\chapter{Theoretical Research}

In this chapter, we will explore the theoretical foundations of security visualization, including the different types of security visualization techniques, the theories and models that underpin security visualization, and the applications of security visualization in the field of information security. Understanding these theoretical foundations enables us to create more effective security visualizations that help security professionals identify and respond to security threats more efficiently.

%In the last years, the field of information security has become increasingly complex and data-driven, with security professionals facing an overwhelming amount of security-related data on a daily basis. To effectively manage these data, security visualization has emerged as a valuable tool for identifying, analyzing and responding to security threats in a more intuitive and efficient manner. We can describe Security visualization as a  graphical representation of security-related information, which can help security professionals to gain a better understanding of the security landscape and make faster informed decisions.

Security visualization is not a new concept, and its roots can be traced back to the early days of information visualization in the 1960s. However, it was not until the 1990s that security visualization gained widespread attention in the field of information security. This was due, in part, to the growing awareness of the need for improved security measures in response to the increasing number and complexity of cyber threats.

One of the pioneers in the field of security visualization is certainly Raffael Marty \cite{marty-2008}, author of one of the most comprehensive guide to the principles and practices of security visualization. The book provides a detailed overview of the different types of security visualization techniques and although today it is a fairly dated source, it is certainly to be considered as the basis for all the research produced in the years following its publication given the extensive treatment of topics such as cognitive psychology, visual perception, and information visualization. In his book Marty discusses several challenges that arise when using security visualization to identify and respond to security threats like Information Overload, Data Quality, Visualization Design and more.

\section{The SANS Framework}\label{The SANS Framework}
Over the years, research works have tried to expand the concepts and go beyond the limitations proposed by the foundations of data visualization. In addition to a more practical part of the work, a necessary effort was made in defining frameworks and standards for the Security Visualization process. Although there are no defined standards in the field of Security Visualization, a reference in this area is given by the work of Balakrishnan \cite{sans_white_paper} which aims to provide general guidelines on the visualization of data concerning security with a repeatable process (figure \ref{fig:Security Data Visualization Process}). In the proposed model, the process is divided into 5 key steps: 

\begin{description}
   \item[Visualization Goals] In this initial phase, the focus is on understanding the objectives and determining what is actually desired to be achieved through the visualization. The suggestion given by the author is that the visualization must be goal-driven or use case-driven and never data-driven. In this way, according to the author, having already a documented idea of the objectives, a better choice will be made when choosing the data and tools for visualization. 
   \item[Data Preparation] This second phase can in turn be divided into two sub-phases. As a first action you have to search and collect the data that will be the object of the visualization. Later, before deciding on the actual method and use for displaying them, the data needs to be cleaned and converted if necessary into a usable format for the next steps, a process that could take a considerable amount of time.
   \item[Exploration] In this phase, it is necessary to perform an analytical analysis to determine the optimal approach for visualizing the data. The author suggests the use of a framework of analytical activities developed in the same year \cite{amar-2005} whose purpose is to allow the analyst, through the various phases of the framework, to ask himself the right questions and obtain the best results based on his purpose, analyzing all possibilities.
   \item[Visualization] This specific phase can be approached from two different perspectives. The first is that of aesthetics, or how to use colors, hue, thickness and many other aspects related to visualization through methodologies that can be described in literature, including a chapter in Marty's book \cite{marty-2008}. Another point of view on which the perspective can concentrate instead is that of the visualization methodology. Here too there are many sources in the literature that analyze and explain the many methods of displaying information. However, as suggested by the author and as you will see in the following sections of this thesis, the possibilities in case there's the need to develop your own visualization methodology increase exponentially thanks to the use of languages and extensions developed to create visualizations.
   \item[Feedback and fine-tune] This is the final step in which continuous feedback and the possible availability of new data allow continuous improvement. Unfortunately, not many indications are provided regarding this phase since the options with which these two actions can take place depend a lot on the context in which the framework is used.
\end{description}

As previously mentioned this framework is not to be considered standard for the entire Security Visualization community but for the subsequent work carried out in this thesis it was taken as an initial reference thanks to which analyzes have been carried out on the various tools, when possible, and after that the framework itself was analyzed and possibly detailed or modify it, subject to critical evaluation.


