D3.5 - Interactive Visualization As Support to Indicator-Based Decision Making

PUBLIC DELIVERABLE

H2020 Project: Smart Resilience Indicators for Smart Critical Infrastructure D3.5 - Interactive Visualization as support to indicator-based decision making

Coordinator: Aleksandar Jovanovic EU-VRi Project Manager: Bastien Caillard EU-VRi European Virtual Institute for Integrated Risk Management Haus der Wirtschaft, Willi-Bleicher-Straße 19, 70174 Stuttgart Contact: [email protected]

SMART RESILIENCE INDICATORS FOR SMART CRITICAL INFRASTRUCTURES

Interactive Visualization as support to indicator- based decision making

Report Title: Interactive Visualization as support to indicator-based decision making

Author(s): U.Barzelay, I.Shapira, T.Knape, P. Klimek

Responsible Contributing IBM R-Tech, AIA, ED Project Partner: Project Partners:

File name / Release: D3.5_Visualization_Method_v10bc30042018 Release No.: 2 Document Pages: 52 No. of annexes: 1 data: Status: Final Dissemination level: PU

SmartResilience: Smart Resilience Grant Agreement No.: 700621 Project title: Indicators for Smart Critical Infrastructures Project No.: 12135

WP3. The SmartResilience indicator-based methodology for assessing, predicting & WP title: Deliverable No: D3.5 monitoring the resilience of SCIs for optimized multi-criteria decision-making

Date: Due date: 30/04/2018 Submission date: 30/04/2018

Keywords: Resilience, interactive data visualization, resilience indicators

P. Klimek Review date: April 6, 2018 Reviewed by: L. Bodsberg Review date: April 16, 2018

Approved by A. Jovanovic Approval date: April 26, 2018 Coordinator:

Haifa, April 2018

© 2016-2019 This document and its content are the property of the SmartResilience Consortium. All rights relevant to this document are determined by the applicable laws. Access to this document does not grant any right or license on the document or its contents. This document or its contents are not to be used or treated in any manner inconsistent with the rights or interests of the SmartResilience Consortium or the Partners detriment and are not to be disclosed externally without prior written consent from the SmartResilience Partners. Each SmartResilience Partner may use this document in conformity with the SmartResilience Consortium Grant Agreement provisions. The research leading to these results has received funding from the European Union’s Horizon 2020 Research and Innovation Programme, under the Grant Agreement No 700621. The views and opinions in this document are solely those of the authors and contributors, not those of the European Commission.

SmartResilience: Indicators for Smart Critical Infrastructures

Release History

Release Date Change No.

1 April 4, 2017 Preliminary version

2 April 26, 2018 Final version

based decision making decision based - D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5 -

SmartResilience page I

SmartResilience: Indicators for Smart Critical Infrastructures

Project Contact

EU-VRi - European Virtual Institute for Integrated Risk Management Haus der Wirtschaft, Willi-Bleicher-Straße 19, 70174 Stuttgart, Germany Visiting/Mailing address: Lange Str. 54, 70174 Stuttgart, Germany Tel: +49 711 410041 27, Fax: +49 711 410041 24 - www.eu-vri.eu - [email protected] Registered in Stuttgart, Germany under HRA 720578

SmartResilience Project

Modern critical infrastructures are becoming increasingly smarter (e.g. the smart cities). Making the infrastructures

based decision making decision based smarter usually means making them smarter in the normal operation and use: more adaptive, more intelligent etc. But - will these smart critical infrastructures (SCIs) behave smartly and be smartly resilient also when exposed to extreme threats, such as extreme weather disasters or terrorist attacks? If making existing infrastructure smarter is achieved by making it more complex, would it also make it more vulnerable? Would this affect resilience of an SCI as its ability to anticipate, prepare for, adapt and withstand, respond to, and recover? What are the resilience indicators (RIs) which one has to look at? These are the main questions tackled by SmartResilience project. The project envisages answering the above questions in several steps (#1) By identifying existing indicators suitable for assessing resilience of SCIs (#2) By identifying new smart resilience indicators including those from Big Data (#3) By developing, a new advanced resilience assessment methodology based on smart RIs and the resilience indicators cube, including the resilience matrix (#4) By developing the interactive SCI Dashboard tool (#5) By applying the methodology/tools in 8 case studies, integrated under one virtual, smart-city-like, European case study. The SCIs considered (in 8 European countries!) deal with energy, transportation, health, and water. This approach will allow benchmarking the best-practice solutions and identifying the early warnings, improving resilience of SCIs against new threats and cascading and ripple effects. The benefits/savings to be achieved by the project D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

- will be assessed by the reinsurance company participant. The consortium involves seven leading end-users/industries in the area, seven leading research organizations, supported by academia and lead by a dedicated European organization. External world leading resilience experts will be included in the Advisory Board.

SmartResilience page II

SmartResilience: Indicators for Smart Critical Infrastructures

Executive Summary

This report summarizes the results of the work in Task 3.5 of the SmartResilience project. Within the Work Package “The SmartResilience Indicator-based methodology for assessing, predicting & monitoring the resilience of SCIs for optimized multi-criteria decision-making”, Task 3.5 “Interactive Visualization as support to indicator-based decision making” addresses the following project objective: developing new methods and solutions of assessing resilience based upon indicators.

The particular objective of Task 3.5 has been to develop a methodology for interactive information visualization to assess the resilience indicators for Smart Critical Infrastructures so that the methodology will assess indicator levels and their corresponding attributes, and present them in a consumable manner to domain experts and ease the user when navigating and reasoning about the dataset

Our report is divided as follows. In Section 1, we provide an introduction to the task and its relationship to other tasks in the project. In Section 2, we review the approaches used for visualization in projects related to the SmartResilience project. In Considering that the reader may not be experienced with the visualization domain, in Section 3 we start by providing details about how one can measure the value of a visualization as well as sharing the structured process we have gone through in structuring the methodology. More specifically, we start by reviewing What is the dataset, Why are we motivated to visualize it, How it can be visualized and then continues with a detailed review of the visualization methodology. Finally, In Section 4, we provide sample use cases that can be addressed using our methodology.

As described in detail, the visual representation that we use for the resilience indicators datasets is a treepmap (as seen in the figure below) and the report is structured in such a way that also a non-technical reader would be able to understand the various decisions that were taken when structuring this visualization as well as the value it provides. based decision making decision based -

D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5 -

SmartResilience page III

SmartResilience: Indicators for Smart Critical Infrastructures

Table of Contents

Background ...... 8 Relation to other parts of the project ...... 8 Visualizations in the iNTeg-Risk project. Adapted from [23],[24],[25],[26] .... 10 2.1.1 KPIs, Monitoring performance and Benchmarking ...... 10 2.1.2 Risk Ears ...... 11 2.1.3 Risk Radar ...... 12 2.1.4 Multi Criteria Decision Making (MCDM) ...... 13 2.1.5 The Semantic Clustering Tool (S-RDI) ...... 14 2.1.6 Risk Atlas ...... 17 Visualization in Resilience Index Dashboard by ANL (adapted from [21]) ...... 18 The visualisation in SmartResilience Tool ...... 21 Visualization Task ...... 22 Resilience Visualization ...... 23 What Why and How should resilience visualization be designed ...... 23 3.3.1 What is the dataset ...... 23 3.3.2 Why visualize the dataset ...... 25 3.3.3 How to visualize the dataset ...... 26 TreeMap visualization introduction...... 27 TreeMap visualization for SmartResilience ...... 28

3.5.1 Color and cell size ...... 28 3.5.2 Color by levels ...... 28 3.5.3 Cell size using global weight ...... 29 3.5.4 Padding considerations ...... 32 3.5.5 Color by score and resiliency-level ...... 33 based decision making decision based - 3.5.6 Scaling considerations ...... 35 3.5.7 Setting order within a group of indicators ...... 37 3.5.8 Linking the model outputs to the overall SmartResilience framework: Indicators ...... 38 Use of GIS software ...... 40 Indicator/issue networks ...... 42 Compare resiliency measurements ...... 44 Focusing on hierarchy visualization using tree-map...... 45

