\begin{description}
  \item [Flowtag] FlowTag \cite{flowtag_paper} is a network trace viewer that offers an interactive and intuitive interface. It processes PCAP files to generate a comprehensive database of flows, which can be visualized and analyzed by the user. The tool enables users to filter and focus on specific flows of interest, examine the payload, and annotate them with relevant keywords. FlowTag is implemented in Ruby using the Tk interface and incorporates a combination of flow-based visualization, a parallel-coordinates view for flow selection, and keyword tagging. This integrated approach facilitates swift analysis of packet captures. Additionally, FlowTag allows users to export tagged flows along with the flow database and associated tagging information for further analysis or sharing. The main reason why the tool could not be analyzed is due to its codebase \cite{flowtag_github} being published 10 years ago and never updated, rendering it largely deprecated and incompatible with modern systems.

  \item [InetVis] InetVis is an advanced 3-D scatter-plot visualization tool designed specifically for network traffic analysis. It functions akin to a media player, but tailored to network traffic. It proves to be highly advantageous in identifying and observing scan activities and detecting anomalous traffic patterns. In InetVis, network packets are graphically represented based on the following parameters: the destination address within the home network is plotted along the x-axis, the source address within the external Internet range is plotted along the z-axis and ports, distinguishing between TCP and UDP, are plotted along the y-axis. ICMP traffic is depicted below the TCP/UDP cube, marked by a grey/white ICMP plane. InetVis encompasses several key features that aid in the exploration of network traffic and facilitate the development of valuable insights, which collectively enhance the usability and effectiveness of InetVis as a tool for comprehensive network traffic analysis. Due to the outdated version of the original tool published in 2007 \cite{inetvis_site}, there has been a recent attempt to update the application to make it available on modern systems, in 2018. However, the result achieved or, at least, the version published and currently available \cite{inetvis_github} of this work is not functional on either Windows or Linux systems.

  \item [J-Viz] J-Viz \cite{jviz_paper} is a specialized security visualization tool designed to detect algorithmic complexity attacks within Java bytecode. This tool utilizes connected directed graphs derived from the bytecode and applies a designated node ordering, known as sibling-first recursive (SFR) numbering, to visualize the graphs effectively. Specifically, the graphs used in this context are derived by employing Shiver's k-CFA framework on Java bytecode. The tool incorporates valuable connections between the nodes of the input graph and the corresponding Java bytecode that generated it. Furthermore, it provides a decompiled version of the Java bytecode for better understanding. By employing the canonical drawing paradigm, J-Viz proves to be highly effective in identifying potential security vulnerabilities associated with algorithmic complexity attacks. The utilization of J-Viz as a security visualization tool should contributes to the exploration and identification of algorithmic complexity vulnerabilities within Java bytecode, further enhancing the understanding and mitigation of potential security risks in software systems. The tool is made available through its page on SourceForge \cite{jviz_site}, but the provided source code, most likely due to its publication date, is mostly deprecated and does not allow the installation of the tool, thus rendering it unusable.
  
  \item [AlertWheel] AlertWheel \cite{alertwheel_paper} is an innovative user interface that incorporates a unique radial overview visualization, along with filtering, drill-down capabilities, and the ability to save and annotate specific data subsets. The purpose of this interface is to support the workflow of network defense analysts. During the design process of AlertWheel, has been designed a novel techniques for presenting bipartite graphs effectively. Similar to other radial visualizations, AlertWheel also employs a radial layout to depict the simultaneous occurrence of various events, including their location, time, and nature. However, the specific radial layout used in AlertWheel is particularly well-suited for visualizing attacks targeted at a honeypot. This visualization approach proves valuable for network analysts, especially during the emergence of highly infectious malware outbreaks on the Internet. Currently, there is only one way to download the application, which is via its SourceForge page \cite{alertwheel_site}, which provides a Windows installation file. However, it appears that this file isn't working correctly.

  \item [BUCEPHALUS] Bucephalus \cite{bucephalus_paper} is a Visual Analytics solution that offers a visual overview of the relationships between business functions, devices, and vulnerabilities. It provides users with a what-if analysis scenario, helping them make decisions on which vulnerabilities to prioritize for remediation. The tool has been developed and validated through a user-centered design process, with active involvement from security professionals. Due to contractual reasons between the research group and the involved company, the tool is not available to the public.

