Visualizing very large networks: an update

One of the most popular blog posts we’ve published in the last five years is Corey Lanum’s How to visualize very large networks. It was written to help answer our most frequently asked question: “We have 5 million nodes and links, how can I load them all into KeyLines?”

In reality, visualizing so much data in one screen is rarely useful or successful, so Corey described helpful strategies for managing this.

The main strategies were:

• Group and merge nodes and links to reduce the density of the network you’re trying to visualize.
• Use filters or centrality measures to visualize data one section at a time.

Since the post was published in 2014, we’ve released 10 versions of KeyLines and added lots of functionality. We now support four new techniques to help you visualize large networks.

1. Filter by time or geography

Filters are ideal for simplifying networks to find hidden structures and outliers. They provide a simple and intuitive way for users to choose which parts of the network they want to see.

KeyLines v2.0 and v2.7.1 introduced two new ways to filter: by time and by geography.

If your data has a timestamp, the time bar lets users select subsets of data by time frame, or pan through a time range to identify interesting activity in the network:

Using adaptive mode, our force-directed layouts (organic and standard) incrementally adjust as links are formed and broken, making it easy to see how the network evolves.

Almost all network data has a geographic element. KeyLines Geospatial lets users filter map-based data so they can analyze one location at a time:

2. Expand outwards

Another technique to avoid overloading your chart with too much data is to start with a small network and allow your users to work their way outwards.

When a user expands an item, incremental mode fixes existing network nodes in position and adds new nodes around them. It stops KeyLines from repositioning every node and rearranging the network with every chart layout.

3. Use an efficient layout

KeyLines’ layouts are optimized to combine efficiency with effectiveness, but the best option for large networks is the Lens Layout, first available in KeyLines v2.11.

The main advantages are:

• load time is shorter than more complex layout algorithms
• nodes are positioned across the canvas, avoiding overlap, which makes patterns clearly visible.

We still recommend that users adopt the strategies we’ve suggested for exploring subsets of data, but if you do need to load a large network, the Lens layout is your best option.

4. Deploy WebGL

There are times when a user needs to load thousands of nodes at once, for example, when they’re investigating automatically generated data like SIEM alerts.

Our WebGL graphics renderer, released in KeyLines 3.0, was designed to meet this challenge.

WebGL harnesses your device’s GPU for dramatically improved drawing performance. As a result, you can visualize vast networks with full interactivity.

Compared to our original HTML5 Canvas renderer, the WebGL component is much faster:

Some other tips

Corey’s original advice still stands:

• Filtering and Combos are excellent ways to de-clutter the chart (a function in KeyLines v3.2 made it even easier to combine these two methods)
• Centrality measures can indicate nodes and subnetworks worth your focus
• A progress bar is essential to reassure users working with large networks

But over the course of the past 10 releases, KeyLines has cemented its position as the most powerful network visualization technology, capable of visualizing the largest networks.

Put it to the test! Sign up for a free trial of the KeyLines SDK.

Try KeyLines