All items must be labeled “H2020 SmartResilience” so as to be able to identify them in the event of a divestiture. D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

SmartResilience page IV

SmartResilience: Indicators for Smart Critical Infrastructures

List of Figures

Figure 1: Relations between T3.5 and other WP3 tasks ...... 9 Figure 2: Relations between the methods and models tasks ...... 9 Figure 3: Monitoring the evolution of a KPI value over time and comparing the performance of three different Companies ...... 10 Figure 4: Overview of the notions’ status ...... 11 Figure 5: Advanced assessment / criteria using RiskEars tool ...... 12 Figure 6: iNTeg-Risk Risk Radar ...... 12 Figure 7: Legend for Risk Radar...... 13 Figure 8: Example for five unconventional gas scenarios MCDM analysis based on 12 IRGC factors ...... 14 Figure 9: iNTeg-Risk Radar chart applied on two SmartResilience cases ...... 14 Figure 10: The RiskEars network as produced by an early version of the S-RDI tool showing notions (green nodes), ERRAs (red nodes), ERIs (yellow nodes) and similarity scores (grey-scale edges) ...... 15 Figure 11: S-RDI analysis for unconventional gas topic when comparing it with other ERRAs (using single link clustering option) ...... 16 Figure 12: Graphical representation of shale gas resources in Germany overlapping with natural protected areas in Baden-Württemberg (shown red) from iNTeg-Risk RiskAtlas ...... 17 Figure 13: Risk Distances in RiskAtlas ...... 17 Figure 14: Display Option Showing Values of RI Components for a Facility

Compared with Sector Averages ...... 18 Figure 15: RI Dashboard Screen ...... 19 Figure 16: Basic architecture of the integrated resilience assessment and decision support tool ...... 20 Figure 17: SCI Dashboard and Visualization (package E), top procedure ...... 20 based decision making decision based

- Figure 18: The six-level structure of CIRAM ...... 24 Figure 19: Resilience Matrix in SmartResilience ...... 25 Figure 20: Scenario "transport (aviation/airport) – terror attack" for all resilience phases ...... 26 Figure 21: A treemap visualizing hard disk space usage [13] ...... 27 Figure 22: A treemap visualizing the exported products from Japan [14] ...... 28 Figure 23: Cell color is determined by levels ...... 29 Figure 24: Cell size of indicator is proportional to global weight of the indicator 30 Figure 25: Example of the cell sizes of all the indicators ...... 30 Figure 26: Example of accumulating cell size of indicators to recursively determine the size of issue ...... 31 Figure 27: Example of accumulating cell size of phases to determine the size of

D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5 threats ...... 31 - Figure 28: Example of accumulating cell size of threats to determine the size of a city ...... 32

SmartResilience page V

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 29: Padding introduces distortions in the size proportions ...... 32 Figure 30: Using small padding can minimize distortion and still be used to express the containment ...... 33 Figure 31: Using a color scale to encode the score/resilience level of each datum34 Figure 32: Example of five scores that are encoded to different colors ...... 34 Figure 33: Visualization of a dataset with 334 indicators ...... 35 Figure 34: Visualization of a dataset with 1419 indicators ...... 36 Figure 35: Setting order within each issue eliminates clatter and emphasizes indicators distribution within each issue ...... 37 Figure 36: An un sorted treemap on the left and a sorted treemap on the right 38 Figure 37: Screenshot taken from the current version of the SCI dashboard, showing a selection of DCL (ID 48)...... 38 Figure 38: One of the Assessment of DCL (ID 48) – “Before first accident” ...... 39 Figure 39: BeforeFirstAccident Figure 40: AfterFirstAccident ...... 39 Figure 41: BeforeSecondAccident Figure 42: AfterSecondAccident ...... 39 Figure 43: Indicators and statistics visualized in a GIS map ...... 41 Figure 44: Street traffic analyzed by purpose...... 41 Figure 45: The use case study infrastructures are shown as large green circles, indicators as small blue circles. Links connect infrastructures and indicators if the indicator has been used in the assessment of an infrastructure...... 42 Figure 46: Mapping between issues and infrastructures. Blue circles represent issues. Link indicate that an issue has been used in DCLs for the corresponding infrastructures ...... 43 Figure 47: Multiples small tree-map, used to compare two resiliency measurements ...... 44 Figure 48: Multiples small tree-map, used to compare four resiliency measurements with different resiliency levels at level 1. (A) Level 1 has resiliency level of 8 (B) Level 1 has resiliency level of 6 (C) Level 1 has resiliency level of 4 (D) Level 1 has resiliency level of 2 ...... 45

Figure 49: tree-map where cell size is determined in a top down manner and a categorical color scheme is used to color siblings with the same color46

based decision making decision based

D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5 -

SmartResilience page VI

SmartResilience: Indicators for Smart Critical Infrastructures

List of Acronyms

Acronym Definition CI Critical Infrastructure CIRAM Critical Infrastructure Resilience assessment Methodology D Deliverable DB Database DHS Department of Homeland Security ECI Economic Complexity Index ERRA Emerging Risk Representative industrial Applications GIS Geospatial Information System IRGC The International Risk Governance Council KPI Key Performance Indicator MCDM Multi Criteria Decision Making RI Resilience Indicator RIL Resilience Level S Score SCI Smart Critical Infrastructure S-RDI Semantic Risk Distance Index T Task WP Work Package

based decision making decision based - D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5 -

SmartResilience page VII

SmartResilience: Indicators for Smart Critical Infrastructures

Introduction

Background Visualization is the preferred way of users to access complex data and is considered as enabler for reasoning and decision making. In the SmartResilience project the main objectives include (1) identifying existing indicators that are suitable for assessing resilience of Smart Critical Infrastructures (SCIs) (2) identifying new “smart” resilience indicators using Big Data and (3) developing new methods and solutions to assess the resilience based on the above (1,2) indicators. At the time of writing, several hundred indicators have already been collected as part of the SmartResilience project with the intention to use them to assess SCIs. Therefore, one of the results of the project is that hundreds of indicators, with the combination of new methods is going to be used to output a quantitative assessment of a SCI or city, which can be also, a single number, measuring the resilience. Motivated by the goal that end users will adopt the work that is done in SmartResilience, some immediate challenges that arise are for example: 1. How can we increase the confidence that end users have with this new metric that is based on many indicators and new methods with complex calculations? 2. Suppose that end users do have confidence in our system and method. How can we make it easier for them to discover information and conclusions so they can act? 3. Can we save time for end users and summarize the results in a way that is easier for them to consume? Using information visualization, we can take advantage of human visual perception and hopefully help meet the above-mentioned challenges.

Relation to other parts of the project The methodology developed in the context of this report is part of the effort to develop new methodologies in WP3. As a results, this methodology is dependent on the outputs of work done in WP3, such as, the methodology designed to assess resiliency using levels developed in Task 3.2. based decision making decision based - Additionally, Task 4.3 aims to provide a design and application (preferably in the form of a web application) for interactive visualization, based on the indicators gathered during the project. As a result Task 4.3 is an opportunity to demonstrate an implementation of the methodology presented in this report and demonstrate the value of the methodology, as well as, give users an opportunity to interact with the data. Finally, Task 3.7 aims to provide a web-based dashboard that will be used as the prototype for the case studies in WP5, where the work done so far in the project will be put to use, evaluated, and validated.

WP1 (baseline) provides input on the project baseline and common framework [3-5], WP2 (challenges) provides input on threats, vulnerabilities and impacts for SCIs [6-7], and WP4 (indicators) provides input on resilience indicators [8]. WP5 (case studies) provides use cases and interact with the methodology developers (T5.1).