\begin{figure}[h]
    \centering
    \includegraphics[width=14cm]{Figures/chapter3/Security Data Visaulization process.png}
    \caption{Security Data Visualization Process \cite{sans_white_paper}}
    \label{fig:Security Data Visualization Process}
\end{figure}

\section{VizSec}
As expressed in the previous chapter of the methodological analysis, the selection of papers did not have particular filters regarding the origin of the research. However, one of the elements common to many of the works found and analyzed was the membership of the IEEE Symposium on Visualization for Cyber Security or VizSec \cite{vizsec_site}. In the world of security visualization, VizSec represents the reference forum for workers and researchers from the academic, industrial and governmental world.

The VizSec IEEE Symposium has grown since its inception in 2004. The early years of the conference emphasized the development of new ways of visualizing security data but, over time, it became clear that effective security design does not depend solely on the technical aspect of design at even how well it meets the needs of the people who use it. As a result, the conference has focused more on the human factors of safety simulation, including how to create simple, easy-to-use, and effective simulations for decision-making.
While the conference has always focused on the safety picture, the range of topics covered has broadened considerably over the years. In addition to traditional topics such as network security and malware analysis, the conference now covers areas such as threat intelligence, incident response and cybersecurity education and training.
As the field of security design has matured, it is clear that interdisciplinary collaboration is essential to achieving effective design. The VizSec conference addressed this need by encouraging interdisciplinary collaboration, bringing together researchers and practitioners from fields such as computer science, psychology and design.
With the growing importance of cybersecurity in today's world, the VizSec Symposium has become an increasingly important event for security professionals. The conference provides a forum for sharing best practices, discussing emerging threats and exploring new ways to mitigate cyber risk.
Overall, the VizSec IEEE Conference has evolved to reflect the changing needs and priorities of the security community.

\section{Literature Review}
Upon reviewing the extensive research conducted in the field of security visualization, it becomes evident that significant efforts have been dedicated to three primary areas: user-centered design studies focused on developing effective data visualization solutions for security analysts \cite{unlocking_user_centered_paper,user_centered_glyph_paper,user_centered_taxonomy_paper}, comprehensive surveys investigating data visualization in the context of cybersecurity \cite{design_space_paper,systematic_literature_review,survey_per_SANS_refining}, and innovative approaches or exploratory investigations into data analysis techniques and visualization methods tailored specifically to the domain of cybersecurity \cite{malware_detection_paper, ensamble_visualization_paper, Streaming_data_visualization_paper}.

In the context of the first category examined, user-centered design embodies a set of design methodologies that entail the active involvement of identifiable user representatives throughout the product development process. These methodologies aim to comprehensively grasp the users' needs, preferences, and requirements, ensuring the resultant product is finely attuned to their specific contexts and demands. Moreover these design methodologies emphasize the primacy of usability, effectiveness, and the overall user experience, thereby amplifying the intrinsic value and pertinence of the developed solution.
In particular, McKenna's \cite{unlocking_user_centered_paper} work references two key components within the user-design methodology. The first intriguing aspect pertains to the techniques for understanding user needs like the cognitive task analysis (CTA), which is used to understand the cognitive processes and mental strategies employed by individuals when performing complex tasks. It aims to uncover the underlying knowledge, decision-making processes, and problem-solving strategies utilized during task execution. CTA ca be very useful in various domains, because enables researchers and practitioners to gain a deeper understanding of how individuals acquire, process, and apply information to complete tasks effectively. The second noteworthy aspect is the discussion and adoption of the design process model in the context of creating a visualization. Specifically, reference is made to a work produced by the same authors \cite{design_activity_framework_paper}, which supports iterative and user-centered visualization design and provides guidelines for achieving a set of design objectives. The study cited provides a comprehensive reference as a practical guide for the design process, making clear connections between the various design processes and decisions regarding visualization design. Furthermore, the paper presents a range of methodologies, both well-established and novel, to be employed throughout the entire framework of the design activity.

