# A Survey on Immersive Cyber Situational Awareness Systems
## 3 Visualization and Interaction Techniques
### Interaction Techniques for ICSA  
An interaction technique refers to an approach to interact with immersive visualizations for creating and maintaining cyber situational awareness for a given system. We have identified nine interaction techniques for ICSA systems through the existing literature. Table 5 presents the identified interaction techniques with their corresponding literature. In the following, we describe each interaction technique of ICSA systems for creating cyber situational awareness. **Select:** Users engage with ICSA systems by selecting objects or options to carry out tasks such as organizing and interacting with cybersecurity data, thereby enhancing their cyber situational awareness. Immersive technologies provide several ways for the selection task in ICSA systems. This includes touch selection [12], gaze selection [37], point selection [20], gesture selection [29], controller selection [39], and custom marker selection [42]. These natural interactions make the selection task easier for end-users than the traditional mouse and keyboard selection, in which investigation of large-scale networks becomes cumbersome when users try to reach a specific node [50]. **Navigate:** Navigation refers to the interactions that help users move in ICSA systems to gain cybersecurity awareness. Most immersive technologies employ head tracking to enable their users to navigate ICSA systems with physical movements [20]. Head tracking provides a natural experience of moving around 3D virtual elements for obtaining a comprehensive perception and comprehension of cyber situational awareness [50]. Similarly, immersive technologies use selection techniques with virtual objects, allowing users to navigate ICSA systems. For example, users point and click on 3D arrows to navigate around a VR environment presented in [39]. Another navigation technique is zooming, which provides users with zoom-in and zoom-out capabilities for navigating ICSA environments. **Details on Demand:** Users of ICSA systems need the necessary details of cybersecurity data for understanding, analyzing, and forecasting cyber situations. Therefore, immersive technologies offer _details on demand_ capability in ICSA systems to display detailed information about cybersecurity data, when required by end-users. For instance, the 3D Network Visualizer application shows the detailed network traffic, through command terminal windows and Wireshark displays, on top of nodes in a node-link graph to diagnose a network cyber situation [29]. **Arrange/Change:** Organization of cybersecurity data provides insights of cyber situations to end-users. Therefore, ICSA systems enable users to arrange and change cybersecurity data, statistics, and views in a comprehensible manner so that they can perceive cyber situations with minimum cognitive load. This includes information highlighting, changing \begin{table}
\begin{tabular}{l l} \hline \hline
**Interaction Techniques** & **Papers** \\ \hline Select & [11; 12; 20; 29; 30; 31; 32; 33; 34; 35; 36; 37; 38; 39; 40; 42; 45; 47; 50; 51; 52] \\ \hline Navigate & [11; 20; 29; 30; 31; 32; 33; 38; 39; 40; 46; 47; 50] \\ \hline Details on Demand & [11; 12; 20; 29; 30; 31; 32; 33; 37; 38; 39; 40; 45; 46; 47; 53; 54] \\ \hline Arrange/Change & [29; 30; 31; 32; 33; 36; 37; 39; 40; 46] \\ \hline Filter & [29; 31; 32] \\ \hline Extract/Share & [32; 50] \\ \hline Aggregate/Relate & [31; 32; 36; 37] \\ \hline Annotate & [31; 32] \\ \hline Record & [33] \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Identified immersive interaction techniques and their sources. attribute mapping, and changing representations (i.e., customization) of cybersecurity visualizations, which enhances users' cyber situational awareness. For example, users can change angles between radial data and helix of the helical visualization, proposed in [31], to visualize cybersecurity data with clarity.