Self-organizing maps (SOMs) are self-organized projections of high dimensional data onto a low, typically two dimensional (2D), map wherein vector similarity is implicitly translated into topological closeness in the 2D projection. They are thus used for clustering and visualization of high dimensional data. However it is often challenging to interpret the results due to drawbacks of currently used methods for identifying and visualizing cluster boundaries in the resulting feature maps. In this thesis we introduce a new phase to the SOM that we refer to as the Cluster Reinforcement (CR) phase. The CR phase amplifies within-cluster similarity with the consequence that cluster boundaries become much more evident. We also define a new Boundary (B) matrix that makes cluster boundaries easy to visualize, can be thresholded at various levels to make cluster hierarchies apparent, and can be overlain directly onto maps of component planes (something that was not possible with previous methods). The combination of the SOM, CR phase and B-matrix comprise an automated method for improved identification and informative visualization of clusters in high dimensional data. We demonstrate these methods on three data sets: the classic 13- dimensional binary-valued “animal” benchmark test, actual 60-dimensional binaryvalued phonetic word clustering problem, and 3-dimensional real-valued geographic data clustering related to fuel efficiency of vehicle choice.

Analyzing modern day's information systems that produce humongous multi-dimensional data in form of logs, traces or events that unfold over time can be tedious without adequate visualization, thereby, advocating the need for an intelligible visualization. This thesis researched and developed a visualization framework that represents multi-dimensional dynamic and temporal process data in a potentially intelligible and actionable form. A prototype showing four different views using notional malware data abstracted from Normal Sandbox behavioral traces were developed. In particular, the B-matrix view representing the DLL files used by the malware to attack a system. This representation is aimed at visualizing large data sets without losing emphasis on the process unfolding over multiple dimensions.