# A Survey on Immersive Cyber Situational Awareness Systems
## 3 Visualization and Interaction Techniques
### Visualization Techniques for ICSA  
Immersive technologies provide several unique features for complex and multidimensional cybersecurity data visualization to enhance the understanding of end-users. For example, these features include spatial immersion, situated analytics, embodied data exploration, collaboration, multisensory presentation, and engagement for complex data presentation and analysis [28]. This enhances the perception, comprehension, and projection of cyber situational awareness for end-users. To answer RQ1, we identified 11 distinguishable visualization techniques of immersive technologies from the existing literature used for creating cyber situational awareness. Table 4 presents the identified visualization techniques along with their corresponding literature. In the following, we report the details of each visualization technique for ICSA. **Geographical Displays:** ICSA systems use geographical displays to represent cybersecurity data for creating cyber situational awareness. Geographical displays refer to the visualizations that present cybersecurity data with their geographical locations (e.g., position coordinates of longitude and latitude). The spatial information helps end-users (e.g., cybersecurity experts, trainees, and analysts) to understand a cyber situation, which facilitates their decision-making and execution of action plans accordingly. For instance, an immersive 3D Network Visualizer application, developed by [PERSON] et al. [29], displays networks' topology with their geographic coordinates. In each network topology, network nodes and edges are overlaid onto a real-world globe based on their geographical locations, as presented by Figure 2. It can also be seen that cybersecurity alerts/flags are placed on corresponding nodes and edges, which facilitates end-users in monitoring and detecting cybersecurity anomalies in large-scale networks. \begin{table}
\begin{tabular}{l l} \hline \hline
**Visualization Techniques** & **Papers** \\ \hline Geographical Displays & [11; 12; 29; 30] \\ \hline Metaphorical Displays & [31] \\ \hline Node-Link Graphs & [29; 32; 33; 34; 35] \\ \hline Scatterplots & [36] \\ \hline Three-Dimensional Bar Charts & [37] \\ \hline Volume & [11; 14; 15; 20; 29; 31; 32; 33; 38; 39; 40; 41; 42; 43; 44; 45] \\ \hline Icons/Symbols/Glyphs & [12; 29; 41; 42; 45; 46; 47] \\ \hline Animation/Video Displays & [11; 46; 47] \\ \hline
360\({}^{\circ}\) Pictures & [45; 48] \\ \hline Two-Dimensional Displays & [14; 15; 29; 32; 33; 38; 39; 40; 47] \\ \hline List/Table/Text Displays & [11; 12; 31; 33; 38; 40; 45; 46; 47] \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Identified immersive visualization techniques and their sources. **Metaphorical Display:** Cybersecurity visualizations leverage metaphors to represent cyber situations in a comprehensible manner. Metaphorical displays provide clarity and context of cyber situations without any data occlusion. For example, [PERSON] et al. [31] developed a helix structure to display arranged, organized, and systematized cybersecurity data. The 3D helical representation, presented by Figure 3, helps users in monitoring and detecting periodic signals of cyberattacks. A user is placed inside the helix, surrounded by cybersecurity data, to obtain insights into cyber situations with proper context and less obstruction. **Node-Link Graphs:** Large-scaled network topologies are presented by node-link graphs to identify and understand how nodes (e.g., entities) are connected with each other. This provides an overview of network topologies, where nodes and their links are drawn as points and lines, respectively. For instance, the 3D Cyber COP prototype, developed by [PERSON] et al. [32], presents a holistic view of network topologies through node-link graphs for cybersecurity coordinators, which provides them with an understanding of network security state. Similarly, the 3D Network Visualizer application [29] contracts node-link graphs for showing network assets and their relationships with each other.