# Study on Cyber Common Operational Picture Framework for Cyber Situational Awareness
## 1 Introduction  
With the rapid growth of the Internet, the number of cyber-attacks within cyberspace increases day by day, which increases the importance of cybersecurity [1, 2]. Recognizing this importance in the field of defense, the United States Department of Defense designated cyberspace as the fifth battlefield after land, sea, air, and space [3]. It also distributed doctrines for planning, executing, and evaluating operations in cyberspace [4].  
Cyber-attacks are being actively conducted not only in peacetime but also in wartime situations. For example, in the ongoing war between Ukraine and Russia, hybrid warfare, a complex tactic that mobilizes cyber-attacks as well as conventional attacks, has been consistently implemented since the beginning of the war [5, 6]. Cyber-attacks against Ukraine surged 196% in the first three days of combat, while those against Russia increased by 4% [7].  
In order to prepare for such a cyber-attack, it is necessary to quickly recognize the cyber situation. To do this, a Cyber Common Operational Picture (CyCOP) is usually required,which commanders and security officers can use for cyber situational awareness. In order to develop an effective CyCOP, screens that can analyze data in cyberspace or real data from multiple perspectives are first required. Second, it must have a fast response time and high awareness because it is necessary to quickly grasp the situation in cyberspace, and where data is coming and going. Visualization for this situational awareness is essential not only in national defense but also in the field of information protection. In particular, visualization for situational awareness is very helpful when conducting cyber battle training. Cyber warfare training requires a detailed understanding of the cyber situation of the Red and Blue Teams. Accordingly, this research studied a design for a CyCOP framework for cyber situational awareness. The goal of this paper is to consider all aspects of visualization for rapid cyber situational awareness. Most of the research on cyber situational awareness has been conducted in the military. Accordingly, it is necessary to collect and organize data on cyber situational awareness and visualization defined by many military forces. In order to find out how fast visualization is necessary, studies on response time should be investigated. Rapid cyber situational awareness should be easy to recognize at a glance. To do so, it is necessary to investigate the shape and size of icons with good visibility. Accordingly, this paper consists of five sections. Section 2 shows the need for CyCOPs based on the operational planning and cyber situational awareness specified in published military manuals. Then, we show how screens to compose CyCOPs were identified and studies such as those on the response time and object icons were investigated to compose the interface. Section 3 draws implications from the published military manuals and various research data investigated in Section 2. Then, based on the derived implications, we show how the CyCOP framework was designed and implemented. Section 4 discusses an experiment on the response time of the implemented CyCOP screens. Finally, Section 5 draws conclusions about this paper.