  \item [Fimetis] The Fimetis tool \cite{fimetis_paper} provides a comprehensive solution for exploring file metadata, including timestamps and ownership details, while effectively managing substantial volumes of such data. Fimetis offers a user-friendly interface with visual controls that facilitate seamless navigation through the dataset. Additionally, the analysis process benefits from a collection of predefined configurations that identify typical file patterns and operations, such as crontab rules, files with weak permissions, and indications of on-the-spot compilation. The application's user interface operates within a browser environment and leverages the indexing capabilities of ElasticSearch to efficiently process the data. Notwithstanding its relatively recent development in 2020, the provided codebase exhibits a multitude of errors, rendering the tool unusable in its current state.

  \item [V3SPA] V3SPA \cite{v3spa_paper} (Verification, Validation and Visualization of Security Policy Abstractions) is a tool for visualizing and analyzing SELinux and SEAndroid security policies. It addresses the challenges of policy development and maintenance by leveraging the Lobster domain-specific language to create policy abstractions. With integrated exploratory controls and filters, V3SPA enables rapid analysis of policy rules. It introduces innovative analysis modes including differential policy analysis, allowing visual comparison of policy versions, and information flow analysis for identifying unexpected permissions and examining policy design. V3SPA offers a comprehensive view of the entire policy while allowing selective filtering and reachability queries. It enhances the efficiency and effectiveness of policy authors and auditors, revolutionizing the way SELinux policies are built and analyzed. The codebase of the prototype can be accessed through its GitHub page \cite{v3spa_github}. However, despite various installation methods being documented, none of them are currently operational due to dependencies on outdated components that have not received updates in several years. Furthermore, the developer has explicitly stated in the repository's issue section that the tool will not undergo further updates, and any installation-related challenges will remain unresolved.

  \item [CRUSOE] CRUSOE \cite{crusoe_paper} web application displays and illustrates the data regarding the ongoing cybersecurity status within a computer network. It provides multiple perspectives on the data gathered from other tools. Notably, it offers visual representations of an entity's context within the network and an overview of vulnerabilities and susceptible hosts present in the network. Additionally, the web application incorporates dashboards for other tools developed within the same project. These dashboards facilitate monitoring and verification of data collection and subsequent processes, offering an alternative to the default control mechanism of such tools. The source code of the application can be downloaded from the university's webpage \cite{crusoe_site} where it was developed. Additionally, the tool can be installed using Docker. However, the inability to use the application stems from the requirement of institutional credentials during its initialization, which, despite requests, have not been made available. This unavailability of the required credentials hinders users from effectively utilizing the application's functionalities.

  \item [CVExplorer] CVExplorer \cite{cvexplorer_paper} is an interactive system designed to visualize cybersecurity threats derived from the National Vulnerability Database. Its purpose is to serve as a reporting and alerting tool, contributing to the enhancement of security measures against cyber attacks and potentially reducing network vulnerabilities. The system consists of interconnected views that enable users to visualize the interrelationships among various aspects found within a vast collection of vulnerability reports. These aspects include the types and levels of vulnerabilities, vendors, and products involved. CVExplorer offers an intuitive interface and supports numerous interactive features, such as filtering and sorting vulnerability severity ratings. These functionalities allow users to swiftly narrow down their focus to specific areas of interest. As mentioned in the research paper, a link is provided for users to access a demonstrative video and an online demo of the prototype \cite{cvexplorer_site}. However, it is worth noting that the provided link is currently non-functional, rendering the online demo inaccessible at this time.

  \item [RiskID] The RiskID \cite{riskid_paper} application utilizes visualizations to represent network connections in a graphical manner, facilitating easy comparison. As a result of two algorithms working behind the scenes, connections are actively organized and potential labels are predicted. These algorithms include a recommendation algorithm and a semi-supervised learning strategy. Combined with interactive adjustments to the user interface, they form a behavior recommendation system. According to the findings from this study, behavior recommendation enhances the quality of labels significantly. By analyzing interaction patterns, it was observed that the availability of behavior recommendation resulted in a more intuitive workflow being adopted. Even in this last case, the code available in its GitHub repository \cite{riskid_github} is not functional due to several errors and dependencies. The development of this tool has been dormant for many years, suggesting a state of abandonment in its development.
\end{description}

