\subsection*{Tulip}
Tulip \cite{tulip_site} is a cross-platform, open-source framework designed primarily for the visualization and analysis of large graphs. It serves as an information visualization framework dedicated to exploring and visualizing relational data. Its primary objective is to offer developers a comprehensive library that supports the creation of interactive information visualization applications tailored to their specific problem domains. Tulip enables the implementation of algorithms, visual encoding techniques, interaction mechanisms, data models, and domain-specific visualizations, with a development pipeline which enhances the framework's efficiency for both research prototyping and the development of real world applications.

The tool not only allows importing CSV files containing various data for visualization but also supports importing files with different extensions representing other graph hierarchies such as .dot files mentioned in the previous tool, .bib files for BibTex, JSON files and more. In addition to the possibility of representing the data provided via file, the tool allows you to perform a variety of algorithms on the data such as clustering algorithms, topological test algorithms, triangulation algorithms and various algorithms for modifying the characteristics of the representation. Among the various possibilities for creating visualizations, the user can either select from a choice of more common graphs such as scatter plots, histograms and parallel coordinates, or choose from more specific types of graphs such as node link diagrams or geographic views.

The two examples shown in the images focus on this last type of graph. In the examples shown there are no data concerning the context of cybersecurity but generic data are reported in order to show the possibilities offered by the tool. In both visualizations the data contain, in addition to their information for analysis, data regarding their geographical position which was selected by the tool and produced the visualization. In the first case (figure \ref{fig:tulip1}), cities were represented, and in addition to their locations, temperature information was visualized using a color scheme. In a scenario more relevant to our context, for example, we could associate server data with their respective positions and add their status as additional information using a similar color scheme. This way, we would create an overview of the overall state of a network. In the second case (figure \ref{fig:tulip2}), we have a combination of a geographic representation and a node-link diagram. If we were to provide an example in this case as well, we could consider visualizing a network by including the various connections within it, without sacrificing the information about geographic location and status (or other relevant information based on the analysis), which can be achieved by using a color scale.

\begin{figure}[h]
    \centering
    \includegraphics[scale=.3]{Figures/chapter4/Tulip/Tulip1.png}
    \caption{Tulip first example}
    \label{fig:tulip1}
\end{figure}
\begin{figure}[h]
    \centering
    \includegraphics[scale=.3]{Figures/chapter4/Tulip/Tulip2.png}
    \caption{Tulip second example}
    \label{fig:tulip2}
\end{figure}

The tool is available both as a file that can be installed on Windows \cite{tulip_download} and as an open-source code \cite{tulip_github} that can be installed on all operating systems and is also related to various guides available online. Also in this case we are faced with an application developed with a viewpoint focused on the representation of more generic data, and not for a cybersecurity specific focus. One of the fundamental elements that characterizes the tool is certainly the possibility of applying algorithms on the data both before and after the calculation of the visualization. The tool is also designed to be able to represent large graphs and is therefore optimized for the representation of large amounts of data. However, from the point of view of carrying out the analyses, a first limitation is the lack of interactivity of the graphs produced. In fact, once the image has been produced, it can be downloaded or modified for various uses but does not provide any interactivity, thus producing a simply image file.