# Data-Driven Network Anomaly Detection with Cyber Attack and Defense Visualization
## 6 Prototype  
This paper includes an exploratory proof-of-concept demonstration developed as a web service that queries required data from a MySQL database and sends them to a visual display. The front-end is developed through a combination of JavaScript and C# published as a WebGL project from the new Unity software Entity Component System (ECS) [62]. Figure 6 shows our high-fidelity prototype with self-explanatory iconography and simple categorization of system functions. System navigation is placed on the left side with the following:  
* _Network Discovery:_ This executes an automated _bash script_ described in Section 4.1. In case of network discovery performed outside our prototype, the data can be loaded as a CSV file through the _select file_ icon on the bottom left side of the page.
* _Network Model:_ This displays the scanned network topology.
* _Attack Data:_ This allows loading the attack data described in Section 4.3. These data can be 100% completely loaded as used in our experiment but can also be modified for different studies.
* _Reports:_ This summarizes exportable data from the experiment.
* _Refresh:_ This allows a new experiment to be conducted.
* _GET TCE%:_ This calculates the TCE and displays it on the top right side of the page.
* _Resolve:_ This runs the defense mitigation strategy described in Section 4.8.  
The top dashboard summarizes our experiment including 3857 TCP connections, a total experiment time of 5 min, and an initial TCE of 8%. However, in a real environment, immediate defense and mitigation should occur on detection, and our visual system is set only to deploy the _resolve module_ on Section 4.8 on execution from the user so that cyberattack effects can be viewed first.  
These technical details and functional aspects of our proof-of-concept prototype build on our prototype's topology, as summarized in Figure 6, that depicts a real-time interactive network model having an array of network devices and connections. This high-level overview demonstrates the prototype's structural and operational accuracy, reflecting a  
Figure 6: Snapshot of the proposed prototype.  
complex network. As explained, the technical backbone combines a MySQL database queried by a web service, with a responsive front-end JavaScript and Unity's ECS interface, emphasizing real-time data processing. For a practical demonstration of the system's versatility, the prototype incorporates various simulated attack scenarios. The attack data function facilitates the loading of specific attack types from the KDDCup'99 dataset, such as DoS and probing attacks, to validate the detection and visualization mechanisms.  
The prototype's layout, with dedicated controls for network discovery, data loading, and mitigation strategy implementation (\"Resolve\"), provides real-time observations of threats, thus verifying the prototype's effectiveness and practical contribution within the field of cybersecurity visualization. The introduction of a real-time visualization layer achieves our MO-3 by presenting a novel mechanism for network security monitoring that enables informed decision-making. This feature directly addresses the gap in effective threat visualization noted in existing NIDS solutions and marks a significant step in layering effective threats identification and mitigation. The utilization of color-coded connection statuses simplifies the complexity associated with network monitoring amid massive network events. The prototype's design also achieves our MO-4 through changing network link colors from red to blue, indicating the mitigation of threats in real time. This feature directly reflects our objective to not only detect but also visually signify the neutralization of network threats for enhanced clarity and immediacy of security responses.