Supporting the cyber analytic process using visual history on large displays

Abstract

Cyber analytics focuses on increasing the safety and soundness of our digital infrastructure. The volume, size and velocity of these datasets make the analysis challenging on current work environments and tools. A cyber analytics work environment should enable multiple, simultaneous investigations and information foraging, as well as provide a solution space for organizing data. As such, various workflow visualization tools are used to help users track their analysis, reuse effective workflows, and test hypotheses. Also, the use of large display workspaces can provide new opportunities for improving visual analytics in cyber security. In this work, we present a prototype workspace for analysts where the analytic process is maintained in the workspace. Thus, we are able to present analysts with visual states of their data throughout the investigation, in which real-time changes can be made to any previous state, and analysts can backtrack through their investigation.

Performance and interaction behaviour during visual search on large, high-resolution displays

“…One increased the quantity of abstract data in proportion to the display size to investigate the scalability of visual encoding, which meant that task performance times cannot be directly compared 18 . A second gathered subjective feedback that highlighted the potential benefit of LHRDs for helping users refer back to previous steps during extended sessions of visual cybersecurity data analysis 5 .…”

Visualization System Requirements for Data Processing Pipeline Design and Optimization

“…Whole-workflow systems capture the provenance of data analysis, and provide visual support for multiple lines of inquiry that is particularly beneficial when analysis takes place over an extended period of time or involves multiple endusers [15], [16]. Visualization brings benefits that include significantly improving the process of prototyping engineering designs [17] and comparing flood-control strategies [18].…”

PTVis: Visual Narrative and Auxiliary Decision to Assist in Comprehending the Penetration Testing Process

“…In terms of penetration testing event analysis, Gregory et al [6] researched the visual fingerprint information left by various popular penetration testing tools to help analysts better understand the specific methods used by attackers and the identifiable characteristics of the tools. Ankit et al [7] designed a prototype workspace to help visualize the workflow of analysts when analysing network penetration events and to improve the efficiency of analysts in analysing network penetration events. ROPMate [8] provides a semantic-based visual analysis solution, that helps cyber red teams filter and link to form complete vulnerabilities by filtering penetration testing tools.…”

“…In contrast, a visual-based penetration testing summary can provide a more effective method. Previous work in the field of visual analysis of penetration testing has mostly focused on the analysis of network penetration events (e.g., [6], [7]). With the improvement in network penetration methods, to promote research on new attack technologies and to have a deeper comprehension of network penetration activities, an increasing amount of work is focusing on the visual analysis of penetration testing processes and methods (e.g., [8], [9]).…”