\section{Categorizations and statistics}
In the field of cybersecurity, the effective management and analysis of security data are critical for identifying and responding to potential threats. Categorization plays a fundamental role in organizing and classifying cybersecurity tools based on their data, input, and processing capabilities. Additionally, statistical analysis provides valuable insights into the quantitative aspects of security data, enabling researchers and practitioners to extract meaningful information and draw conclusions. This subchapter explores the categorization of the various cybersecurity tools encountered during this research.

Categorizing cybersecurity tools is essential for understanding their functionalities, capabilities, and suitability for specific security tasks. A systematic categorization framework allows cybersecurity professionals to assess and compare various tools, facilitating informed decision-making in tool selection. The categorization process typically involves grouping tools based on their data types, input sources, and processing techniques.
The initial categorization put forth pertains to the nature of input and its associated semantic interpretation, utilized by different tools to perform their functionality (table \ref{Tab:input}). Both the tested and unavailable tools are included in both this and the following categorizations, with clear separation by a line. Additionally, when applicable, it is duly noted the lack of utility in considering certain tools for specific categorizations.

\input{chapters/Tables/Input_table}

Based on the preliminary analysis of the input table presented, it is apparent that the initial set of tools, which have been previously characterized as more general in nature, exhibit input types and data representations that are also of a broader scope, rather than being specifically tailored to security visualization. However, according to the output categorization presented in the table \ref{Tab:output}, it is noteworthy that, except for one particular tool included in this study, these tools uniquely offer the functionality to download the computed visualizations. This capability is significant in facilitating communication and information sharing pertaining to the analysis process. Regarding the more specific tools developed in the field of security visualization, it is evident that there is a clear trend in network analysis to utilize the widely recognized .pcap standard, as discussed in previous chapters, while in other cases, more general formats such as .JSON are employed for data representation. It is important to mention that in two specific cases, namely Vulnex and Code Pulse (see the description for the second phase of the analysis), the input procedure is automated and does not require a specific format to be manually entered, but instead, it involves a configuration process that can vary in complexity depending on the development context. As mentioned earlier, regarding the output, we can observe that the majority of the tools do not offer options for exporting the created visualizations. The only exception is SAGE, which differs from other tools as it does not provide real-time visualizations but calculates various visualizations and directly outputs the results. It is worth noting that ROPMate's output, as indicated in the table, is in the form of source code, which implies the possibility of obtaining the code created through the visualization of gadgets, providing a textual output rather than a visual one, while the RedEye's output is the same as the input.



A subsequent categorization, still related to the input data provided to the applications, concerns the potential data processing that these data undergo before being visualized. In the provided table \ref{Tab:process}, we can observe a nearly equal division between the tools that process the data and the others. Furthermore, it is worth highlighting the wide variety of data processing techniques, with some clearly defined in their respective papers, while others are more generic and therefore their complexity is not assessable.

Another significant aspect related to the data utilized by the tools pertains to their specific purpose within the realm of cybersecurity. The table \ref{Tab:goals} showcases the aforementioned tools, organized and classified based on their distinct ``security goal". As elucidated earlier through the input categorization, a predominant category observed is that of Network Analysis. Additionally, noteworthy categories encompass vulnerability and threat analysis, forensic analysis, and, to a lesser extent, security administration tools. These delineations align with the current state of the field, illustrating the prevailing emphasis on these particular domains within cybersecurity research and practice \cite{design_space_paper}. Within the same table, further classifications are provided concerning potential synergies that can arise among the various tools or alternative options that one tool may offer in comparison to another. It is worth emphasizing that, in this regard, the scope of consideration extends beyond the available and tested tools employed in the research, but the analysis encompasses potential relationships and alternatives, even among tools that were not accessible or directly examined during the study. When it comes to selecting among the available alternatives, a crucial factor to consider is the alignment of each tool with the specific security goal at hand. It is imperative that a viable alternative operates within the same domain as the tool being replaced and does not impose any significant limitations. However, achieving such alignment is not always feasible. For instance, in the case of ROPMate and SAGE, both tools fall under the same security goal category, yet upon closer scrutiny, ROPMate proves more suitable for analyzing application development aspects, while SAGE excels in examining the potential threats within a networked system. In the context of synergies, the term encompasses various forms of collaboration among applications, expanding their individual scopes of operation. However, delineating the precise interactions between two tools can pose a complex task. 

