\subsection*{Vulnus}
Vulnus \cite{vulnus_paper} is born with the objective of proposing a solution to dynamically inspect and compare vulnerabilities present within a network and simulate the effects that potential fixes would have on the network. The tool is designed for roles such as security managers, who need to interact with various information regarding the state of system vulnerabilities on the network and make decisions regarding potential fixes and their relative priorities. During the evaluation of priorities, elements such as the spread of vulnerabilities within the network, their impact, and the level of danger they pose should be taken into account. To provide this assessment, vulnerabilities are evaluated using both the CVE \cite{cve_site} score, with associated metrics like CVSS \cite{cvss_site}, and a score called ``Target Environmental", which is automatically calculated by the tool. The Target Environmental score is calculated, or rather extracted, from the Attack Graph that is computed on that network, which is a graphical representation that depicts the potential paths an attacker can take to compromise a computer network or system.

\begin{figure}[h]
    \centering
    \includegraphics[angle=90, width=\textwidth, height=\NewHeight]{Figures/chapter4/Vulnus/img1.png}
    \caption{Vulnus default sub-network view}
    \label{fig:vulnus}
\end{figure}
\begin{figure}[h]
    \centering
    \includegraphics[angle=90, width=\textwidth, height=\NewHeight]{Figures/chapter4/Vulnus/img4.png}
    \caption{Vulnus network view}
    \label{fig:vulnus2}
\end{figure}
\begin{figure}[h]
    \centering
    \includegraphics[angle=90, width=\textwidth, height=\NewHeight]{Figures/chapter4/Vulnus/img3.png}
    \caption{Vulnus vulnerability view}
    \label{fig:vulnus3}
\end{figure}
\begin{figure}[h]
    \centering
    \includegraphics[angle=90, width=\textwidth, height=\NewHeight]{Figures/chapter4/Vulnus/img2.png}
    \caption{Vulnus score view}
    \label{fig:vulnus4}
\end{figure}
\FloatBarrier
For the calculation of these metrics, the tool utilizes data from scanners such as OpenVAS and Nessus, which enable the identification of vulnerabilities present in the nodes within the network. In the currently available online prototype version \cite{vulnus_site}, unfortunately, it is not possible to input additional scans or personal files, therefore, the analysis and evaluations can only be performed on the existing dataset upon startup. Upon opening the page, you can observe that the main section is dedicated to the visualization of nodes within the network using a modified version of a TreeMap Bar chart. This panel represents the distribution of nodes based on their subnet, or can be displayed according to vulnerabilities or calculated scores (figures \ref{fig:vulnus},\ref{fig:vulnus2},\ref{fig:vulnus3},\ref{fig:vulnus4}). The nodes are visualized as rectangles, and within them, various subdivisions of colors and sizes represent different information (figure \ref{fig:vulnus_node}), for example, the size of the rectangle indicates the cardinality of the vulnerability. Additionally, in the upper left corner, triangles are placed to indicate whether the node is a source (blue triangle) or a target (yellow triangle). By hovering the mouse over a node, information about its scores is shown. In the bottom part of the page, you will find various tools that can be used for analysis through two main types of operations: selection and inspection. The tool allows you to select nodes in different ways, both from the tool panel and the central panel, leveraging the full interactivity of all the components on the page. Among these tools, there are two elements in particular. The first is a frequency chart of the selected vulnerabilities, while the second is a radar diagram that enables immediate comparison based on score evaluations. Finally, in the bottom-right part of the page, there is a sorted list of vulnerabilities that need to be fixed, calculated through the attack graph. Specifically, the vulnerabilities are displayed in descending order based on their impact on the various paths calculated by the tool. By selecting them, the attack graph is recalculated and, as a result, the visualization is updated, allowing for a ``what-if" analysis, as defined by the developers, to provide an idea of the effects that resolving these vulnerabilities may have on the network (figure \ref{fig:vulnus_post}).

\begin{figure}[h]
    \centering
    \includegraphics[scale=.3]{Figures/chapter4/Vulnus/figure2.png}
    \caption{Example of node visualization. a) the base score is encoded by a red sliding windows that progressively covers the node blue background and it is in the fourth level (range [6, 8)); b) the target environmental score is encoded by the sliding window red color and it is in the fourth level (range [6, 8]); c) the exploitability bar-gram shows that about 25\% of the vulnerabilities have a very high exploitability (black, range [8, 10]); d) the yellow triangle classify the node as a target node; e) the pink upwards arrow indicates the Target Environmental has increased with respect to the last scan. Provided by \cite{vulnus_paper}.}
    \label{fig:vulnus_node}
\end{figure}
\FloatBarrier
And it is precisely this last feature that is one of its major strengths because, in addition to providing an ``approximated optimal fixing strategy," by updating the visualization of vulnerabilities and consequently the possible paths at each iteration, it allows the analyst to identify a suboptimal strategy that may differ from the calculated one but is more aligned with the limitations imposed by the organizational context, which may not always allow for instant fixes. At the visualization level, as seen in this example, it is evident that even large-scale networks can be represented clearly without the loss of information. Unfortunately, as previously mentioned, the tool is only available in this non-modifiable prototype version. Despite its functional and adequate features, the inability to input scan files limits the tool's usability, and additionally, no information is provided regarding the current development status, thereby restricting its purpose to a practical demonstration.

\begin{figure}[h]
    \centering
    \includegraphics[angle=90, width=\textwidth, height=\NewHeight]{Figures/chapter4/Vulnus/img_post_filtri.png}
    \caption{Vulnus view after first 4 CVE fixed in ``what-if" analysis}
    \label{fig:vulnus_post}
\end{figure}
\FloatBarrier
In terms of the development phases, we can identify a phase of defining \emph{Visualization goals} conducted in collaboration with specialists such as security managers and security operators. The paper does not provide specific details, but rather examples of the main activities that need to be carried out. During the \emph{data Preparation} phase, as mentioned earlier, it is possible to use data from scanners, even though uploading is not allowed in the current prototype. One of the main features of the tool lies precisely in this phase, which involves processing this data for the calculation of the attack graph and its corresponding scores. The paper provides interesting insights for the \emph{Exploration} phase, as it not only emphasizes collaboration in decision making with the group of specialists, but also highlights the continuous modification of initial visualizations based on their interactions, leading to the prototype we observe. For the final phase of \emph{Feedback and fine-tuning}, once again, the use of surveys is mentioned for evaluating usability and effectiveness with users of varying levels of experience, resulting in a generally positive evaluation from more experienced users.


