Coordinated Multi-View Visual Analytics for AWS VPC Flow Log Analysis

Abstract

Cloud infrastructure produces a massive amount of network traffic logs, which play a crucial role in monitoring and detecting potential threats. Nevertheless, the process of analyzing these logs using text-based tools and static dashboards is inefficient for cloud security analysts to quickly detect anomalies and understand complex attack patterns. This paper proposes an interactive visual analytics dashboard for analyzing AWS VPC Flow Log-derived data, which enables coordinated multi-view exploration of cloud network traffic. The proposed system combines time-series visualization, geographic mapping, scatter-based anomaly detection, parallel coordinates for multivariate profiling, and connection analysis in a single interface developed using the$\mathbf{R}$Shiny platform. A user-centered assessment was performed to evaluate usability and analytical efficiency. The results show that filtering and synchronized views enhance interpretability, facilitate efficient transition from overview to detail, and facilitate the identification of anomalous behavior. The System Usability Scale (SUS) scored an average of 76.8, which surpassed the generally accepted threshold of usability. In general, the proposed approach has the potential to leverage interactive visual analytics for humancentered cloud security monitoring and exploratory network traffic analysis.