# A Survey on Immersive Cyber Situational Awareness Systems
## 6 Discussion
### A Reference Framework for Designing and Analyzing ICSA Systems  
Unlike the traditional cyber situational awareness frameworks [57], there exists no framework for the designing elements (i.e., interaction and visualization techniques) of ICSA systems to create perception, comprehension, and projection of cyber situational awareness. This gap in the literature and practice presents significant challenges for developers and practitioners working on ICSA systems, as they lack a standardized guide to create systems that effectively enhance the perception, comprehension, and projection of cyber situational awareness. The absence of such a framework leads to several specific issues. Developers, when faced with a multitude of available features and options, often find it difficult to identify the most suitable visualization and interaction techniques for their specific objectives, such as improving user comprehension. This difficulty can result in inefficiencies and increased costs during both the design and operational phases of ICSA systems. Without a clear framework, the process of trial and error becomes more prevalent, which can delay development timelines and inflate budgets. Also, the lack of a structured approach can lead to inconsistencies in system performance and user experience, undermining the efficacy of ICSA systems in real-world applications. For instance, a developer aiming to design an ICSA system with a primary focus on enhancing user perception might struggle to select the appropriate visualization techniques that provide clear and immediate insights into cyber threats. Similarly, interaction techniques that facilitate quick and intuitive user responses might be overlooked or misapplied. These challenges are exacerbated when considering the need to balance multiple design elements simultaneously, such as ensuring that the system is both comprehensive and comprehensible. To address these significant challenges, we have undertaken the task of mapping visualization and interaction techniques (detailed in Section 3) to the different levels of ICSA (outlined in Section 4). This mapping process has culminated in the development of a reference framework that categorizes existing interaction and visualization techniques according to the three critical levels of ICSA: perception, comprehension, and projection. Figure 11 illustrates this framework, demonstrating the immersive visualization and interaction techniques applicable at each level of ICSA. For instance, basic visualization techniques such as _volume_ and interaction features like _select_ are essential components at the perception level of cyber situational awareness. These techniques are utilized within our framework to enhance the perception level of ICSA, providing users with clear and immediate insights into cyber threats. Our reference framework is designed to aid developers and practitioners in identifying the most suitable visualization and interaction techniques when designing and operating ICSA systems for specific purposes, whether it be for perception, comprehension, or projection. By offering a structured approach, this framework ensures that the selection and implementation of these techniques are efficient and effective, ultimately enhancing the overall design and functionality of ICSA systems. Moreover, the framework plays a crucial role in facilitating anomaly detection and mitigation processes within ICSA systems. Categorizing immersive techniques based on their applicability to different levels of situational awareness enables the creation of more robust systems that can promptly identify and respond to anomalies. This capability is particularly important in the dynamic field of cybersecurity, where timely and accurate situational awareness is critical to preventing and addressing cyber threats. To strengthen the practical relevance of the proposed framework, we have mapped specific techniques to the three levels of situational awareness using concrete examples from the surveyed literature.