Abstract
The objective of security data visualizations is to help cyber analysts to perceive trends and patterns, and gain insights into security data. Sound and systematic evaluations of security data visualizations are rarely performed, in part due to the lack of proper quantitative and qualitative measures. In this paper, we present a novel evaluation approach for security visualization based on Christopher Alexander's fifteen properties of living structures. Alexander's fifteen properties are derived from various visual patterns that appear in nature. Each property represents the guidelines for good design. We believe that using these fundamental properties have the potential for building a more robust evaluation. Each property offers essential qualities that enable better analytical reasoning. We demonstrate how to use Alexander's properties to evaluate security related visualizations. We derive a set of visualization-specific properties for evaluation, developed based on Alexander's original properties.