D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

- The internal relations to other tasks in WP3 are illustrated in Figure 1

page 8 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 1: Relations between T3.5 and other WP3 tasks T3.5 (visualization) and T3.2, T3.3, T3.4 (Methods & models) take input from T3.1 (contextual factors). T3.2- T3.4 provides input to the visualization (T3.5) and the integrated tool (T3.7, which also interacts with T3.5). Finally, the assessment methodology (T3.2) and the integrated tool (T3.7) are described in the guideline (T3.6), also taking contextual factors (T3.1) into account. A more detailed description of the relations between the methods and models tasks (T3.2-T3.4) is illustrated in Figure 2.

based decision making decision based -

Figure 2: Relations between the methods and models tasks T3.2 provides a baseline assessment, as illustrated with the blue line in the Figure 2. This is a regular, e.g. yearly, assessment of the Resilience Level (RIL), whereas T3.4 (monitoring and optimization) covers long-term optimization and short-term monitoring. Long-term optimization is considering measures to increase the RIL. Various options may be considered using multi criteria decision-making (MCDM). Short-term monitoring may include monitoring the status of e.g. vital resilience resources "continuously" (e.g. during a disaster). T3.2 (assessment) follows the model described in T3.3 (and vice versa). The methodology described in this task (T3.5) aims at assessing the indicator levels and their corresponding attributes and present them in a consumable manner. D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

- The relevant information is presented and visualized (T3.5) in the integrated tool (T3.7).

page 9 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

A review of the approaches used for visualizations at projects related to SmartResilience

This chapter presents the relevant existing solutions for Risk and Resilience Indicators visualisation and analysis presentation. The main references are the iNTeg-Risk project and RI Dashboard by ANL, which are considered good visualisation solutions due to their clarity and user-friendliness. Each visualisation approach is briefly presented and considered as a possible solution for the SmartResilience project visualisation needs.

Visualizations in the iNTeg-Risk project. Adapted from [23],[24],[25],[26]

2.1.1 KPIs, Monitoring performance and Benchmarking KPIs/RIs measures can be used to inform process owners (i.e. engineer, plant manager, decision-maker, etc.) about the level of performance of the processes. Monitoring the performance of a system requires defining targets or aims for the KPIs that are measurable and achievable within a given timeframe. KPI value can be compared over time with previous ones to analyze whether performance improved or remained within the target range. Benchmarking is a systematic process of comparing and measuring the performance of a system (e.g. organization and/or its departments/units) against others with similar activities and similar risks. This allows the system to learn and eventually incorporate best practices from better performing organizations so that it can make the necessary safety improvements itself. A benchmarking process requires establishing a common set of sector based indicators that can provide organizations with the range of adequate information needed to assess their levels of risk and safety against given targets. However, comparing systems that may be complex, dissimilar and embedded in different contexts requires caution. Therefore it should be verified that stakeholders have an understanding of which indicators are appropriate to use and how to effectively judge the measurements against their target. based decision making decision based -

D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

- Figure 3: Monitoring the evolution of a KPI value over time and comparing the performance of three different Companies

page 10 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

2.1.2 Risk Ears Risk Ears is a database system for the acquisition and monitoring of early warnings. From the first "notions" indicating that something might become a threat, RiskEars enables to manage and follow the further development or maturation of the notion towards a full-scale risk (Figure 4). If a technology is new or has little historical data about potential risks and occurred accidents, the companies developing the technology and authorities providing the permission to do so, must watch for notions of potential risk scenarios related to the new technology and discuss these with experts on specific platforms dedicated to such activities. The system allows to gather notions of emerging risks coming from different sources, usually persons and/or organizations "of confidence", registered as the so-called iNTeg-Risk emerging risk sentinels, i.e. professionals rated as credible sources of notions about emerging risks. RiskEars enables the monitoring of the evolution of risks (e.g. from early notion to a litigation case). An appropriate example for this would be “Fracking”.

Figure 4: Overview of the notions’ status

“Advanced” assessment part of the RiskEars notion comprises: (1) Risk Story – Provides an overall picture of the emerging risk and context; (2) Impact scenario – Describes the key loss scenarios;

based decision making decision based (3) Risk Perception – Describes how the risk is perceived by the general public, key stakeholders or - experts; (4) Recommendations – Proposes any (existing/own) recommendations for the risk; (5) Reference and further reading – Provides references for sources of information, and provide sources for further reading, if any; (6) Decisions and measures – Provides any proposed “decisions” or measures to control and reduce this emerging risk, or mitigate the consequences of the identified loss scenarios.

D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 11 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 5: Advanced assessment / criteria using RiskEars tool

2.1.3 Risk Radar Risk Radar (Figure 6) provides the way to visualize and analyze the notions in RiskEars. In addition it feeds RiskEars with the inputs from web-analysis (on-line analysis of web contents, social networks monitoring, Twitter monitoring). based decision making decision based - D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

- Figure 6: iNTeg-Risk Risk Radar

page 12 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Risk Radar is a monitoring tool designed to identify/locate/assess the risk according to the criticality of the issue based on the following factors: • Environmental • Socio-political • Economic/Financial • Regulatory/Legal • Technological Emerging risks identified in new technologies are assessed according to the criticality of the respective risk. Figure 7 shows risks categorized in five clusters, the nearer to the center, the more critical the issue. A sample of notions can be selected and the selection for comparison can be displayed; or the most critical Twitter entries can be automatically retrieved, if the values of the risks peak more than the alarm/alert levels set.

Figure 7: Legend for Risk Radar

2.1.4 Multi Criteria Decision Making (MCDM) Multi criteria decisions are related to decisions considering more than one goal, which are often mutually conflicting. The iNTeg-Risk MCDM (Multi Criteria Decision Making) tool can be very helpful for characterizing based decision making decision based - and visualizing different cases/alternatives and help the analyst during the problem solving (decision- making). An example of the iNTeg-Risk MCDM analysis is shown in Figure 8. Measurements are derived or interpreted subjectively as indicators of the strength of various preferences. An example of the same tool applied to two cases from the SmartResilience project, using the Resilience Indicator Level (RIL) in different phases is shown in Figure 9. D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 13 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 8: Example for five unconventional gas scenarios MCDM analysis based on 12 IRGC factors

Figure 9: iNTeg-Risk Radar chart applied on two SmartResilience cases

2.1.5 The Semantic Clustering Tool (S-RDI) When missing historical data as input for an analysis, tools based on semantic clustering can be very helpful. based decision making decision based

- The Semantic Clustering Tool (S-RDI) enables to analyze and visualize similarities and interconnections between elements with text content. This capability helps analysts find relationships between different datasets or documents when processing large volumes of documents and vast amounts of data. This is an important feature when dealing with complex activities/projects which become almost unmanageable because they generate such vast amounts of documentation of all types, sizes, and shapes. The S-RDI tool (Semantic Risk Distance Index) developed as part of the iNTeg-Risk project, provides graphical representations based on similarity scores calculated by the overlap of properties and the semantic similarities of texts in order to identifies similarities between well known and well managed risk scenarios and new, emerging risk scenarios related to the evolving technology. D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 14 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 10: The RiskEars network as produced by an early version of the S-RDI tool showing notions (green nodes), ERRAs (red nodes), ERIs (yellow nodes) and similarity scores (grey-scale edges)

Semantic clustering is a technique that has been adapted by the S-RDI tool. The S-RDI tool measures the semantic similarity between keywords that have been given as input to the tool. Using these results a graph is mapped. Node size is proportional to its eigenvector centrality (~ Google's page rank - a measure of importance). The color indicates the node's degree (the deeper the red, the higher the degree). Thickness of links indicates similarities between the described network nodes. The S-RDI tool is designed to visualize and analyze similarities and interconnections between vast numbers of elements for which a textual description is available. Suppose one is confronted with, say, a thousand documents containing descriptions about different emerging risks and one is interested in finding connections between individual risks in this dataset, one needs to cluster these documents around a given number of themes or find out which of them have the largest potential to contribute to systemic risks. The S- RDI tool provides a fully automated way aiding this process. Example

