# A Survey on Immersive Cyber Situational Awareness Systems
## 6 Discussion
### Future Research Areas  
Through the analysis of our research findings, we have identified potential future research directions for researchers aimed at improving the existing state of ICSA systems. **Projection of ICSA. ** The projection phase is a critical component of ICSA, enabling users to anticipate future cyber events and formulate appropriate response strategies. However, as highlighted in our proposed framework (Figure 11), there is a notable gap in the use of immersive visualization and interaction techniques specifically tailored for this phase. Most existing solutions focus heavily on perception and comprehension, while projection remains underexplored. We encourage researchers and system designers to address this gap by developing immersive methods that support forecasting and predictive analysis within virtual environments. Enhancing the projection phase will provide users with a more holistic situational understanding, improving their ability to proactively respond to emerging cyber threats. **Integrating Advanced Immersive Visualization and Interaction Techniques. ** Immersive technologies provide a powerful array of visualization and interaction methods that remain largely untapped in the context of ICSA. Integrating advanced techniques such as flow visualizations, Kohonen maps, 3D heatmaps, import interactions, and spatial navigation (drive interactions) can significantly enrich users' understanding of cybersecurity data. Flow visualizations [66] are particularly useful for mapping data movement across networks, allowing users to detect abnormal patterns and suspicious activity. Kohonen map representations [67], also known as self-organizing maps, provide a means of visualizing high-dimensional data in a two-dimensional space, which can be instrumental in identifying clusters and anomalies in large datasets. Heatmap visualizations [68] employ a three-dimensional approach to represent data, where color gradients indicate data intensity and the height of the map reflects the magnitude of specific metrics. This method offers an intuitive understanding of data variations and hotspots. Import interactions [69] involve the ability to seamlessly bring external data into the immersive environment, enhancing the user's capacity to analyze and correlate diverse data sources. Drive interactions [70] refer to the techniques that enable users to navigate through the virtual space effectively, providing them with a more immersive and interactive experience. The incorporation of these advanced visualization and interaction techniques into the ICSA domain can significantly enhance the capability of developers and practitioners to design and operate ICSA systems. By leveraging these techniques, users can gain deeper insights into cyber threats and network activities, enabling more effective monitoring, analysis, and response. Furthermore, we strongly advocate for the continuous development and integration of new visualization and interaction techniques tailored specifically for cyber situational awareness in immersive environments. This ongoing innovation is essential to keep pace with the evolving nature of cyber threats and to ensure that ICSA systems remain robust, intuitive, and effective. **Large-Scale User Study:** As discussed in Section 5, many ICSA systems are evaluated through user studies involving a relatively small number of participants. While these studies provide useful early-stage insights, they limit the broader applicability of findings. For example, systems tested with only a few users may not reflect the needs of large-scaleinfrastructures that involve multiple roles, varied operational contexts, and diverse user profiles. Feedback from a small group can overlook usability challenges and functional gaps that only emerge in more complex or realistic environments. This restricts the generalizability and scalability of current ICSA systems. To overcome these limitations, we advocate for large-scale user studies during the design and evaluation of ICSA systems.