In the course of reviewing the articles, it was observed that several recent solutions, discussed in the subsequent chapters, have employed a user-centered design approach in the design and development of the tools.
A further aspect unrelated to the development process in this domain, pertains to the paramount importance of devising aesthetics elements and interaction paradigms that not only incorporate robust security measures but also encompass engaging and user-friendly elements. The literature review conducted in this study has revealed several research contributions focusing on the exploration of aesthetics in creating visually captivating and effective warning signs \cite{usable_aesthetics_paper,aesthetics_paper2}. Investigations have been carried out to assess the utilization of various visualization effects to alert the public about the perils while navigating online platforms. The findings from these studies demonstrate the significant role that aesthetics can play in shaping users' perceptions and engagement with online security warnings and cautions and highlight that user-centered design principles can be applied to improve internet security.
It is essential to acknowledge that while these aspects bear substantial importance within the wider realm of online security, they have been deliberately excluded from the purview of this work owing to their specific emphasis on a distinct subject area.

The second prominent type of research conducted is surveys focusing on security visualization, which play a crucial role in providing a comprehensive understanding of the existing landscape. These surveys aim to explore and analyze the various aspects of security visualization, including tools, techniques, methodologies, and challenges. Surveys in security visualization often involve a systematic review of the literature, where researchers gather and analyze relevant articles, papers, and publications, examining different dimensions of security visualization, such as data sources, visualization techniques, user interaction, and evaluation methods. These surveys also help identify trends, gaps, and emerging areas of research within the field. Through surveys, researchers gain insights into the current state-of-the-art in security visualization, allowing them to identify common practices, identify challenges, and propose directions for future research. 

The last category addresses the development of unique methodologies and techniques in security visualization. This involves the ability to customize and expand existing visualization approaches, as well as create new ones, to cater to specific needs within the cybersecurity domain. Recent research efforts have not only concentrated on network analysis, which was initially a primary area of interest in security visualization, but have also expanded to encompass diverse domains such as forensic analysis and malware analysis, among others. Researchers have dedicated their efforts to exploring innovative visualization techniques that effectively represent complex data structures, relationships, and behaviors pertinent to cybersecurity. The development of specialized visualizations tailored to specific cybersecurity domains exemplifies the progressive nature of security visualization as a dynamic and evolving research field.

Despite the evolution of research in this field, many of the visualization techniques used, both in research and real-world contexts, are based on the current data visualization theory, which has been extensively described by multiple sources in the literature. One notable source in this regard is Marty, as mentioned earlier, who delves into the subject matter extensively in his book, exploring various aspects such as the multitude of choices within visualization methodologies and the decision-making process involved. Regarding the grouping of visualization techniques used today, one prominent reference cited in the literature, as seen in the work presented by Balakrishnan, is the representation developed by KPI Library known as ``A Periodic Table of Visualization Methods" (figure \ref{fig:visualization_table}), which classifies visualization methods into six categories, providing a comprehensive overview of the field. As far as the visualization choice process is concerned instead, despite being an outdated source, the methodology expressed by Marty in one of the chapters of his book (figure \ref{fig:marty_flow}) is to be considered today both a valid solution and a basis for the development of a decision-making process which it can be aimed at a particular case or at a more general purpose.

\begin{figure}[h]
    \centering
    \includegraphics[scale=.4, angle=90]{Figures/chapter3/visualization_table.png}
    \caption{A Periodic Table of Visualization Methods(KPI Library, 2014) \cite{visual_table}}
    \label{fig:visualization_table}
\end{figure}
\begin{figure}[h]
    \centering
    \includegraphics[scale=.83, angle=90]{Figures/chapter3/marty_flow.png}
    \caption{Choosing Graph Types, ``Marty, R. (2009). Applied security visualization" \cite{marty-2008}}
    \label{fig:marty_flow}
\end{figure}