For the first basic analysis of the “Fracking” topic, the technology used semantically compared risk scenarios related to fracking with the following Emerging Risk Representative industrial Applications (ERRA) and their related emerging risk scenarios considered in iNTeg-Risk project: A1: Carbon Capture and Storage A2: (Re) Insurance issues related to emerging risks based decision making decision based - A3: Automated surveillance of industrial infrastructures A4: Liquid Natural Gas re-gasification C2: Remote operations in environmentally sensitive areas C4: A typical, one-of-the-kind major hazards/scenarios D3: Emerging risks related to interaction between natural hazards and technologies For this analysis “Fracking” scenarios are connected with at least three other above mentioned ERRAs. The S- RDI tool calculates that the strongest link is with Carbon Capture and Storage applications, the second strongest with scenarios related to Liquid Natural Gas re-gasification and the third strongest with remote operations in environmentally sensitive areas. The results of this analysis is shown in Figure 11. This means that, if needed, tools and methods used for assessing likelihood/consequence analysis in “closest” technology related emerging risk scenarios may be applicable for the first assessment of emerging D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

risk scenarios on “Fracking” as well, thus giving decision maker a possible way to tackle risks emerging from - the fracking process.

page 15 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 11: S-RDI analysis for unconventional gas topic when comparing it with other ERRAs (using single link clustering option)

based decision making decision based - D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 16 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

2.1.6 Risk Atlas The GIS (geographic/geospatial information system) based part of the iNTeg-Risk 1StopShop helps to visually represent emerging risks and their possible interactions and impacts (Figure 12). Risk Atlas is a system for mapping emerging as well as conventional risks.

Figure 12: Graphical representation of shale gas resources in Germany overlapping with natural protected areas in Baden-Württemberg (shown red) from iNTeg-Risk RiskAtlas

RiskAtlas maps over 200 layers of data related to hazards and vulnerabilities, such as earthquakes, hazardous materials, and industrial plants and similar; The emerging risks can be “recognized” by screening the list of

calculated risk distances for the hazard-vulnerability pairs of points in the respective layers as shown in Figure 13. based decision making decision based -

Figure 13: Risk Distances in RiskAtlas

D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 17 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Visualization in Resilience Index Dashboard by ANL (adapted from [21]) Argonne National Laboratory, in collaboration with the DHS (U.S. Department of Homeland Security) Protective Security Coordination Division, has developed a comprehensive methodology that uses uniform and consistent data to develop a resilience index (RI) on the basis of data collected through a modified version of the DHS Enhanced Critical Infrastructure Protection (ECIP) program. The RI is derived from three categories: robustness, resourcefulness, and recovery. The survey covers around 1500 variables, which are then combined into a single Resilience Index (0 - lowest; 100 - highest) though a five-stage aggregation process. Without going into details on how the RI is calculated, we present their interactive visualization solutions. The RI enables a comparison of the level of resilience at CIs and guides prioritization of resources for improving resilience. An individual score becomes more meaningful when compared with the scores of a set of similar facilities. The RI also provides valuable information to owners/operators about their facility’s standing relative to those of similar sector assets (benchmarking) and about ways they can increase resilience. The comparison at the highest level (overall RI) provides a good indication of how the overall resilience posture at the facility compares to those of other, similar facilities. The comparisons at the next- highest level (e.g., robustness, level 1), or at numerous lower levels (e.g., electric power, level 3, or telecommunication, also level 3) provide good starting points for the owner/operator when considering which new resilience measures may be worthwhile. Figure 14 shows a display option that includes an overall RI and the three level 1 components. The sector maximum, average, and minimum values are shown as dots.

Figure 14: Display Option Showing Values of RI Components for a Facility Compared with Sector Averages

An important feature included in the Argonne work is the dashboard (Figure 15) which shows ("predicts") the effect on the resilience (index) by selecting various possible measures (i.e. changing the yes/no answers to based decision making decision based - the "indicator" questions). The tool allows managers, simply by selecting possible options for consideration, to change characteristics at each level and immediately see the changes to the overall values of the calculated indices. Instead of analyzing only one scenario, the dashboard allows managers to consider as many scenarios as needed, reducing the uncertainty inherent in risk management by providing additional information to managers trying to determine the best courses of action to take to ensure a better-functioning and more resilient facility. At the top of the dashboard screen (Figure 15), different tabs allow users to select one of the three level 1 RI parameters; resourcefulness is subdivided into resourcefulness pre-event and post-event. When one of these components is selected, the related level 2 and level 3 components appear in the middle of the screen, which enables the user to choose the different characteristics that apply to her/his facility. At the bottom of the screen, the user can see — in real time — the repercussions of modifying these components in the different

D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5 resulting RI values (bottom of the screen). Three representations are used to support this functionality

- (moving clockwise from the bottom left of the screen):

page 18 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

• A gauge shows the value of the RI for the selected level 1 component (i.e., resourcefulness); • A counter shows the value of the overall RI; • Bar charts show the values of indices for the level 2 components and compare them to the subsector averages.

The ability to change the parameters, the speed with which users can see the results, and the possibility for assessing different scenarios all serve to make the dashboard a very powerful tool and particularly relevant for helping to manage risk-related decisions about critical infrastructures.

based decision making decision based Figure 15: RI Dashboard Screen -

D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 19 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

The basic architecture of the integrated resilience assessment and decision support tool is shown in Figure 16, showing the relations between different packages. Figure 17 shows the procedure of SCI Dashboard (Package E) usage, which includes the visualization module (Package F).

Figure 16: Basic architecture of the integrated resilience assessment and decision support tool

START

RI Database SCIdash_SETUP

SCIdash_Monit x SCIdash_Ind x SCIdash_RIL

SCIdash_Vis

SCIdash_Opt

Package B Package C

SCIdash_Vis based decision making decision based

- (final visualisation)

Visualisation SCIdash_ Big Data (Package F) Report Tools

SCIdash_ SCIdash_ ReportWeb ReportPDF

END

x - Data Exchange Tool D + Big Data analysis support

Figure 17: SCI Dashboard and Visualization (package E), top procedure D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 20 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

The visualisation in SmartResilience Tool Out of the options considered above the visualization already implemented of yet to be developed in the SmartResilience Tool includes or will include the following elements: • The interdependencies (see chapter 2.1.6) • The critical risk/resilience distances (see chapter 2.1.6)) • The MCDM-related visualization, apart from the radar diagrams (for different options) also the min- mean-max barchart diagrams (see chapter 2.1.4) In addition the networking options and the vitalization from Figure 4 to Figure 13 will be included shifting the emphasis from risk visualization towards resilience visualization. The options implemented until M24 in the project are described in the draft report on the deliverable D3.7 (software tool). based decision making decision based - D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 21 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Visualization methodology

Visualization Task When developing the proposed methodology, we were motivated to compose and create a visualization that would be useful for the end user who would eventually use the methodology and the visualization tool. One might rephrase and state that we aimed to create a methodology with the highest value. We assume some readers are not familiar with visualization measurement techniques and so we briefly review the subject here. The question that should come into mind is how can one measure the value of visualization? Stasko [1] suggests that the success of the visualization can be measured using the following equation: Value (of visualization) = Time + Insights + Essence + Confidence Time characterizes the ability to reduce the overall time that a user will spend in order to get answers for various questions that arise when interacting with the data. Insights stands for the ability to discover information and conclusions about the data where an obvious guideline is that if you learn nothing new from the visualization it is useless. Essence is the ability to convey the big picture or to provide the key take-away of the dataset. It is the ability to turn a large number of datums and output a single representation that highlights the characteristics of the dataset in the context of the domain. Confidence quantifies the amount of trust that a person using the visualization will have when viewing the visualization. Obviously, if the visualization transforms the data (e.g., by aggregation) and encodes it (e.g., using size, angle, curvature etc’) then those transformation and idioms must preserve the properties of the data itself in order to increase the confidence of a user.

