\chapter{Analysis Methodology}

The goal of this chapter is to describe the methodology that will be used to analyze the existing literature on the use of visualizations in cybersecurity. To achieve this goal, the following research questions will be addressed.

\begin{itemize}
\item What is the current state of the art in security visualisation?
\item What are the practical strategies that are being used to visualize security data?
\item What are the gaps between the proposed theory and the practises used in security visualization?
\end{itemize}
To answer these questions, a systematic review of the literature was conducted. The review  include a search of multiple databases, including ACM Digital Library, IEEE Xplore, Springer Link and Google Scholar, using relevant keywords such as ``cybersecurity visualizations", ``security data visualization" and ``information visualization in cybersecurity". The review  include articles published in English without restrictions on the date of publication.

Once the articles have been identified and collected, they were analyzed using a qualitative approach. The analysis has involved reading and summarizing the main points of each article, and identifying common themes and trends in the literature. The results of the analysis was used to answer the research questions and to provide insights into the current state of the field and will be presented in the subsequent chapters of the thesis.

The analysis also includes survey-type articles conducted on the state of security visualization over the years. Although this is not a survey article, any theories, proposals and categorizations present in these articles, which was also analyzed, was considered, expanded and eventually refuted in the following chapters.

In addition to a systematic review of the literature, this research also include a practical component. To complement the theoretical analysis, a practical test was conducted to investigate the effectiveness of available visualization tools in a real-world cybersecurity setting. The test involved selecting an available sample of visualisation tools identified through the literature review and online research to test their capabilities and performance in analysing security data. In particular the selection criteria for the tools used in this study primarily revolved around their presence in the examined scientific articles, considering their relative availability, as well as their adoption within industry contexts, and additionally, the choice took into account their popularity and subsequent utilization in real-world settings, thereby ensuring their relevance and widespread usage. The data used for the tests were a combination of simulated and real security data.

The results of the practical test were compared and contrasted with the findings from the literature review, to provide a comprehensive understanding of the use of visualizations in cybersecurity. This allowed for the identification of both the strengths, the real-world effectiveness and limitations of the selected visualization tools, as well as any gaps between the theory proposed in the literature and the practical use of these tools.

To enhance the credibility of the findings, a thematic analysis was carried out to identify prevailing themes, trends and statistics in literature. The approach entailed categorising articles based on their shared themes before conducting an extensive examination to uncover deeper insights about the contemporary status of the field. This technique should provide us with a comprehensive and balanced picture of cybersecurity visualisation's current state. 

In addition to examining data types and processing techniques, this study also evaluated the influence of user experience on security visualizations' effectiveness. This involved analyzing the type of data that is being visualized, such as log files, network traffic, and attack patterns.

This analysis includes an assessment of how design elements like color, shape, and size impact users' ability to understand and make full use of visualization tools. Finally, to address the limitations of the study, a critical evaluation of the methodology used in this research was conducted. This evaluation considered factors such as the representativeness of the sample of articles used in the literature review, the generalizability of the results, and the limitations of the practical test. The evaluation provided insights into the strengths and weaknesses of the methodology used in this research and suggest areas for improvement in future studies.

Moreover, the research methodology was expanded to incorporate empirical findings derived from a real-world scenario and an expert consultation session involving cybersecurity specialists from Politecnico di Torino. This experience provided practical insights into the implementation and efficacy of commonly employed techniques for enhancing cybersecurity. These insights played an important role in extending the analysis methodology and identifying potential disparities between the theoretical constructs proposed in the existing literature and the pragmatic application of the conceptual framework. By validating the analysis methodology, a comprehensive comprehension of the utility of visualizations in the realm of cybersecurity was achieved. The feedback received from the experts regarding the efficacy of the chosen visualization tools in real-world contexts were instrumental in fine-tuning the analysis methodology and shedding light on any inherent limitations associated with the selected tools.

Overall, the methodology used in this research combines both a systematic review of the literature and a practical test of available visualization tools. This mixed-methods approach will provide a comprehensive understanding of the use of visualizations in cybersecurity and allow for the identification of both the current state of the art and the real-world effectiveness and limitations of these tools.