# A Survey on Immersive Cyber Situational Awareness Systems
## 3 Visualization and Interaction Techniques
### Visualization Techniques for ICSA
[46], uses animations to demonstrate the impacts (e.g., the disappearance of applications, photos, or emails) of phishing attacks. This sort of information enables end-users to predict cyber situations caused by their actions. **360\({}^{\circ}\) Pictures:** Immersive visualizations employ 360\({}^{\circ}\) pictures to disseminate cyber situational awareness to end-users. 360\({}^{\circ}\) pictures present an overall and comprehensive view of cyber situations, which enhances the cyber situational awareness of end-users. A potential use of 360\({}^{\circ}\) pictures is highlighted in [48], in which 360\({}^{\circ}\) pictures are used to detect cybersecurity vulnerabilities in a given system. The identification of cybersecurity vulnerabilities indicates the severity of a cyber situation [13]. It also leads to the identification of potential countermeasures for eradicating the detected vulnerabilities. **Two-Dimensional Displays:** ICSA systems use two-dimensional displays for cybersecurity 2D data visualization in a 3D spatial space around end-users. For example, focusing on a single display of information, [PERSON] et al. [15] developed an AR application that shows cybersecurity data (e.g., threats and severity levels) through a virtual 2D event information panel along with physical monitors that show operational information, as presented by Figure 9. Similarly, the node-link graphs, presented in [29], display network data (i.e., command terminal windows and Wireshark displays) through 2D displays in an immersive 3D space. Two-dimensional displays are usually integrated with 3D visualization techniques in ICSA systems to enhance the cyber situational awareness of end-users. **List/Table/Text Displays:** ICSA systems need to display cybersecurity information through long-text, list, or tabular format. Therefore, immersive technologies employ lists, tables, or text summaries to represent cybersecurity information for enhancing the cyber situational awareness of end-users. For example, the VR system developed in [39] provides textual instructions for entering, navigating, and inspecting a virtual data center through a virtual tablet. Moreover, operational and security protocols are provided to end-users through the tablet for detecting and fixing an anomaly in the data center. Similarly, an AR-based cybersecurity awareness game [45] provides textual instructions to end-users regarding how to play the game (Figure 10); also, it gives an explanation behind each step taken by users in a textual format to raise their cybersecurity awareness. Figure 3:0 Icons [46]. **Comparative Analysis of Visualization Techniques for ICSA:** To address the depth of analysis, we critically compare the identified visualization techniques based on their effectiveness, limitations, and contextual relevance in ICSA systems. Geographical displays and node-link graphs are effective for representing distributed infrastructures and visualizing relationships within large-scale networks. They support spatial reasoning and structural understanding but can become visually dense in complex or highly dynamic environments. Metaphorical displays, such as 3D helices, provide intuitive and engaging representations for temporal or sequential data, enhancing pattern recognition. However, their abstract nature may require a learning curve and can limit immediate interpretability. Scatterplots and 3D bar charts support precise, multidimensional analysis and are well suited for anomaly detection and performance comparison. These methods, while analytically powerful, can become cognitively demanding as data volume increases. Icons, symbols, and glyphs are frequently used for intuitive labeling and quick recognition, especially in user-friendly or educational settings, though they may oversimplify nuanced data. Animations and video displays are highly effective for illustrating causal effects, user actions, and attack consequences, making them suitable for training and awareness. Yet, they often lack interactivity and analytical flexibility.