The above model is well known in the visualization community and is used to discuss and compare different visualizations. However, this approach is motivated by reviewing the end result and it does not discuss the tasks and steps that one should follow when trying to develop a visualization methodology that is composed of high level abstraction and low level interdependent tasks that will be performed by the user. Muzner and Brehmer [3] suggest a multi-level classification of the process that one should follow in order to

based decision making decision based develop a methodology and they present the process as a sequence of questions and steps that need to be - answered as the methodology is developed. In their work, Munzer and Brehmar suggest that the visualization process should focus on the questions of Why, What and How. Why refers to the reasons that one would have to use the visualization. When considering motivation of the visualization end user we should ask ourselves what is the goal that a user is trying to achieve? Is the user trying to search for specific datums, to explore, browse, locate, lookup datums? Is the user interested in summarizing, comparing or identifying data? Sometimes that goal is simply present the dataset in a consumable manner and a visually appealing manner for the purpose of discovery and enjoyment. How refers to the methods used in data science and visualization such as the visual encoding of data (using color, shapes, motion etc’ ), its manipulation (selection, navigation) and so forth. What refers to the input type of the visualization task, meaning, the datasets and the attributes that characterize the datums. Datasets are described in an abstract form which is domain agnostic. Data can be provided as tables or networks and each datum can be categorical, ordered, un-ordered, sequential, non- D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

- sequential and so forth.

page 22 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Asking the Why, What and How provides a common basis for analysis that does not solely refer to interdependent small tasks [2] that are performed during the interaction phase. Therefore the analysis of the visualization will use the above mentioned succinct and abstract terms in order to reason about and evaluate the fulfilment of the visualization goals.

Resilience Visualization As mentioned in previous sections, we are motivated to create a generic visualization methodology that will ease the user when navigating and reasoning about a resilience related dataset. We strive to offer a methodology that focuses on the resilience indicators and the resilience measurements that will eventually be given to cities and CIs. The following section walk through an example of how one can create a new methodology for visualization, we assume no prior knowledge, therefore it is lengthy, it goes through discussion on the classification of the process mentioned in Section 3.1. Section 4 talk about additional resilience visualization methodology without providing analysis of the What, Why and How.

What Why and How should resilience visualization be designed We provide our analysis of the mission at hand by conveying our understanding of the What, Why and How in the form of a discussion: What distinguishes resilience indicators related dataset, Why should one would want to visualize such a dataset and then possible approaches to visualization, or rather, How to visualize the data.

3.3.1 What is the dataset We realize that some of the readers do not have previous experience with the resilience and risk indicators domain, when we refer to What we observe from a resilience dataset, as mentioned in D1.2 [4], it is typically a dataset composed of dozens and up to hundreds of indicators. Indicators can be thought of as the basic unit of measurement for resilience. Each indicator describes a distinct property that eventually is expected to have a measurable influence on the overall resilience level of a SCI. As proposed in D3.2 [6], the resilience assessment methodology, referred to as CIRAM, leverages and is based on resilience indicators. CIRAM proposes a hierarchical method to assess resilience at different levels.

CIRAM proposes six levels of assessment as shown in Figure 18 below. We observe that the levels have a hierarchical structure: Level-1 describes a city or an area whose resilience attribute is characterized by the underlying possibly multiple CIs at level-2.

based decision making decision based Level-2 describes a critical infrastructure whose resilience attribute is characterized by the underlying - possibly multiple threats at level-3. Level-3 describes a threat whose resilience attribute is characterized by the underlying possibly multiple phases at level-4. Level-4 describes a phase whose resilience attribute is characterized by the underlying possibly multiple issues at level-5. Level-5 describes an issue whose score is characterized by the underlying possibly multiple indicators at level-6. Finally, level-6 describes an indictor and its value. D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 23 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 18: The six-level structure of CIRAM

Furthermore, the calculation of the resiliency levels is based on the values provided by deeper levels and is performed in a bottom-up manner, meaning, that first the values are assigned to the indicators themselves at the deepest level (level-6) and afterwards calculations are performed on consecutive levels. The calculations from level-6 are used for calculations at level-5. The calculations from level-5 are used for

calculations at level-4 and so forth. The characteristics of the CIRAM method donate a tree type to the dataset. This is an important conclusion since it should influence the way we should develop the methodology. Looking at Figure 18 it is also clear that the methodology has a tree structure where the root node of the tree is the level-1 element which is the city or area. Furthermore, we also observe an additional characteristic of the dataset, where all leaves have the same depth or level, where this property is a direct result of the fact that indicators are the basis for the based decision making decision based - evaluation of upper levels. Another property to notice is the resilience matrix notion, seen at Figure 19, which refers to the phases and dimensions. D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 24 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 19: Resilience Matrix in SmartResilience

So far, we have presented the resilience dataset in a high-level manner and witnessed its graph tree like properties. We continue by zooming into the characteristics of the datums that characterize each layer. We use the format of the indicators and issues detailed in D1.4 [7], since the RI template specification will eventually be used to collect and store indicators and therefore will be the basis for constructing a dataset.

We refer the reader to D1.4 [7] for a detailed review of the fields. From this point forward we focus on key fields that characterize indicators. Obviously, each indicator and issue must have fields used for identification such as ID, Type, Name and so forth where the majority of which are categorical attributes, these attributes can be free text. Indicators which by nature are used for the quantification of resilience must have a measurement whose value is between the min-value and the max-value. Additionally, as stated by CIRAM, each indicator has a weight used when calculating the value of the issue at the top level. Furthermore, each element in each level (phase, threat etc.) is assigned a weight used to calculate its upper level resiliency score. Hence, an important observation is that the scores/values and weights are sequential.

based decision making decision based 3.3.2 Why visualize the dataset - Now that we have an understanding of what the dataset is, we can proceed and focus on the task of Why as described in Section 3.1. When asking the question of Why, we focus on the needs of a user and why the user will choose to use our visualization. First most, as mentioned in the reference approaches section, although much research is done in the area of resilience and risk assessment, visualization is not commonly used in these domains. Therefore, we are optimistic that a profound impact [10] can take place by the introduction of visualization to present resilience data. In the project proposal [8], the requirements from the visualization at T3.5 are as follows: “The methodology will assess the indicator levels and their corresponding attributes, and present them in a consumable manner to domain experts”. Therefore, we are motivated to create a methodology that will enable the user to visualize the indicators, D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

and attributes that characterize different levels (issues, phases, dimensions etc.). -

page 25 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

More specifically, It is clear that a vast amount of indicators will be defined and accumulated during the SmartResilience project. Therefore, we anticipate that the number of leaves/indicators that will compose a resilience measurement of a SCI in each use case [9] will be significant. We provide an example here to discuss possible tasks that the user will find helpful. As an example, let us focus on a sample use case that quantifies the resiliency level of the Budapest airport when facing a terror attack. In this scenario, there are datums as follows: 1. A single datum at each of the levels 1,2,3. A total of three datums. 2. Five datums at level 4. 3. Up to five datums at level 5. 4. At the time of writing more than 900 indicators were collected. Let us assume that 10 indicators will be defined per issue. Therefore, 250 indicators, 25 issues, 5 phases, 1 threat, 1 SCI and 1 city will compose the dataset. A total of 283 datums will compose the dataset. If multiple threats are added or additional indicators are used, the dataset will include over a thousand datums.

Figure 20: Scenario "transport (aviation/airport) – terror attack" for all resilience phases

This observation is key to fulfilling the user needs since we anticipate that the set of datums used to calculate the resiliency of a city will be very large. This motivates us to present a methodology that supports the following actions: based decision making decision based - • Discover indicators that have low levels and negative/positive influence on the resilience levels • Summarize and Compare the resilience measurements at different times and Identify and Derive differences.

3.3.3 How to visualize the dataset To conclude the process of proposing the methodology, we will now explore and present the various visual encodings of the data attributes and propose a metaphor used to present the data. This task is discussed in detail in the following sections.

D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 26 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

TreeMap visualization introduction As previously noted, the dataset is characterized as having a hierarchical tree structure which motivates us to use a Treemap [11,12]. Treemaps display hierarchical data as a set of nested rectangles. Each rectangle represents a node in the tree and each rectangle is filled with additional rectangles to represent the children of the node. Leaf nodes are represented as rectangles as well and do not have inner rectangles. According to the visualization metaphor, both the colours and sizes of the cells are determined. Treemaps make efficient use of space and can display thousands of items on the screen simultaneously.

