# Study on Cyber Common Operational Picture Framework for Cyber Situational Awareness
## 4 CyCOP System Response Speed Test  
The framework designed in Section 3 was implemented as shown in Figures 7-11 in compliance with the UI, object symbol, and object size investigated in Section 2. However, because the response speed could not be confirmed with pictures, it was proven by experiments. The experiment tests the response speed of the implemented visualizations 1 to 5. To measure the response speed, the developer tools provided in the Google Chrome browser were used.  
Experimental items were extracted from the items in Table 6. Items with simple response times were excluded because these were difficult to measure in a web environment. However, the items corresponding to the complex response times were selected for an experiment on the detailed information inquiry and screen output of objects for which people are most sensitive to the response speed. Among these, File Update was excluded because it is a function that is not in the visualization implemented in this research. Accordingly, the finally selected test items are inquiry (simple) and inquiry (complex).  
Figure 11: Visualization 5: Visualize the Three Layers of Cyberspace.  
Figure 12: Diagram of Object Relationships between Network Layers.  
When any object in a visualization screen was clicked, a detailed description of the object was displayed in the interface on the right side of the screen. Inquiry (simple) measured the time from when an object was clicked on the visualization screen until the detailed description of the object appeared on the right interface. The object information was requested from the server, as shown in square 1 in Figure 13. As shown in square 2, the time (response time) until the object information was received on the CyCOP visualization screen (Client) was measured in the Network tab of the browser developer tool. Inquiry (complex) called a visualization screen using multiple external/internal data. To measure this, the time of the red box in Figure 14 was measured. This meant the time it took for all assets needed to output the visualization screen to be called. For objective evaluation, when measuring inquiry (simple) and inquiry (complex), after clearing the entire browser cache and calling 10 times, the average was derived as listed in Table 10. As a result of the experiment, inquiry (simple) showed a fast response speed of about 0.1 s for all visualizations. In the case of inquiry (complex), visualization 4 showed the fastest response time (0.63 s) and visualization 11 showed the slowest response time (1.50 s). This was because visualization 4 had the fastest speed because the resource was not called for a large image. In the case of visualization 11, it showed the slowest speed because it was the first screen to call information about multiple packets and Google Map API.  
Figure 14: Measuring Inquiry (complex) Response Time in Browser Developer Tools Network Tab.  
Figure 13: Measuring Inquiry (simple) Response Time in Browser Developer Tools Network Tab.  
What can be learned through this experiment is that only information that needs visualization should be retrieved and displayed. This is because if you call for a large amount of DB query information and APIs, the speed slows down. Slowing down means that rapid cyber situational awareness is impossible after all. The slower the cyber situational awareness, the more vulnerable it is to cyberattacks.