# A Survey on Immersive Cyber Situational Awareness Systems
## 3 Visualization and Interaction Techniques
### Visualization Techniques for ICSA
Figure 4 shows the node-link graphs developed by the 3D Network Visualizer application for cyber situational awareness. Figure 3: Metaphorical display [31]. Figure 2: Geographical display [29]. **Scatterplots:** Cybersecurity data need to be correlated with different cybersecurity parameters for a better understanding of cyber situations. For this purpose, immersive three-dimensional scatterplots are used to display relationships among cybersecurity data. Moreover, additional cybersecurity information can be visualized through different colors, shapes, and sizes of objects in scatterplots. An interesting example of immersive scatterplots is reported in [36], where different sets of network traffic data are displayed through scatterplots for different networks (Figure 5). The color, shape, and size of data objects present different cybersecurity parameters (e.g., anomalous and normal traffic data) for better perception and analysis of cyber situations. **Three-Dimensional Bar Charts:** Three-dimensional bar charts refer to the representation of information with rectangular bars of different widths, heights, and colors presenting the corresponding cybersecurity data in an immersive three-dimensional space. These charts are mostly used to perform a comparative analysis of multidimensional data in the cybersecurity realm. For instance, [PERSON] et al. [37] developed a prototype application, called MINER, to perform a network anomaly analysis with 3D bar charts (Figure 6). The unique design of these 3D bar charts allows for a more intuitive and time-efficient identification of irregularities within network data. By presenting the information in this visually accessible manner, MINER enhances the cyber situational awareness of its end-users. Figure 4: Node-linkgraph [29]. Figure 5: Scatterplot [36]. **Volume:** Volume refers to the 3D object representations of cybersecurity data, encompassing assets, cyberattacks, and countermeasures, to aid end-users in understanding and managing cyber situations. For example, Figure 7 presents the cartoonish 3D models and virtual shields that are used to show cybersecurity threats and countermeasures, respectively, in an AR-based serious game reported in [42]. Similarly, 3D round-shaped objects (e.g., spheres) of red and green colors to indicate faulty and normal equipment, respectively, are used in debug UIs developed to detect anomalies in high-performance computing environments [11]. The literature reporting the use of _volume_ in ICSA systems is presented in Table 4.  
**Icons/Symbols/Glyphs:** ICSA systems use icons, symbols, or glyphs to represent cybersecurity data for better perception and comprehension by end-users. Our survey shows that this immersive visualization technique is extensively used in ICSA systems for cyber situational awareness (Table 4). For instance, an AR-based application, reported in [46], uses icons to indicate objects for navigating into the application, such as the _trash-bin icon_ for delete and the _open icon_ for open operation, as presented by Figure 8. Moreover, other different icons, such as email and trashcan icons, are used to open and delete an email. Similarly, the 3D Network Visualizer applications use icons to show a variety of network components, including switches, computers, and routers [29]. The use of icons, symbols, or glyphs increases the understanding and perception of cyber situations by end-users. Figure 6: Three-dimensional bar chart [37]. Figure 7: Volume rendering [42]. **Animation/Video Displays:** ICSA systems use animations and videos to display cybersecurity information (e.g., impacts of cyberattacks, and countermeasures' implementation process) for enhancing cyber situational awareness of end-users. For example, [PERSON] et al. [11] presented a concept of animation in their developed AR-based framework for fixing anomalies in large-scale infrastructures. For instance, animations include instructions to fix an anomaly to enhance cybersecurity. Similarly, the application on phishing education [49], developed by [PERSON] et al.