Figure 21: A treemap visualizing hard disk space usage [13]

In Figure 21 the hard disk space usage is visualized using a treemap, each folder in the file system is represented by a rectangle (or a node) which may contain additional rectangles. A file is shown as a rectangle that does not contain additional nodes. Figure 22 below displays the products exported from Japan, used when reviewing the ECI index [15]. based decision making decision based - D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 27 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 22: A treemap visualizing the exported products from Japan [14]

Motivated by the potential of the treemap as a vital visualization idiom for resilience indicators, we proceed to discuss the visual encoding of our dataset so that it will be visualized using a treemap.

TreeMap visualization for SmartResilience

3.5.1 Color and cell size The fundamental choices we need to make are related to:

1. The logic that will determine how and what colors we will be assigned to cells within the treemap. 2. The logic by which the sizes of the cells are determined. In the following sections, we present the possible alternatives.

3.5.2 Color by levels One option is to encode the color of each cell according to its depth, that is according to the type of level based decision making decision based - that the cell represents. In Figure 23 below, indicators (level-6) are colored in green. Issues are colored in light green, phases are colored in light yellow, threats are colored in light orange, critical infrastructures are colored in orange and a city/area is colored in dark red.

D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 28 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 23: Cell color is determined by levels

A set of indicators is used to determine the values of an issue and therefore, indicators compose an issue. We can view the set of indicators that compose an issue by looking at the issue that contains them. In the example above, the issue “System/Physical issue_0” contains three indicators (indicator_1, indicator_2 and indicator_3). Therefore, the hierarchy of the dataset is expressed by containment and the layout of tree is such that expresses this containment and hierarchy. Similarly, the issue “System/Physical issue_0” is contained within the phase “Understand risks” at the bottom left. The threat “Terror attack” is composed of two phases: “Understand risks” and Anticipate/Prepare”. The “ICT” CI contains two threats: “Cyber attack” and “Terror attack”. Lastly, the “Tel Aviv” area contains one CI, the ICT CI.

While this representation is useful to explore the levels of the dataset it is not very informative and therefore not recommended as the default view of the visualization. In the following sections, we will provide additional color encodings that support specific user tasks. Before that, it is important to understand the way that the layout of the tree is calculated and the logic that is used to set the size of each cell. based decision making decision based - 3.5.3 Cell size using global weight As discuss in D3.2 (and mentioned in this report in Section 3.2.1) when describing the Resilience assessment methodology (CIRAM) there is a guideline to give weights at every level. Individual weights can be assigned to the indicators. The weights can be assigned equally but a user has an option of providing a specific weight for each element (e.g., indicator, issue etc.) since some elements may have different effect on the resilience level and not all elements are equal, We propose that the size of an indicator cell be proportional to the weight of the indicator on the overall resiliency score be given to the level-1 area. The logic of this encoding is that it will differentiate between indicators that are more significant than others and will assist for example, with locating indicators that are casing deterioration of the overall resilience. We refer to the global-weight of an indicator as the percentage of the score of the level-1 entity that this indicator will determine. In Figure 24 below we show an example of how the global-weight of indicator_1 was calculated. The outcome is that a specific indicator has a global value of approximately 8% and therefore the indicator was assigned approximately 8% of the entire area used to draw the visualization. D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 29 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 24: Cell size of indicator is proportional to global weight of the indicator

Similarly, the Figure below provides the global weight for all 14 indicators. Because the global-weight of the indicators was calculated using the weights from upper level entities (e.g., issue, phase and so forth) the size of the issue that surrounds a set of indicators is inherently proportional to the global-weight of that issue, where the global-weight of an issue defines the portion of an issue from the resiliency score of the level-1 entity. Similarly, we define the global-weight of each entity as the portion that the entity has when calculating the level-1 resiliency measurement. The following figures depict the various sizes of elements in different levels. based decision making decision based -

Figure 25: Example of the cell sizes of all the indicators D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 30 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 26: Example of accumulating cell size of indicators to recursively determine the size of issue based decision making decision based -

Figure 27: Example of accumulating cell size of phases to determine the size of threats D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 31 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 28: Example of accumulating cell size of threats to determine the size of a city

3.5.4 Padding considerations As described in previous sections, we express the hierarchy of the level using containment visible by adding padding between cells in different layers. As described in the previous section, we express the weight of an element by assigning a proportional cell size. However, there is a tradeoff between a large padding and a small padding value – when using a large padding value the hierarchy is more visible but there is less space to render the indicators, thus, the proportion between the indicator size and its global weight is less accurate. Similarly, when using a small padding value there is more space to express ratio between the indicators and their global weight but this comes at the cost of losing some of the visibility of the hierarchy, hence, there is a tradeoff as described in the figure below. based decision making decision based - D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

- Figure 29: Padding introduces distortions in the size proportions

page 32 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

The figure below shows two different setups for padding, used on the same dataset. The treemap on the right side expresses the weight of the indicators with less distortion than the treemap on the left. As stated, the hierarchy of the dataset is better expressed at the image to the left.

Figure 30: Using small padding can minimize distortion and still be used to express the containment

3.5.5 Color by score and resiliency-level In previous sections, we introduced the treemap where the color encoding was based on the level of the entity and stated that such an encoding is not very informative. Furthermore, we are motivated to present the resiliency levels assigned to each element. This thinking motivated us to color each cell according to the resiliency score it was given, in the example below we use red color to encode low scores/values and green

color to encode high scores/values. According to the current methodology defined in D3.2, indicators and issues have scores on a scale of [1,5], and entities in upper levels have scores on a scale of [0,10]. Although different entities may have different scoring scales, we propose the use of a single diverging color schema, since it results in a more consistent and intuitive look. The color scheme currently used is shown on the right side of the figure below, we use a color scheme implemented by D3 [16] and based on the work of Cynthia Brewer [17]. based decision making decision based - The introduction of resilience level encoded as color reveals additional information. As seen in the example below, it is apparent that the overall resiliency level of the level-1 entity is reduced due to “bad” scores at phase “Respond/Recover” under the “Cyber attack” threat. D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 33 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 31: Using a color scale to encode the score/resilience level of each datum

The figure below visualizes a different dataset than the one used so far to demonstrate different colors assigned to indicators for the purpose of demonstrating the use of the selected color scheme. based decision making decision based -

Figure 32: Example of five scores that are encoded to different colors

D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 34 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

3.5.6 Scaling considerations In the examples that were presented so far, we have seen treemaps that visualize 14 indicators. In the section describing the dataset, we presented calculations that explain that a typical dataset will have hundreds or thousands of indicators. One of the properties of treemaps is that they make efficient use of space and are indeed able to represent a large number of elements. In the following figures we present a couple of visualizations in which a larger number of indicators was used and the descriptive power of the visualization is maintained.

Figure 33: Visualization of a dataset with 334 indicators based decision making decision based - D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 35 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 34: Visualization of a dataset with 1419 indicators

based decision making decision based -

D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 36 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

3.5.7 Setting order within a group of indicators In Figure 34 above, a set of indicators that compose an issue appear in no specific order. We can introduce order in a set of indicators using a convention where indicators with high scores appear on left side of an issue and indicators with low values appear on the right side of an issue. The figure below demonstrates the order of indicators, applied with an issue. based decision making decision based -

Figure 35: Setting order within each issue eliminates clatter and emphasizes indicators distribution within each issue

D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 37 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

The figure below shows a comparison between the treemaps visualizing the same dataset. The treemap on the left does not sort the elements whereas the image on the right does sort the elements. The sorting is applied in all the levels and so elements with “better” (higher) values are aggregated on the left side, which results in a visualization that is easier to comprehend and is more visually appealing.

Figure 36: An un sorted treemap on the left and a sorted treemap on the right

3.5.8 Linking the model outputs to the overall SmartResilience framework: Indicators

Figure 37: Screenshot taken from the current version of the SCI dashboard, based decision making decision based - showing a selection of DCL (ID 48).

