{"title":"Analysis of the Design Space for Cybersecurity Visualizations in VizSec","authors":"A. Komadina, Ž. Mihajlović, S. Groš","doi":"10.1109/VizSec56996.2022.9941422","DOIUrl":"https://doi.org/10.1109/VizSec56996.2022.9941422","url":null,"abstract":"In this paper, we present research on the analysis of the design space for cybersecurity visualizations in VizSec. At the beginning of this research, we analyzed 17 survey papers in the field of cybersecurity visualization. Based on the analysis of the focus areas in each of these survey papers, we identified five key components of visualization design, i.e. Input Data, Security Tasks, Visual Encoding, Interactivity, and Evaluation. To show how research papers align with these components, we analyzed 60 papers published at the IEEE Symposium on Visualization for Cyber Security (VizSec) between 2016 and 2021 in the context of the five identified components. As a result, each research paper was classified into several categories derived from the selected components of the visualization design. Our contributions are: (i) an analysis of the focus areas in survey papers on cybersecurity visualization and (ii) the classification of 60 research papers in the context of the selected components of the visualization design. Finally, we highlighted the main findings of the analysis and drew conclusions.","PeriodicalId":425753,"journal":{"name":"2022 IEEE Symposium on Visualization for Cyber Security (VizSec)","volume":"83 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133727742","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Kuhu Gupta, Aditeya Pandey, Larry Chan, Ambika Yadav, B. Staats, M. Borkin
{"title":"Portola: A Hybrid Tree and Network Visualization Technique for Network Segmentation","authors":"Kuhu Gupta, Aditeya Pandey, Larry Chan, Ambika Yadav, B. Staats, M. Borkin","doi":"10.1109/VizSec56996.2022.9941388","DOIUrl":"https://doi.org/10.1109/VizSec56996.2022.9941388","url":null,"abstract":"Network security is critical for organizations to secure their network resources from intrusion and attacks. A security policy is a rule enforced in the network to allow or block network traffic. To write security policies, network analysts divide their networks into segments or parts with similar security needs. Segmentation makes writing security policies manageable and identifies robust security policies for the network. Visualizations can help analysts to understand the segmented network and define security policies. We contribute Portola, a hybrid tree and network visualization technique to display a segmented computer network. Portola presents an overview of the segmentation as a hierarchy and displays connections within the network. Using Portola, analysts can explore a segmented network, identify nodes and connections of interest through exploratory network analysis, and drill down on elements of interest to reason about the patterns of relationships in the network. Through this work, we also discuss the goals of network analysts who work with segmented networks and discuss the lessons learned from the user-centered iterative design of Portola.","PeriodicalId":425753,"journal":{"name":"2022 IEEE Symposium on Visualization for Cyber Security (VizSec)","volume":"144 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131651666","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Keynote - Beyond Vis(Sec): Emerging Trends in Data Science for Cybersecurity","authors":"","doi":"10.1109/vizsec56996.2022.9941381","DOIUrl":"https://doi.org/10.1109/vizsec56996.2022.9941381","url":null,"abstract":"","PeriodicalId":425753,"journal":{"name":"2022 IEEE Symposium on Visualization for Cyber Security (VizSec)","volume":"31 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-10-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117254888","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Marija Schufrin, Hendrik Lücke-Tieke, J. Kohlhammer
{"title":"Visual Firewall Log Analysis - At the Border Between Analytical and Appealing","authors":"Marija Schufrin, Hendrik Lücke-Tieke, J. Kohlhammer","doi":"10.1109/VizSec56996.2022.9941462","DOIUrl":"https://doi.org/10.1109/VizSec56996.2022.9941462","url":null,"abstract":"In this paper, we present our design study on developing an interactive visual firewall log analysis system in collaboration with an IT service provider. We describe the human-centered design process, in which we additionally considered hedonic qualities by including the usage of personas, psychological need cards and interaction vocabulary. For the problem characterization we especially focus on the demands of the two main clusters of requirements: high-level overview and low-level analysis, represented by the two defined personas, namely information security officer and network analyst. This resulted in the prototype of a visual analysis system consisting of two interlinked parts. One part addresses the needs for rather strategical tasks while also fulfilling the need for an appealing appearance and interaction. The other part rather addresses the requirements for operational tasks and aims to provide a high level of flexibility. We describe our design journey, the derived domain tasks and task abstractions as well as our visual design decisions, and present our final prototypes based on a usage scenario. We also report on our capstone event, where we conducted an observed experiment and collected feedback from the information security officer. Finally, as a reflection, we propose the extension of a widely used design study process with a track for an additional focus on hedonic qualities.","PeriodicalId":425753,"journal":{"name":"2022 IEEE Symposium on Visualization for Cyber Security (VizSec)","volume":"14 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-09-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115543777","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Igor Cherepanov, Alex Ulmer, Jonathan Geraldi Joewono, J. Kohlhammer
{"title":"Visualization Of Class Activation Maps To Explain AI Classification Of Network Packet Captures","authors":"Igor Cherepanov, Alex Ulmer, Jonathan Geraldi Joewono, J. Kohlhammer","doi":"10.1109/VizSec56996.2022.9941392","DOIUrl":"https://doi.org/10.1109/VizSec56996.2022.9941392","url":null,"abstract":"The classification of internet traffic has become increasingly important due to the rapid growth of today’s networks and application variety. The number of connections and the addition of new applications in our networks causes a vast amount of log data and complicates the search for common patterns by experts. Finding such patterns among specific classes of applications is necessary to fulfill various requirements in network analytics. Supervised deep learning methods learn features from raw data and achieve high accuracy in classification. However, these methods are very complex and are used as black-box models, which weakens the experts’ trust in these classifications. Moreover, by using them as a black-box, new knowledge cannot be obtained from the model predictions despite their excellent performance. Therefore, the explainability of the classifications is crucial. Besides increasing trust, the explanation can be used for model evaluation to gain new insights from the data and to improve the model. In this paper, we present a visual and interactive tool that combines the classification of network data with an explanation technique to form an interface between experts, algorithms, and data.","PeriodicalId":425753,"journal":{"name":"2022 IEEE Symposium on Visualization for Cyber Security (VizSec)","volume":"335 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-09-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133759444","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}