\section{SANS Refining Framework}
In light of the preceding chapters and the identified gap concerning the absence of a standardized framework, it is important to acknowledge that Balakrishnan's proposed framework does not serve as the exclusive reference for the field of security visualization. Thus, this chapter undertakes a comprehensive exploration to scrutinize and propose necessary refinements to the different stages that compose it, which demand reevaluation. The analysis of the previously presented table \ref{Tab:sans} underscores a significant disparity in the emphasis given to the \emph{Visualization} phase and the \emph{Feedback and fine-tuning} phase within the analyses of tools developments.

Regarding the \emph{Exploration} phase, the original proposal entailed conducting an analytical analysis to determine the optimal approach for visualizing the data. Building upon this initial premise, and considering the range of research possibilities available, it is imperative to extend this analysis to encompass existing solutions. This extension should encompass both complete solutions that are already deployable and prototypes that offer room for further extensions or modifications. The objective is to align these solutions with the predefined visualization goals established in the previous phase (\emph{Visualization Goals} phase). By doing so, a comprehensive evaluation can be conducted to identify the most suitable visualization techniques and strategies that effectively address the requirements of security data visualization. The current state of the literature reviews conducted in research \cite{survey_per_SANS_refining} presents diverse lists and categorizations of solutions, encompassing both available and non-accessible alternatives, which are described to a sufficient extent through their corresponding research papers and provide insights into the characteristics and potentials of various products. While these sources should not be regarded as exhaustive catalogs of security tools utilizing visualization techniques, they nonetheless serve as valuable resources, offering a diverse range of possibilities and expanding the knowledge base on available visualization techniques in the field of security. Leveraging these resources enables researchers and practitioners to broaden their comprehension of visualization techniques and explore novel avenues for augmenting the comprehension and analysis of security data. Nevertheless, it is crucial to acknowledge, as previously highlighted in the description of the comparison table of tools and their covered phases, that the selection process of a suitable visualization tool or methodology for an organization necessitates the consideration of various factors. These include ease of use, customization options, integration with existing security infrastructure, and compliance with specific organizational and industry standards. Additionally, potential limitations arising from the requirement to adhere to specific standards, whether internal or external, must be taken into account (As described for example in the case of Vulnex \ref{Vulnex}). Hence, it would be beneficial to allocate a section within this phase to analyze the constraints that developers may encounter during the development or selection of a visualization tool. These considerations ensure that the chosen visualization solution aligns effectively with the organization's needs, objectives, and technical environment, facilitating seamless integration and optimal utilization in the context of security operations.

Transitioning to the concluding phase of the framework, namely the \emph{Feedback} and \emph{Fine-tune} phase, it is noteworthy that since its introduction in Chapter \ref{The SANS Framework}, there is a conspicuous absence of explicit guidance concerning this phase. This is primarily due to the contextual dependence of the available options for executing feedback-related activities within the framework, however this absence creates potential gaps that impede the practical application and adoption of these solutions in real-world settings. In many of the analyzed cases, it's evident that during this developmental phase, diverse strategies were employed, such as expert feedback on tool characteristics (for example Pixel Carpet \cite{PixelCarpet_paper}), execution of specific test cases by experts and non-experts alike to assess various methodologies or proposed solutions (for example Vulnus \cite{vulnus_paper}), and the implementation of a set of simulated tasks aimed at demonstrating the efficacy of the product (for example \cite{NetCapVis_paper}), all approaches which align with the user-centered design methodology. Subsequently, in some cases, there were modifications aimed at improving and updating the various tools. However, in all cases, the focus was primarily on feature enhancements, with little attention given to critical factors such as privacy and security. As highlighted in the chapter on gaps and supported by the research, this lack of standardization and subsequent absence of necessary validation hinder the practical adoption of such tools \cite{systematic_literature_review}. Therefore, it is needed to incorporate within the development process of a security visualization application the necessary functionalities that ensure both privacy and security, promoting their wider use. Some examples of main points aimed at ensuring these factors are: 

\begin{itemize}
    \item The anonymization of sensitive data. By removing or obfuscating personally identifiable information and other sensitive data, user privacy can be safeguarded, and compliance with relevant data protection regulations can be maintained.
    \item Controlling access to visualizations. Robust access controls and authentication mechanisms should be implemented to ensure that only authorized individuals can access the visualizations, thereby minimizing the risk of unauthorized data exposure, particularly if they contain sensitive information.
    \item Secure storage and transmission of data used. Employing encryption and other appropriate security measures ensures that data is protected from unauthorized access, tampering, or theft throughout its lifecycle.
    \item Staying informed about vulnerabilities related to visualization tools. Remaining up-to-date on known vulnerabilities or security issues enables proactive measures to be taken to mitigate risks and safeguard the integrity of the visualization environment.
\end{itemize}

In alignment with the modular approach observed in the \emph{Data preparation} phase, where the initial data collection and subsequent data cleaning and filtering are distinct sub-phases, a similar division can be proposed for this phase. In this way, strategies can be integrated with the existing feedback mechanisms in the first phase to incorporate these features within the developed applications, enabling their applicability in contexts where they have found limited utilization thus far.

