# A Survey on Immersive Cyber Situational Awareness Systems
## 1 Introduction
ICSA systems provide several features for enhancing the cyber situational awareness of end-users [19]. While several related paradigms, such as digital twins, gamification, and the metaverse, share immersive characteristics, ICSA systems in this context are specifically grounded in extended reality technologies such as virtual, augmented, and mixed reality. These systems provide a range of features to enhance users' understanding of complex and evolving cyber threats. For example, ICSA systems present multidimensional cybersecurity data through different visualization techniques (e.g., metaphorical shapes, icons, and scatterplots) with an ability to arrange its multiple views through natural interaction features (e.g., gaze, gesture, and controller) in a spatial three-dimensional space around users for monitoring, analyzing and forecasting cyber situations. Moreover, a single immersive 3D display presents cybersecurity information in a unified manner, delivering a comprehensive cyber common operating picture while reducing cognitive load and eliminating the need for multiple traditional data views to achieve situational awareness. Furthermore, ICSA systems provide engagement, entertainment, and enjoyment in cybersecurity education and training processes [20], which significantly increases cyber situational awareness with less cognitive load and mental effort. With the adoption of the _Industrial Revolution 4.0_, ICSA systems can be employed in a variety of settings, including Security Operation Centers, operations of Computer Emergency Response Teams, Incident Response Management, Network Security Operations, and Computer Network Defense, as well as in cybersecurity education and training. Given the advantages of ICSA systems over traditional cyber situational awareness systems, researchers and practitioners have been putting a lot of effort into analyzing, designing, and evaluating visualization and interaction features of ICSA systems for a better understanding of cyber situational awareness. Therefore, the body of knowledge on ICSA systems has continuously been scatteredly expanding. Hence, we decided to collect, analyze, and synthesize the existing literature for systematizing and classifying the state of the art on ICSA systems. In this study, we have extracted, analyzed, and reported the existing literature on ICSA systems. In particular, our survey aims to review the visualization and interaction techniques, evaluation mechanisms, and levels of cyber situational awareness achieved for ICSA systems. The ICSA visualization and interaction techniques are then further analyzed in terms of the perception, comprehension, and projection phases of cyber situational awareness to propose a framework for designing and analyzing ICSA systems. Furthermore, this survey identifies future research directions for researchers and provides industrial insights for practitioners regarding ICSA systems. **Our Contributions**. In summary, our survey makes the following contributions. * It provides an overarching analysis of ICSA visualization and interaction techniques identified in the literature. Each visualization and interaction technique is reported in the context of perception, comprehension, and projection of ICSA systems. The visualization and interaction techniques are categorized based on a novel taxonomy separately. * It gives a comprehensive analysis of the situational awareness levels achieved for ICSA in the literature. For the first time, each level of situational awareness is described in the context of ICSA. The existing literature is categorized based on the defined levels of ICSA (i.e., perception, comprehension, projection). * It presents a high-level investigation of evaluation mechanisms used to validate ICSA systems. Each evaluation mechanism has been critically examined, focusing on ICSA usability evaluation, user demographics, performance, and cognition metrics. The evaluation mechanisms are categorized based on the methodology employed for validating ICSA systems.