# A Survey on Immersive Cyber Situational Awareness Systems
## 3 Visualization and Interaction Techniques
### Interaction Techniques for ICSA
**Filters:** Filters enable users to define inclusion and exclusion criteria within cybersecurity visualizations, allowing them to concentrate on the most relevant data and enhance their cyber situational awareness. For instance, the Network Feed application, proposed in [29], allows users to filter network traffic types (e.g., UDP, ICMP, and TCP) to obtain specific insights into cyber situations. **Extract/Share:** ICSA systems allow users to extract and share cybersecurity reports, status, and visualizations with each other for creating collaborative environments to estimate cyber situational awareness. Moreover, the collaborative assessment of cyber situational awareness facilitates the identification, selection, and preparation of an optimal action plan for achieving desired cyber situations. For instance, the 3D Cyber COP prototype, developed by [PERSON] et al. [32], shares different cybersecurity data visualizations with operators according to their roles (e.g., analyst, coordinator, and client). It also provides cybersecurity report extraction capability to coordinators at any given instance to perform collaborative analysis for estimating cyber situations in real time. **Aggregate/Relate:** ICSA systems enable users to aggregate cybersecurity data to make sense of what is going on in cyberspace. Recalling the example of the 3D Cyber COP prototype, cybersecurity experts combine raw data to create potential cyber incident scenarios [32]. This helps users predict possible cyber situations and prepare possible action plans accordingly. **Annotate:** Annotation refers to the addition of graphical or textual information on cybersecurity visualizations for a better understanding of cyber situational awareness. The metaphorical display of cybersecurity information allows users to add additional information on a given space beyond the helix [31]. Similarly, the 3D Cyber COP application enables cybersecurity analysts to share their analysis with each other by adding visual cues on cyber assets [32]. In this way, all the stakeholders involved in cybersecurity operations can obtain the same picture of cyberspace, which facilitates the execution of cybersecurity operations in a collaborative manner. **Record:** ICSA systems allow users to save their interaction logs and cybersecurity data trends for estimating the cyber situations of a given system. Historical data help users in detecting anomalies and predicting cyber situations. For example, the 3D Cyber COP application shows a system's parameter details (e.g., status, trend, and history) through a two-dimensional graph on a virtual 2D screen to help analysts in assessing cyber situational awareness [33]. **Comparative Analysis of Interaction Techniques for ICSA:** To strengthen the depth of analysis, we compare the identified interaction techniques in ICSA systems by evaluating their effectiveness, limitations, and application contexts. Selection techniques, such as gesture-, gaze-, touch-, and controller-based inputs, are foundational and vary in precision and ease of use. Gesture and gaze offer natural and immersive control, well suited for hands-free environments, but may lack accuracy in dense data scenes. Touch and controller-based methods provide higher precision, making them more suitable for tasks requiring detailed manipulation. Navigation through head tracking and point-and-click movement enhances spatial orientation and immersion, but may lead to fatigue or disorientation during prolonged use. Zoom-based navigation supports focus on specific elements but can interrupt global situational awareness if not smoothly integrated. Details-on-demand interactions enable users to access supplementary data when needed, supporting analysis without overwhelming the visual interface. However, excessive layering can increase visual complexity. Arrange/change and filter techniques empower users to tailor data views, reduce cognitive load, and focus on relevant threats, especially beneficial in high-volume or mission-critical environments.