One of the most popular blog posts we’ve published in the last five years is Corey Lanum’s How to visualize very large networks. It was written to help answer our most frequently asked question: “We have 5 million nodes and links, how can I load them all into KeyLines?”
In reality, visualizing so much data in one screen is rarely useful or successful, so Corey described helpful strategies for managing this.
The main strategies were:
Since the post was published in 2014, we’ve released 10 versions of KeyLines and added lots of functionality. We now support four new techniques to help you visualize large networks.
Filters are ideal for simplifying networks to find hidden structures and outliers. They provide a simple and intuitive way for users to choose which parts of the network they want to see.
If your data has a timestamp, the time bar lets users select subsets of data by time frame, or pan through a time range to identify interesting activity in the network:
The ‘Tweak’ layout, which uses the force-directed model, incrementally adapts itself as links are formed and broken, making it easy to see how the network evolves.
Almost all network data has a geographic element. KeyLines Geospatial lets users filter map-based data so they can analyze one location at a time:
Another technique to avoid overloading your chart with too much data is to start with a small network and allow your users to work their way outwards.
The KeyLines expand feature supported this way of working already, but we improved expand in KeyLines v3.2 when we added an incremental mode (previously only available for the Standard Layout) to hierarchy, tweak and radial layouts:
When a user expands an item, incremental mode fixes existing network nodes in position and adds new nodes around them. It stops KeyLines from repositioning every node and rearranging the network with every chart layout.
The main advantages are:
We still recommend that users adopt the strategies we’ve suggested for exploring subsets of data, but if you do need to load a large network, the Lens layout is your best option.
There are times when a user needs to load thousands of nodes at once, for example, when they’re investigating automatically generated data like SIEM alerts.
Our WebGL graphics renderer, released in KeyLines 3.0, was designed to meet this challenge.
WebGL harnesses your device’s GPU for dramatically improved drawing performance. As a result, you can visualize vast networks with full interactivity.
Compared to our original HTML5 Canvas renderer, the WebGL component is much faster:
Corey’s original advice still stands:
But over the course of the past 10 releases, KeyLines has cemented its position as the most powerful network visualization technology, capable of visualizing the largest networks.
Put it to the test! Sign up for a free trial of the KeyLines SDK.