An alternative approach, diverging from incorporating these features in the \emph{Feedback and fine tune} phase, is to introduce a distinct and novel phase with the primary objective of integrating essential security features into applications, rather than including them in the fine-tuning of the development process (figure \ref{fig:SANS refined}). This proposed phase would be dedicated solely to addressing the inclusion of these necessary security components, ensuring their effective implementation and adherence to relevant standards and guidelines. 

\begin{figure}[h!]
    \centering
    \includegraphics[width=14cm]{Figures/chapter5/SANS refined.png}
    \caption{Security Data Visualization Process alternative with Security and Privacy phase}
    \label{fig:SANS refined}
\end{figure}
\FloatBarrier

Regarding the remaining phases, namely \emph{Visualization Goals}, \emph{Data Preparation}, and \emph{Visualization}, as highlighted in the summary table, they exhibit a higher presence within the development phases identified in the conducted analysis. In addition to their substantial presence, these phases do not display significant deficiencies or noticeable gaps, apart from minor additions that could be made, although of lesser importance. For instance, in the first phase, it would be beneficial to supplement the original author's recommendations with an additional user-driven methodology, alongside the goal-driven and use-case-driven approaches. This inclusion is warranted considering the established trend in the field, as evidenced by both the state of research and the outcomes achieved, further substantiating the efficacy of this user-centric approach.
In the context of the second phase of data preparation, it would be appropriate to adopt security strategies, such as data anonymization previously suggested, already in this early state. This approach aligns with contemporary development methodologies employed in application development contexts, wherein the integration of security components throughout the development lifecycle is emphasized. In relation to the \emph{Visualization} phase, no specific guidelines or recommendations are deemed necessary. This is attributed to its inherent interdependence with the preceding phase, namely Exploration, which indirectly enhances the visualization outcomes. The visualization phase benefits from the accumulated knowledge and insights acquired during the exploration phase, thus improving the overall results.

In addition to presenting the aforementioned methodology, the paper proceeds to propose a set of potential strategies for validating the proposed framework. The validation of a methodology is of paramount importance as it ensures its credibility, reliability, and applicability within the research domain or alignment with industry best practices.
\begin{description}
    \item[Expert consultation] Seeking feedback and input from subject matter experts in the field of cybersecurity and visualization. Engage with individuals who possess deep knowledge and expertise in these domains to validate the appropriateness and effectiveness of the chosen methodology. By consulting experts, it's possible to gather valuable insights and perspectives that can strengthen the credibility and robustness of the methodology. These experts can provide critical feedback on the research design, methodology implementation, and the alignment of the approach with industry best practices.
    \item[User testing] Conduct user testing sessions with individuals who would be potential users of the methodology or the resulting visualizations. Involve participants who have practical experience and domain knowledge in cybersecurity to evaluate the usability, clarity, and usefulness of the methodology. Through user testing, can be gathered firsthand feedback on how well the methodology supports their decision-making processes and addresses their specific needs. This feedback can help identify any potential flaws or areas for improvement, enabling you to refine and optimize the methodology based on user perspectives.
    \item[Comparative analysis] Performing a comparative analysis by comparing the methodology used in the study to other existing methodologies or frameworks in the field. Evaluating the strengths and weaknesses of each approach and assess whether the chosen methodology adequately addresses the research objectives. Identifying the unique contributions of the proposed methodology, such as novel visualization techniques or integration of user-centered design principles, that differentiate it from other approaches. This comparative analysis will provide a comprehensive understanding of the advantages and distinctiveness of your chosen methodology.
    
\end{description}

Moreover, each of these methods not only possesses individual validity but can also be employed in conjunction with the anothers, thereby offering a diversified approach. The choice of which method or combination to utilize is bestowed upon the user, as it is contingent upon the specific organizational scenarios at hand. This discretionary freedom allows for the customization of the validation process to effectively address the unique requirements and constraints of each organization. By presenting multiple options and affording users the opportunity to make informed decisions, the proposed framework demonstrates its adaptability and versatility, thus rendering it applicable across diverse contexts.

In conclusion, this chapter has proposed different modifications and enhancements to the existing framework and possible validation methods interchangeable and combinable with each other. These modifications aim to address the gaps and limitations identified in the original proposal, ultimately facilitating the practical adoption and utilization of security visualization solutions in real-world contexts. The \emph{Exploration} phase benefits from the inclusion of existing solutions, allowing for a comprehensive evaluation of visualization techniques that effectively address the requirements of security data visualization. The \emph{Feedback and Fine-tune} phase plays a crucial role in refining the developed applications. Incorporating privacy and security considerations within this phase ensures that the visualization tools adhere to necessary standards and guidelines, promoting their wider adoption. The \emph{Visualization Goals}, \emph{Data Preparation}, and \emph{Visualization} phases are found to be robust and well-defined in the original framework. However, minor additions can be made to further improve these phases, as expressed above. Overall, the proposed modifications aim to enhance the effectiveness, security, and practicality of the framework. By addressing the identified gaps and incorporating necessary considerations, the framework becomes more comprehensive and applicable in diverse security visualization contexts.