will have to take note of the time (from the Data Simulation), identify the group and try to make a judgement on the level of anomaly (you will have to decide if it sounds low or high anomaly, there is no correct answer!). You should also try to identify how the other groups are behaving: are they anomalous or not?
Recognise if there is an attack, in which group, with what anomaly level, and also how the other groups are behaving. Please always take note of the time as indicated in the Data Simulation (not the time of your watch!).
Start the application following the instructions described above, make sure audio is ON and the volume is appropriate.
Start doing your normal tasks but remember to fill in the spreadsheet when appropriate (when you hear an anomaly and when there is an attack. Please refer to the spreadsheet for more details).
As you know, the test lasts three hours. After three hours the audio will stop automatically. If you need to leave your desk or remove the headphones it is OK, just note it down in the spreadsheet (with time).