The output of the visualization models described in this section is linked to the overall SmartResilience framework by providing infrastructure DCL (Dynamic Checklist) to use case scenario. That is, the observable model parameters are directly related to the DCL infrastructure. For example, Figure 37 is a screenshot from the current version of the SCI Dashboard that shows the different assessment of the same infrastructure DCL (ID 48) over time (BeforeFirstAccident, AfterFirstAccident, for example) for the ECHO use case. We can then select one of the assessment and get its matching resilience matrix data (see figure 38). The SCI Dashboard provides a data export service to enable use of this data.

D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 38 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 38: One of the Assessment of DCL (ID 48) – “Before first accident”

Once we export the data of the different assessment of the same infrastructure DCL (ID 48) we can visualize the data (based on the visualization model) analyze it and get insights about the use case. The example below shows the visualization of real data from the SCI Dashboard that was exported. In this case we exported ID-48, ID-49, ID-50, ID-51 as seen in Figure 37 and then create a visualization. Those assessments are different assessment of the same infrastructure DCL using the visualization (cell color are by resilience level) we can get insights.

Figure 39: BeforeFirstAccident Figure 40: AfterFirstAccident based decision making decision based - D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

- Figure 41: BeforeSecondAccident Figure 42: AfterSecondAccident

page 39 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Additional resilience visualization

In the previous Section we show how to create new methodology for visualization. We went through the classification process of answering the What, Why, How. We discussed the value of the visualization methodology on every feature. In the following section we will present additional resilience visualization methodology that are being used for resilience assessment, without providing analysis for What, Why, How.

Use of GIS software Emergency managers can use geographical information systems (GIS) to understand what is at or nearby a location. GIS can visualize how features of an area change over time and show travel patterns applicable at different times of the day. Electronic maps support the understanding of a district of a city exposed to flooding for example. City authorities can use this knowledge to tailor alert messages to civilians for instance.

We have used ESRI ArcGIS to visualize transport related performance indicators such as congested speed, average queuing and statistics such as the number of lanes, car flows, LGV & HGV flows, public transport flows including bus and rail flows on an electronic map for Cork City (see figure below). The visualization of demand model-based traffic flow KPIs per street level at specific time periods during the day helps emergency managers plan access routes to emergency locations, coordinate with local staff bringing up warning signs directing citizens to use new temporary public transport routes. The Environment Department of Cork City Council, CCC operates monitoring arrangements with reference to data on weather, tidal range and fluvial levels with a view to forecasting and operating a 3 stage Flood

Warning scheme. In the event of city centre streets being inundated by flood waters, damage to property and shops is greatly increased if traffic and particularly larger vehicles still continue to travel through the flood waters. The Transportation Division is responsible for the response to Flood Warnings with regard to restricting access to flooded street and implementation of closures using barriers and Statuary Road Signs. The based decision making decision based - availability of more accurate data street level parameters would facilitate targeting the Flood Warning messages to the most relevant groups. The city operates a number of Twitter accounts which can be used to provide more timely advice and highlight hazards which can be targeted to particular user groups. The Traffic Control Centre operates a Variable Message Sign (VMS) system that can be used to advise members of the public of the Flood Warning forecast and the particular areas & streets being impacted. During the course of any event such as Flood events in the city centre, the use of VMS messaging and Twitter has to be relevant, accurate and timely to be effective and the potential availability of more specific geographical information systems (GIS) for Emergency Managers in Cork would certainly enhance the resilience of the city centre in the context of Flood Events and support the adoption of mitigation measures.

D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 40 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 43: Indicators and statistics visualized in a GIS map

Street traffic by purpose and time during the day can be analysed allowing emergency responders to better address the groups that would mostly use the streets (see figure below).

based decision making decision based - Figure 44: Street traffic analyzed by purpose

We have primarily used RapidMiner for analysing datasets and reviewed results using charting functionality in RapidMiner. For visualisation and enabling end users to interact we have worked with ESRI ArcGIS. We plan to add further data visualisation into ESRI including first responder activity per location in the city.

D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 41 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Indicator/issue networks

Figure 45: The use case study infrastructures are shown as large green circles, indicators as small blue circles. Links connect infrastructures and indicators if the indicator has been used in the assessment of an infrastructure.

CI systems do not operate isolated from each other but are highly interconnected. In some cases, these interconnections are obvious, in other cases some less obvious interconnections can be inferred from data.

Based on the resilience assessment methodology (CIRAM) an issue or indicator can be used in the

assessment of different infrastructures (but in the same threat), this might signal a specific interdependence. The idea behind the indicator/issue network approach is to leverage this information. In the Indicator-based approach shown in Figure 45 we show the use case study infrastructures as large green circles and indicators as small blue circles. A link between an indicator and an infrastructure is made if the indicator was used in the assessment of the infrastructure at least once. Note that the same mapping based decision making decision based - that is done in Figure 45 can also be made for issues and infrastructures, see Figure 46. Moreover, identifying indicators that are relevant for the assessment of interdependences as those that have repeatedly been used to assess two different infrastructures under the same threat, opens up the way to build a learning database of resilience indicators in which the system becomes able to propose indicators for a given assessment—based on their use in past assessments of similar scenarios. The Indicator/issue network is explained in more details in D2.3 [27]. In terms of visualizing such networks, we propose force-directed layout algorithms. These algorithms try to find a layout in which (i) nodes that are “close to each other” in the network (that are connected to each other or that share many links in their neighborhoods) are also close to each other in the visualization but (ii) at the same time the network should not be cluttered, i.e., there should be a minimum of overlap between nodes and crossings of links. A force- directed layout assumes that the nodes lie on a plane and that each node carries the same charge so that two nodes repel each other the close they get. Furthermore, nodes that are connected by links are coupled

D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5 by springs and attract each other. The network layout is the configuration of nodes in a plane where the

- repulsive and attractive forces between nodes balance each other. Such layout algorithms are readily

page 42 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

implemented in many mathematical high-level programming languages. Here, we used the open source software Gephi (available under www.gephi.org) to visualize the data.

Figure 46: Mapping between issues and infrastructures. Blue circles represent issues. Link indicate that an issue has been used in DCLs for the corresponding infrastructures based decision making decision based - D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 43 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Sample use cases

Compare resiliency measurements For a user task whose goal is to compare the resiliency level of an area at different times, we are given multiple datasets with each one corresponding to single resiliency measurement. We can use the treemap visualization as described in previous sections to visualize the various datasets and compare them to one another using the small multiples technique [18]. This technique basically aligns several visualizations (e.g., graph charts, pie charts etc.) next to one another, so each instance of the visualization can be easily compared to other visualizations of the same type. Therefore, we suggest aligning different treemaps using the same scale to compare resiliency measurements taken at different times, as shown in the figure below.

based decision making decision based Figure 47: Multiples small tree-map, used to compare two resiliency measurements -

Additionally, we can use multiple small tree-maps, as seen in the figure below, to compare different resiliency measurements of the same area that were calculated at different times. Theoretically, the same technique can also be used to compare resiliency of different cities. However, this is applicable only if the various cities share the exact structure of the resiliency calculation elements, that is, the same elements (e.g., threat, phase, issue) exist in both cities and are assigned the same weights. This property is mandatory, otherwise, the tree-maps will have different layouts which will make the visual comparison task useless. D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 44 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 48: Multiples small tree-map, used to compare four resiliency measurements with different resiliency levels at level 1. (A) Level 1 has resiliency level of 8 (B) Level 1 has resiliency level of 6 (C) Level 1 has resiliency level of 4 (D) Level 1 has resiliency level of 2

