A Data-Centric Methodology and Task Typology for Time-Stamped Event Sequences

TL;DR

This paper introduces a systematic methodology for creating dataset-centric task taxonomies for time-stamped event sequences, aiding visualization design and analysis through a novel task description language.

Contribution

It presents a five-phase methodology for abstracting tasks and constructing taxonomies, and introduces a new task typology using triples for describing tasks in time-stamped event sequences.

Findings

Validated methodology on cybersecurity data

Developed a novel task description language using triples

Enhanced understanding of task structures in event sequences

Abstract

Task abstractions and taxonomic structures for tasks are useful for designers of interactive data analysis approaches, serving as design targets and evaluation criteria alike. For individual data types, dataset-specific taxonomic structures capture unique data characteristics, while being generalizable across application domains. The creation of dataset-centric but domain-agnostic taxonomic structures is difficult, especially if best practices for a focused data type are still missing, observing experts is not feasible, and means for reflection and generalization are scarce. We discovered this need for methodological support when working with time-stamped event sequences, a datatype that has not yet been fully systematically studied in visualization research. To address this shortcoming, we present a methodology that enables researchers to abstract tasks and build dataset-centric taxonomic structures in five phases (data collection, coding, task categorization, task synthesis, and action-target(criterion) crosscut). We validate the methodology by applying it to time-stamped event sequences and present a task typology that uses triples as a novel language of description for tasks: (1) action, (2) data target, and (3) data criterion. We further evaluate the descriptive power of the typology with a real-world case on cybersecurity.