\chapter{Introduction}

Cybersecurity is a critical issue facing organisations and individuals today, particularly as the volume and complexity of security data continues to increase with the proliferation of technology and the data on the Internet.

Big data analytics in cybersecurity involves collecting and analyzing large amounts of digital information to predict and prevent potential cyber threats and attacks. A strong cyber defense posture enables organizations to anticipate actions that may lead to attacks, particularly as the amount of data generated by connected devices and the Internet of Things continues to grow. As new technologies and systems emerge, so do new vulnerabilities, making security a constantly evolving target in the face of increasing data volume and complexity.

Managing and analysing these ``big data" is a major challenge for cybersecurity professionals, and traditional methods of data analysis are often inadequate and insufficient.

One solution to this problem is the use of visualizations, which can help analysts and decision makers understand and manage complex security data more effectively.

The hypothesis that visualizations enhance users' comprehension of information and subsequently improve their performance in making judgments and decisions is strongly supported by research findings \cite{eberhard-2021}. This effect is primarily attributed to cognitive mechanisms. Cognitive mechanism refers to the cognitive processes involved in understanding and processing information. In the context of visualizations, these processes include perception, attention, memory, and reasoning. One of the most important cognitive mechanism in this context is the Preattentive Processing \cite{preattentive_processing}. This is an automatic and rapid processing of visual information that occurs before conscious attention is directed toward the entire visual field. The process involves the initial perception and analysis of basics visual features such as colors, orientation, line ends, contrast, tilt, curvature, shape and size. These simple features are extracted from the field of view in the preattentive system quickly, effortlessly and in parallel without any attention being focused on the visual field, allowing the brain to quickly identify patterns and relationships in visual information.

Information visualisation has the potential to greatly support cybersecurity efforts by allowing analysts to recognise patterns and anomalies in large datasets, and by allowing humans to remain an integral part of the analysis process. Information visualisation involves the transformation of data into interactive graphical displays, taking advantage of the visual perception abilities of humans, capable of visualising patterns and anomalies faster. It can be used for a variety of purposes, including exploration, discovery, decision making, and communication of complex ideas.

Security data visualisation can be used in many areas in information security and can analyse a very different heterogeneous group of data, such as meta-data, network traffic data, enterprise log data, and more. The use of security data visualisation in areas such as security metrics, security monitoring, anomaly detection, forensics, and malware analysis can greatly enhance the capabilities of security professionals and contribute significantly to the overall effectiveness of security measures.

Cybersecurity visualization is important due to different dimensions that may depict security analyses \cite{mediumsite}. One first example to show its importance is about Visual threat investigation through the use of graph visualization. Graph visualization is a technique used to represent complex data structures and relationships between objects in a visual form. The primary goal of graph visualization is to facilitate data exploration and analysis by providing an intuitive and interactive way to visualize and navigate large and complex datasets. The technique involves mapping data elements to graphical objects, such as nodes and edges, and applying layout algorithms to arrange these objects in a meaningful and informative way.
The utilization of graph visualization has been shown to assist analysts in the identification of patterns and anomalies that may indicate potential threats. By combining human pattern recognition abilities with the data processing capabilities of machines, it becomes possible to uncover anomalies that may have otherwise gone unnoticed.
This methodology has demonstrated its ability to identify data breaches, detect malware entry points, predict external attacks, and reveal vulnerabilities in an organization's perimeter. 

