The goal of cyber security visualization is to help analysts increase the safety and soundness of our digital infrastructures by providing effective tools and workspaces. Visualization researchers must make visual tools more usable and compelling than the text-based tools that currently dominate cyber analysts' tool chests. A cyber analytics work environment should enable multiple, simultaneous investigations and information foraging, as well as provide a solution space for organizing data. We describe our study of cyber-security professionals and visualizations in a large, high-resolution display work environment and the analytic tasks this environment can support. We articulate a set of design principles for usable cyber analytic workspaces that our studies have brought to light. Finally, we present prototypes designed to meet our guidelines and a usability evaluation of the environment. Cyber analytics; cyber security; visualization; usability; large, high-resolution displays; cognitive task analysis.  Cyber analysts who defend our computer infrastructures use primitive, command-line tools that are ineffective at the high volume and velocity of the data they must process. They have resisted using visualizations, partly because no visualization has yet met their complex needs. We believe this is because their tasks, work environments, and requirements have not yet been studied sufficiently. We need more user-centered design in the solutions we offer. Large displays have been valuable in other applications with massive data [1], and we suspect that they can be helpful in this application, too. Cyber analytics is a new science of analysis for understanding the behavior of computers and computer networks from the data they generate-discerning the story hidden inside massive cyber data. Many job descriptions include cyber analytic tasks, such as system administration, cyber security, and design and maintenance of computer infrastructures. In this paper, we concentrate on cyber analysis for securing enterprises and large infrastructures of related organizations. We found the behaviors of the cyber analysts we studied were distinct from behaviors of analysts in other domains such as intelligence analysis. For cyber security professionals, a usable workspace should support multiple, simultaneous, open-ended investigations. Separate tasks that arise from distinct tip-off points may eventually connect, implying the need for an overview of all active tasks and their relationships. Analysts desire to find connections that point to the sources of threats to the system they are defending. Using the analogy of information foraging [2], cyber analysts are tracking big game. Individual clues are only valuable if they support other clues that point to the same root cause. To acquire multiple, complementary information items, cyber analysts rapidly switch between analytic inquiries, multi-tasking and refining or broadening queries as they investigate potential leads. Analysts need tools that interoperate. Their tools (and queries) are highly specialized, and they spend much of their time joining data tables and translating information between tools. Often the story they seek is hidden within complex correlations that no single view adequately reveals. This paper contains the results of our study of cyber security analysts, our proposed solutions to selected problems, and users' reactions to our solutions. We identify lessons learned and present a set of design principles for usable cyber analytics workspaces. Our goals were to identify sensemaking processes in cyber analytic work and critical usability issues in cyber analytics workspaces, and to elicit cyber analysts' ideas about how large, highresolution displays can help them work more effectively. We observed cyber analysts using large displays with a sample problem. Then we created mockups that identify effective uses of large displays in cyber analytics. We sought feedback on our prototypes from the users who participated in our study. Many visualizations for cyber security data are special-purpose representations of a particular kind of data. Few tools support interoperability with other applications and utilities. Most tools are neither fast enough nor flexible enough for cyber analysts. There are visualizations [3] [4][5] for packet-headers, network flows, system log files, IDS alerts, etc. Optimizing a tool for one type of data separates the tool from the context of an overall investigation. Unless a visualization tool fits into the broad context of the overall investigation it will limit its utility to the analyst. For instance, a cyber analyst might find some interesting alerts via a Snort IDS alert visualization and then wish to investigate the network flows, packets, host log entries, application logs, etc., that are related to these alerts. Most visualizations do not support this kind of rapid, open-ended foraging activity. Snap-together visualization [6] provides a flexible visualization system of coordinated views that links legacy tools at the database (relation-query) level. Thus a user-defined series of visualizations can be driven from direct interaction with any visualization in the series. Snap would provide the power and flexibility of database and command-line tools, but it has not been applied to cyber analytics. We believe that a coordinated visualization system that interprets interactions and coordinates views relationally is an essential building block of a usable cyber analytic workspace. Displays of the size we used in our study are not in broad use, so it is not surprising that many visualizations are not optimized for this environment. Mitigations like tabbed windows that help conserve space in small displays are counterproductive in a large display. To make use of these displays, we must develop new window and display management techniques.
Similarly, Fink provided an account of the challenges faced in cyber-security settings REF .
Visualizing cyber security: Usable workspaces
2009 6th International Workshop on Visualization for Cyber Security
2009 6th International Workshop on Visualization for Cyber Security
Computer Science