In the case of visualizations used in cybersecurity, the focus goes beyond producing static images. Instead, it aligns with what Shneiderman \cite{shneiderman_paper} refers to as the ``Visual Information-Seeking Mantra". The author proposes that advanced graphical user interfaces should adhere to guidelines that enable the rapid presentation of information and facilitate user-controlled exploration, pointing out the importance of interactive and dynamic visualizations that empower users to quickly navigate and explore the data. The methodology that a visualization should adopt, according to the defined mantra, is ``Overview first, zoom and filter, then details-on-demand". Specifically, the methodology expands into seven abstract tasks, which can be briefly summarized as follows:
\begin{description}
   \item[Overview] Present an initial high-level view of the data to provide users with an understanding of its overall structure and patterns.
   \item[Zoom] Allow users to zoom in on specific areas of interest to examine details at a more detailed level.
   \item[Filter] Enable users to apply filters to the data based on specific criteria or attributes, refining the view to focus on relevant subsets.
   \item[Details-on-demand] Provide users with the ability to access detailed information about specific data elements or points of interest as needed.
   \item[Relate] Support the exploration of relationships and connections between different data elements, facilitating the discovery of meaningful insights.
   \item[History] Allow users to track and revisit their interactions with the visualization, enabling a sense of history and supporting backtracking if needed.
   \item[Extract] Provide mechanisms for users to extract or export relevant portions of the data or visual representation for further analysis or communication purposes.  
\end{description}

Despite the dated nature of this methodology, we can observe the presence of these phases in most of the tools developed in the field of Security Visualization, confirming through expert feedback that the inclusion of these functionalities and the construction of final products implementing this type of design have a positive impact on improving the overall user experience.

All these components described above are made possible thanks to the interactive element, which is always present in modern visual system solutions. The incorporation of interactivity empowers users to actively engage with the visualizations, enabling them to manipulate, explore, and interact with the data in a more dynamic and immersive manner. By offering functionalities such as zooming, filtering, and highlighting, users can navigate and delve into the visual representations, thereby enhancing their understanding, analysis, and decision-making processes. This interactivity aspect not only augments the usability and effectiveness of the visual system but also contributes to an enriched and user-centric experience. During the literature review, the two main types of interaction found can be classified based on their ultimate goal. The first, which can be described as more expressive, aims to modify, for example, the visualization algorithm or its underlying structure. The second type is more exploratory in nature, focusing on the information presented through actions such as zooming and filtering, which are closely tied to the user's actions and provide a means to explore and manipulate the displayed information.

Through the literature review conducted, it has become clear that the use of visualizations in cybersecurity has several key objectives. These objectives are aimed at improving the effectiveness of cybersecurity measures by providing analysts and decision-makers with a clearer understanding of the data and trends related to cyber threats. The ideal objectives of Security Visualization can be delineated as follows:

\begin{description}
  \item[Understanding security data] The primary goal of Security Visualization is to enable analysts to understand security data quickly and intuitively. Data visualization helps identify patterns, correlations, and anomalies that may otherwise go unnoticed. This allows analysts to gain an overview of threats, vulnerabilities, and suspicious activities, facilitating informed decision-making and effective incident response.
  \item[Detecting and responding to security incidents] Security Visualization aims to provide tools and techniques for early detection of security incidents and timely response. Through data visualization, analysts can rapidly identify indicators of compromise and critical security events, enabling immediate response to mitigate the impact of incidents and restore the security of the environment.
  \item[Effectively communicating security information] A key objective of Security Visualization is to communicate security information clearly and effectively to various stakeholders, including security experts, business executives, and end-users. Data visualizations can transform complex security data into understandable visual representations, facilitating easier and engaging communication of key security-related information.
  \item[Supporting decision-making] Security Visualization provides valuable support for informed decision-making related to security. Data visualizations allow analysts to quickly assess options, compare different strategies, and evaluate potential impacts. This enables data-driven decision-making regarding security measures to be implemented, threat mitigation paths, and intervention priorities.
  \item[Enhancing security awareness] Security Visualization aims to improve security awareness among users and system operators. Through clear and engaging visualizations, users can better understand risks, security policies, and recommended actions to protect their data and digital assets. This contributes to promoting a culture of security and adopting conscious behaviors to prevent breaches and attacks.
\end{description}


Overall, the ideal objectives of Security Visualization are to provide in-depth understanding of security data, detect and respond to security incidents, effectively communicate security information, support decision-making, and enhance security awareness among users and system operators. By understanding these objectives, organizations and individuals can better leverage security visualization to improve their cybersecurity posture and protect against potential threats.