\input{chapters/Tables/Output_table}
\input{chapters/Tables/Processing_table}
\input{chapters/Tables/Goals_table}

An illustrative example of synergy can be observed in the amalgamation of forensic analysis tools and Pixel Carpet. This synergy arises from the capability of Pixel Carpet to scrutinize suspicious log files identified through the prior analysis conducted by the aforementioned tools, which themselves can be regarded as viable alternatives. It is important to note that such synergy does not entail direct interaction between the outcomes of the tools but rather implies that the effect of one tool's analysis may prompt the utilization of the other for distinct analytical purposes. Another compelling example within the same domain is demonstrated by the synergy between Vulnex and Code Pulse. Both tools operate within the realm of code vulnerability analysis, and their combined deployment could furnish a diverse yet mutually reinforcing set of analytical insights, thereby augmenting the overall depth of the undertaken analysis. An additional and distinct perspective can be offered for CVExplorer, which could provide external support for various tools that necessitate the exploration of information related to Common Vulnerabilities and Exposures (CVEs).

As evident from the table, there are few instances of synergies or proposed alternatives among the tools. This lack of correlation can be primarily attributed to two limitations identified during the analysis of tool development in the field of security visualization. The first limitation pertains to the number and timeframe of the study conducted for this thesis work. The volume of research in the field of Security Visualization grows annually, driven by the research community's efforts \cite{systematic_literature_review}. As a result, achieving a comprehensive catalog of various theoretical and development papers is a resource-intensive endeavor. Despite analyzing a considerable number of papers in this study, the coverage cannot be deemed exhaustive in terms of the available possibilities. A second limitation stems from the fact that the methodologies and products developed are not designed to operate in a collaborative context with other tools. The objective is not to create something that integrates with existing tools, but rather to present an idea or implementation within a specific and limited context. Consequently, most of the tools are in a prototypical state, geared toward demonstrating a concept or solution in a particular domain rather than facilitating integration with other tools. Thus, the scarcity of identified synergies or alternatives in the examined tools can be attributed to the combination of limited research scope and the inherent nature of the developed methodologies and products, which prioritize specific contextual applicability over comprehensive collaboration with other tools.

In summarizing the various tools based on the different development phases encountered in their descriptions, we obtain an overview presented in the table \ref{Tab:sans}. For convenience, the phases presented in \ref{The SANS Framework} have been denoted using abbreviated terminology, and the symbols used correspond to the following: Y = phase present, N = phase not present, and / = information not available. It is evident that the majority of encountered cases have considered all development phases in the presentation of their applications. A more thorough analysis of the categorization reveals that the Exploration Phase and the Feedback and Fine-Tuning Phase are less frequently represented. Regarding the Exploration Phase, it can be observed that in certain cases, its inclusion was deemed unnecessary as the selection of visualization methodologies favored simplified and immediate choices, rather than elaborate decision-making processes. In other instances, the selection of components was influenced by the requirement to adhere to specific standards, as exemplified by Vulnex. Concerning the Feedback and Fine-Tuning Phase, the lack of specific details or information in the descriptions of tools, particularly within the framework presented by Balakrishnan \cite{sans_white_paper}, makes it challenging to establish a standardized procedure for all development processes. A dedicated section in a succeding chapter will be allocated to provide a comprehensive examination of this phase in subsequent sections.

\input{chapters/Tables/SANS_table}

Lastly, an additional categorization is introduced, which involves evaluating the effectiveness of the proposed solutions and providing a comprehensive overview of the availability of the various tools (table \ref{Tab:judgment}). As extensively elucidated in the tool descriptions, a significant proportion of the cases examined are in a prototypical phase, thereby underscoring the constrained range of options within the domain of open-source Security Visualization. In relation to the more generic solutions, despite their strong support and regular updates, they were not deemed to have a substantial impact within the realm of security visualization due to their inherent generality. Conversely, the solutions specifically developed to harness visualization capabilities in support of cybersecurity exhibited a notably higher impact, generally warranting positive evaluations. Regrettably, their limited availability presents a significant hurdle, often impeding the full utilization of their functionalities and the application of their methodological approaches by analysts. As for the unavailable tools, they were excluded from the categorization due to their inaccessibility for practical analysis.

\input{chapters/Tables/Judgment_table}

