# Study on Cyber Common Operational Picture Framework for Cyber Situational Awareness
## 3 Design and Implementation of the CyCOP Framework
### CyCOP Visualization  
The CyCOP interface was designed in compliance with the reaction speed, UI, object symbol, and object size derived from Section 2. In order to comply with the reaction speed, the minimum number of resource files (js, css, etc.) was called during the visualization output. The UI was designed as shown in Figure 5. However, as suggested in Section 2.3.2, the UI shape slightly changed depending on the intent of the CyCOP visualization screens or type of data mainly used. The object symbols conformed to the standards of MIL-STD-2525D [40]. The object size was designed and implemented with a size of 13 pixels, as suggested in Section 2.3.4. Table 9 lists information for the hardware and software used to implement the CyCOP. From a military point of view, IPB stages 1 and 2 are preparation stages for cyberattacks. In the case of the 3 rd and 4 th stages of IPB, \"information\" and \"operation\" are the areas of response to cyber-attacks. Because the goal of this study was to prepare for cyberattacks, we designed and implemented visualizations 1 to 5, which corresponded to IPB 1 and 2, among the types of CyCOP visualizations shown in Figure 4. The visualization screens from 1 to 5 of the CyCOP visualizations in Figure 4 and the data used for visualization are shown in Figure 6.  
Visualization 1 uses information such as the AS source, destination, and route from the BGP data. As shown in Figure 7, by linking the corresponding information with the visualization, the status of Internet network activity in the area of interest can be viewed dynamically. On the left interface, you can see the origin and destination of packets. On the right interface, it is possible to check whether a packet goes from a specific area to a specific \begin{table}
\begin{tabular}{c c} \hline \hline
**Items** & **Descriptions** \\ \hline OS & Windows 10 Pro \\ Processor & AMD Ryzen 7 3700X 8-Core Processor 3.59 GHz \\ Memory & 64 GB \\ Development languages, & Python 3.9, django 4.1, deck.g1 8.4, Unity 2022.1.13., bootstrap \\ software and tools & 5.2.0, oracle 21c, Google Maps Platform \\ \hline \hline \end{tabular}
\end{table} 
Table 9: CyCOP Implementation Environment Hardware and Software. destination via a specific area. This allows the network security officer to check which AS path the network packets accessing the enterprise access through. Such a visualization screen can be utilized by adding various functions. For example, adding functions such as network anomaly detection to Back-End can visualize packets suspected of being attacked. Visualization 2 uses the same map service API as Google Maps to visualize the satellite view-based map, as shown in Figure 8. On top of that, geographic information such as GeoJSON, other data, internal network information, and information such as the location/facility/building are mixed and visualized. The left interface shows the legend of the icons, and the central interface shows the satellite view-based map. Visualization 3 shows the physical network status of a specific facility in visualization 2 in detail, as shown in Figure 9. Among the physical network assets, it mainly visualizes the router, and checks the information of the router and how the routers are connected. The data used include GeoJSON, other data, and internal network information. The left interface shows the legend of the icons, and the right interface shows detailed information about the facility selected in the central interface. In general companies, it is possible to check the connection status of router devices of buildings managed in-house. The military can check how network devices are distributed within the threatening or threatened area. Through this, you can use operations such as disabling certain buildings and blocking certain networks. Figure 8: Visualization 2: Satellite View-based Geographic Visualization. Figure 7: Visualization 1: Visualization of Internet Network Activity in the Area of Interest. Visualization 4 is used to understand the internal network of the facility selected in visualization3.