Visualizing Cybersecurity - a comparative study toward a security visualization methodology

In the contemporary digital landscape, safeguarding against cybersecurity threats has emerged as a paramount concern for both organizations and individuals. The ability to comprehend, analyze, and respond effectively to security issues plays a pivotal role in protecting sensitive data and preserving the integrity of critical systems. This thesis delves into the realm of security data visualization, aiming to augment the understanding and response capabilities concerning cybersecurity threats. The research commences with a systematic review of the existing literature, encompassing diverse databases and employing relevant keywords. Through this comprehensive approach, a vast array of scholarly articles is curated, providing a robust foundation for the subsequent analysis and exploration of the current state of the art in security visualization. The analysis of the compiled articles adopts a qualitative approach, entailing reading and concise summarization of the key points in each article. Through this process, common themes and trends prevalent in the literature are identified, offering valuable insights into the practical strategies employed in the visualization of security data. This comprehensive analysis, which aims to address the research questions such as identification of the current state of the art and the practical strategies adopted in the field of security visualization, together with the identification of related gaps between theory and practice, serves as the foundation to address these questions and present subsequent results in subsequent chapters. Subsequently, the thesis delves into the examination of tools utilized in security data visualization, categorizing their pertinent aspects and evaluating their efficacy in enhancing comprehension and responsiveness to cybersecurity issues. Where feasible, illustrative use cases are presented to showcase the practical application of these tools. Furthermore, the discussion encompasses a comparative analysis of proprietary tools, elucidating the strengths and weaknesses inherent in various approaches. Furthermore, the thesis exposes a significant research gap concerning the utilization of security visualization tools by non-expert users, with a specific emphasis on general practitioners. The investigation aims to address this gap by exploring the potential benefits and challenges associated with employing security visualization techniques in non-expert contexts. Additionally, the thesis presents categorizations and statistical analyses that contribute to a deeper analysis and comprehension of security data. Various categorization approaches are examined, shedding light on their impact within the context of security visualization. By means of the analyses conducted, the following section of the thesis discusses the process of evaluating gaps in security visualizations and proposes solutions to address these gaps between theory and practice. In the final section, this study proposes modifications to an established framework endorsed by SANS, and outlines potential practical strategies for leveraging security visualization tools to enhance threat protection.