The presented example showcases a simplified representation of data reflecting user logins to an online portal. Each individual component represents an online account, and is linked to one or more IP addresses that have accessed it (figure \ref{fig:users logins}).

\begin{figure}[ht]
    \centering
    \includegraphics[width=14cm]{Figures/introduction/img1.jpg}
    \caption{Users logins}
    \label{fig:users logins}
\end{figure}

The visualization highlights that the majority of accounts have been accessed by a small number of IP addresses, with a few exceptions that show a significantly higher number of accessing IP addresses (figure \ref{fig:users logins with focus}).

\begin{figure}[ht]
    \centering
    \includegraphics[width=14cm]{Figures/introduction/img2.jpg}
    \caption{Users logins with focus on larger shapes}
    \label{fig:users logins with focus}
\end{figure}

A deeper analysis of such exceptional cases allows the analyst to identify potential security threats, such as in the case of a UK-registered user who has accessed the system from over 20 different locations (figure \ref{fig:user logins}). This approach has the potential to significantly enhance the security of organizations and provide critical insights into potential threats.

\begin{figure}[ht]
    \centering
    \includegraphics[width=14cm]{Figures/introduction/img3.jpg}
    \caption{User logins for analysis}
    \label{fig:user logins}
\end{figure}

Another example of utilization showed by the Cambridge Intelligence's article \cite{mediumsite} is about the Visual threat detection phase, always using the graph visualization. The visualization enables analysts to perform quick and precise assessments of events and cases flagged by automated tools. The visualization of a fictitious company's IT network showcases the various offices in different locations and the subnets between them. In this instance, a threat signature has been matched, indicating that an occurrence has taken place that appears similar to a previous malicious event. An analyst is now responsible for reviewing this alert and determining the necessary action quickly. By delving into the basic network overview, an intuitive, fast and comprehensive view of the situation can be obtained. In this scenario, a computer in Cambridge and a phone in Paris are sharing an unencrypted communications, and these devices can be isolated to determine which connected devices may have been impacted. By using this type of visualization, analysts can quickly and accurately review events and cases flagged by automated tools (figure \ref{fig:network representation}).

 This second example shown here, that represents a more common situation in a business context, and the others presented in the original article prove how the same visualization technique can fit different types of analysis, in different phases and how the analysts can benefit from the different visualization techniques for their purposes. 
\clearpage

\begin{figure}[ht]
    \centering
    \includegraphics[width=14cm]{Figures/introduction/img4.jpg}
    \caption{Network representation}
    \label{fig:network representation}
\end{figure}

The goal of this thesis is to investigate the use of visualisations in the field of cybersecurity. Specifically, the research aims to define the following purposes:

\begin{itemize}
\item Define a theoretical framework of the state of the art in security visualisation.
\item Define and indicate practical strategies to be followed.
\item Understand any gaps between the proposed theory and the practises used.
\end{itemize}

The theoretical framework should provide a comprehensive overview of the current state of research and practice in this area, including the key concepts, theoretical models, and empirical findings that underpin effective security visualization. The result produced by this work can guide the design and development of effective security visualization tools and systems by providing a set of principles and guidelines based on the current state of research and practice. Another type of use for which the framework can be exploited is the evaluation of the effectiveness of existing security visualization tools and systems, work that has been conducted for example in the following chapters of this thesis, exploiting the work developed by Balakrishnan in the chapter \ref{The SANS Framework}.

Any evaluations that have been carried out, both on theoretical research and on the various tools, have made it possible to describe hypothetical practical strategies based on the different needs and/or on the actual availability and characteristics of the developed products taken into consideration. Taking into consideration the different analyses, various types of practical indications can be indicated, such as for example the simple suggestion to use certain methods or tools, when possible, or in other cases an indication, supported by correct information, if wanted or needed to develop their own solution, starting from the foundations of those who have already developed and conceived.

These bases already present will precisely be the subject of discussion as regards the various possible gaps present, such as for example those between the objectives of the security visualization, and the results actually achieved, or a different type which can be the gap between the tools developed, very often as we will see more at an experimental level and the tools actually used.

To address these purposes, this thesis will review the existing literature on cybersecurity visualisations. The results of this research will provide insights into the current state of the field and offer recommendations for improving the effectiveness of visualizations in cybersecurity.

Overall, the use of visualizations has the potential to greatly improve cybersecurity by providing analysts and decision makers with a clearer understanding of the data and trends related to cyber threats. This research aims to contribute to the body of knowledge on this important topic and help organizations better protect themselves against cyber attacks.