Focusing on hierarchy visualization using tree-map By choosing a different color encoding and a different size encoding we can emphasize the hierarchy of the elements in the dataset. In the figure below, we use a categorical color scheme and each set of siblings is given the same color. Additionally, the size of cells was determined in a bottom-up manner, where the size of the indicator cells was first determined and then the sizes of upper levels elements was recursively set. In the figure below we use a top-bottom approach to set the sizes of cells where each set of siblings is given the same size. Specifically, both CIs are given 50% of the drawing area (and are given that same color of light yellow since they are siblings). Similarly, within the CI ICT there is a single threat (Terror attack) and the threat is composed of three siblings of type Phase. Therefore, each Phase is given a cell size which represents a third of the area assigned to the Threat. The layout is further calculated recursively, down to level-6. However, there are other visualizations [19,20,21] that better depict a tree structure such as using indentation or a node-link diagram. Additionally, this visualization does not encode the weight assigned to the elements, nor does it encode the resiliency score and therefore its value is not high. Finally, this encoding scheme should be considered as useful to glance at the tree structure using the same visualization idiom (i.e, tree-map) and can be considered if the user is already using a treemap to visualize the dataset and has become accustomed to using a treemap, In this case, this visualization can be considered an additional side view, but not the main visualization. based decision making decision based - D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 45 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Figure 49: tree-map where cell size is determined in a top down manner and a categorical color scheme is used to color siblings with the same color

based decision making decision based - D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 46 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Conclusions

In this report we develop a methodology for interactive information visualization to assess the resilience indicators for Smart Critical Infrastructures so that the methodology will assess the indicator levels and their corresponding attributes, and present them in a consumable manner to domain experts. We start with the following background (i) existing solutions for Risk and Resilience Indicators visualization and analysis presentation ( iNTeg-Risk project and RI Dashboard by ANL 2) (ii) review visualization measurement techniques, more specifically, we reviewed Stasko's formulation to measure the value of a visualization which is formulated as Value (of visualization) = Time + Insights + Essence + Confidence. Stasko's approach is motivated by measuring the value of the visualization, not the method that was used to develop the visualization itself. (iii) We present Muzner and Brehmer "Why, What and How" methodology that one can use as part of the process of developing the visualization. We then answer the "What Why and How" questions in terms of resilience visualization to guide us through the process of constructing the methodology. What - is the resilience indicators dataset, typically a dataset composed of dozens and up to hundreds of indicators that is structured based on CIRAM method (a tree type to the dataset), Why - we want to visualize the dataset to ease the user when navigating and reasoning about a resilience related dataset and How - we discuss possible approaches to visualization, since the dataset is characterized as having a hierarchical tree structure this motivates us to use a Tree-Map. We show that Treemaps make efficient use of space and can display thousands of items on the screen simultaneously. We show possible alternative to use the resilience indicators dataset in tree-Map (i) Alternatives to determine how and what color encoding will be assigned to cells within the treemap (ii) Alternatives to calculate cell size (iii) Alternatives for padding between cells (iv) We show how treemaps make efficient use of space and are indeed able to represent a large number of elements (v) Alternatives to

sort the elements from the same level, we show that sorting by elements score gives results in a visualization that is easier to comprehend and is more visually appealing. The value of our visualization methodology, as measured by Stasko's measurement technique is high since it enables to user to visualize BIG amounts of data and come to conclusions in a short time (, It enables the user to get insight (e.g., detecting outliers, detecting problematic issues, threats etc') and enables a user to grasp the big picture (the essence). Finally, the transformation of the raw numbers in the dataset to cells within the based decision making decision based - treemap is a simple linear transformation and therefore the user's confidence level in the visualization is high. D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 47 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

References

[1] John Stasko, "Value-Driven Evaluation of Visualizations", Proceedings of BELIV 2014, Paris, France, November 2014, pp. 46-53. [2] R. Amar, J. Eagan, and J. T. Stasko. Low-level components of analytic activity in information visualization. In Proc. IEEE Symp. Information Visualization, pages 111–117, 2005. [3] A Multi-Level Typology of Abstract Visualization Tasks. Matthew Brehmer and Tamara Munzner. IEEE Trans. Visualization and Computer Graphics (Proc. InfoVis), 19(12):2376-2545, 2013. [4] SmartResilience (2016). Deliverable D1.2: Analysis of existing assessment resilience approaches, indicators and data sources. http://www.smartresilience.eu- vri.eu/sites/default/files/publications/SmartResD1.2.pdf [5] iNTeg-Risk Project website, http://www.integrisk.eu-vri.eu/, accessed on May. 02, 2017 [6] SmartResilience (2016). Deliverable D3.2: Assessing resilience of SCIs based on indicators http://www.smartresilience.eu-vri.eu/sites/default/files/publications/SmartResD3.2.pdf [7] SmartResilience (2016). Deliverable D1.4: Resilience indicators database http://www.smartresilience.eu-vri.eu/sites/default/files/publications/SmartResD1.4.pdf [8] SmartResilience (2015). Smart Resilience Indicators for Smart Critical Infrastructures – Project proposal Call: H2020-DRS-2015, DRS-14-2015. Coordinator: EU-VRi, www.smartresilience.eu- vri.eu. [9] SmartResilience (2016). Deliverable D1.3: End users’ challenges, needs and requirements for assessing resilience. http://www.smartresilience.eu- vri.eu/sites/default/files/publications/SmartResD1.3.pdf [10] Readings in information visualization: using vision to think SK Card, JD Mackinlay, B Shneiderman

Morgan Kaufmann [11] Tree-maps: A space-filling approach to the visualization of hierarchical information structures B Johnson, B Shneiderman Proceedings of the 2nd conference on Visualization'91, 284-291 [12] Tree visualization with tree-maps: 2-d space-filling approach, B Shneiderman based decision making decision based - ACM Transactions on graphics (TOG) 11 (1), 92-99 [13] https://en.wikipedia.org/wiki/Treemapping [14] https://en.wikipedia.org/wiki/File:Japan_Export_Treemap.jpg [15] https://en.wikipedia.org/wiki/List_of_countries_by_economic_complexity [16] https://github.com/d3/d3-scale-chromatic#interpolateRdYlGn [17] Brewer, Cynthia A., 200x. http://www.ColorBrewer.org, accessed at 30/04/2017 [18] TUFTE E. R.: The Visual Display of Quantitative Information, second ed. Graphics Press, 2001. 2 [19] Scalable, Versatile and Simple Constrained Graph Layout. Tim Dwyer. EuroVis 2009 [20] Graph Visualization and Navigation in Information Visualization: A Survey, Herman, Melancon, and Marshall, IEEE TVCG 2000 [21] A Comparison of the Readability of Graphs Using Node-Link and Matrix-Based Representations. D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

- Ghoniem, Fekete, Castagliola. InfoVis 2004

page 48 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

[22] Fisher, R.E., Bassett, G.W., Buehring, W.A., Collins, M.J., Dickinson, D.C., Eaton, L.K., ...,Peerenboom, J.P. (2010). Constructing a Resilience Index for the Enhanced Critical Infrastructure Protection Program, Argonne National Laboratory, Decision and Information Sciences Division, ANL/DIS‐10‐9, Argonne, IL, USA http://www.ipd.anl.gov/anlpubs/2010/09/67823.pdf [23] Jovanovic, A. (2011). iNTeg-Risk ERMF: The Emerging Risk Management Framework, Deliverable 2.1.2. [24] Jovanovic, A., Löscher, M. (2013). iNTeg-Risk project: How much nearer are we to improved “Early Recognition, Monitoring and Integrated Management of Emerging, New Technology related Risks”? EU-VRi, Willi-Bleicher-Straße 19, 70174 Stuttgart, Germany. [25] Baloš, D., Cozzani, V., Jovanovic, A. (2012). iNTeg-Risk ERMF: Active catalogue of KPIs for Emerging Risks and methods on how to build iNTeg-Risk KPIs, Deliverable 2.4.1. [26] DIN CWA 16694 (DIN SPEC 91299):2013-10. Managing emerging technology-related risks; English version CWA 16649:2013. [27] SmartResilience (2018). Deliverable D2.3: Report on interdependencies and cascading effects of smart city infrastructures http://smartresilience.eu- vri.eu/sites/default/files/publications/SmartResD2.3.pdf based decision making decision based - D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 49 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

A N N E X E S

based decision making decision based - D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 50 SmartResilience

SmartResilience: Indicators for Smart Critical Infrastructures

Annex 1 Review process

The Content of this Annex has been submitted as part of the periodic review report to the PO/EU/ Reviewers. based decision making decision based - D3.5 Interactive Visualization as support to indicator to support as Visualization Interactive D3.5

page 51 SmartResilience