# Study on Cyber Common Operational Picture Framework for Cyber Situational Awareness
## 5 Conclusions  
The purpose of this research was to design and implement a CyCOP framework for situational awareness in cyberspace. By analyzing the JCOPP and U.S.ATP 2-01.3 IPB documents prepared based on JP 3-12, the screens to be visualized in CyCOPs were identified. In addition, studies related to the interface (response time, UI, object symbol, object size) for designing and implementing CyCOPs were investigated. Based on the investigations, the CyCOP framework was designed and described for each visualization screen implemented. Finally, an experiment was conducted to measure the response time of 5 visualization screens to prove that the implemented CyCOP satisfies the inquiry (simple) and inquiry (complex) criteria. As a result, the response speed of the 5 visualization screens was about 0.11 s on average for inquiry (simple) and 1.07 s on average for inquiry (complex). This conforms to the common response times of inquiry (simple) and inquiry (complex) in Table 6.  
This study presented the criteria (UI, object symbol, object size, response time) for rapid cyber situation awareness in a framework. If CyCOP is developed by applying these standards, the military will be able to have strong cyber command and control capabilities. In the private sector, it will be possible to identify and respond to various cyber-crimes that can occur in the currently operating service in real time. In future research, we will implement visualizations (c) to (c), which correspond to the 3 rd and 4 th stages of the U.S.ATP 2-01.3 IPB stage. Visualization (c) uses cyber asset information and ATT & CK's APT Groups data. Visualization (c) utilizes cyber kill chain, ATT&CK's Tactics, and CVE information to visualize network threats within the company. Visualization (c) predicts and visualizes the network activity time in areas where many attacks occur. Visualization (c) identifies which malware was used, which APT group it belongs to, and profiles cyberattacks. Visualization (c) establishes, selects, and prioritizes cyber threat countermeasures. Therefore, the final form of CyCOP will have the ability to actively respond to and prepare for cyber-attacks.  
Conceptualization, K.K. ([PERSON]), J.Y. and S.Y.; Funding acquisition, D.S.; Methodology, K.K. ([PERSON]), S.Y. and J.K.; Design of Cyber Common Operational Picture Framework, K.K. ([PERSON]) and K.K. ([PERSON]); Supervision, D.S.; Validation, J.K.; Writing--original draft, K.K. ([PERSON]) and K.K. ([PERSON]), Writing--review and editing, D.S. All authors have read and agreed to the published version of the manuscript.  
This research was supported by the Future Challenge Defense Technology Research and Development Project (9129156) hosted by the Agency for Defense Development Institute in 2020.  
Not applicable.  
The authors declare no conflict of interest.  
\begin{table}
\begin{tabular}{c c c c c c} \hline
**Behavior** & \⃝1 & \⃝2 & \⃝3 & \⃝4 & \⃝5 \\ \hline Inquiry (simple) & 0.12 & 0.11 & 0.11 & 0.10 & 0.14 \\ Inquiry (complex) & 1.50 & 0.94 & 0.92 & 0.63 & 1.38 \\ \hline \end{tabular}
\end{table}
Table 10: Response Time for each CyCOP Visualization.