Mental Model Mapping Method for Cybersecurity

Abstract

Visualizations can enhance the efficiency of Cyber Defense Analysts, Cyber Defense Incident Responders and Network Operations Specialists (Subject Matter Experts, SME) by providing contextual information for various cybersecurity-related datasets and data sources. We propose that customized, stereoscopic 3D visualizations, aligned with SMEs internalized representations of their data, may enhance their capability to understand the state of their systems in ways that flat displays with either text, 2D or 3D visualizations cannot afford. For these visualizations to be useful and efficient, we need to align these to SMEs internalized understanding of their data. In this paper we propose a method for interviewing SMEs to extract their implicit and explicit understanding of the data that they work with, to create useful, interactive, stereoscopically perceivable visualizations that would assist them with their tasks.

Interactive Stereoscopically Perceivable Multidimensional Data Visualizations for Cybersecurity

“…Appropriate methods (e.g., [8], [24]) should be used when creating ISPMDVs to ensure the utility of the resulting visualization for the CSMEs who would be using them.…”

“…As with all other types of interactive data visualizations (IDV), interactive SPMDV (ISPMDV) should be created with or by subject matter experts (SMEs) in order to ensure that these creations will indeed serve their intended audience well [8]. To enable cybersecurity SMEs (CSMEs) to create useful stereoscopically perceivable IDVs (SPIDVs), these CSMEs need (at least):…”

“…CSMEs rely on large datasets, so it stands to reason that the full use of a third dimension afforded by xR will be useful in making more data visually discernable without relying on cluttering cues like shading, occlusion, and perspective (as is needed for MDV on flat screens). Model Mapping Method for Cybersecurity (M4C) [8] is one method that can be used to design SPMDV while enabling the CSMEs to serve as both the designers and consumers of their own visualizations. In M4C, visualizations of networked entities (e.g., computers) are positioned according to their logical (but not necessarily their physical) topology, with the resulting 3D structure(s) matching a CSME's understanding of a network's expected topology.…”

A 3D Mixed Reality Visualization of Network Topology and Activity Results in Better Dyadic Cyber Team Communication and Cyber Situational Awareness

“…Typical representations of network topology are in two dimensions (2D), which loses temporal and spatial relationships between nodes in the network, in addition to not scaling well with increased (but often necessary) complexity. Virtual Reality (VR) and Mixed Reality (MR) tools that are able to visualize CSA-relevant information such as network topology in space and time may aid in the development of shared mental models for efficient RCP communication between technical and non-technical personnel (Kullman et al, 2018(Kullman et al, , 2019a(Kullman et al, , 2019b(Kullman et al, , 2020.…”

“…The Virtual Data Explorer (Kullman et al, 2018(Kullman et al, , 2019a was developed to visualize network topology in a manner that is idiosyncratic to the mental models analysts use to conceptualize the network (Figure 2). Based on interviews with expert analysts, the VDE is able to visualize the relationship between nodes in an actual network in space and time (Kullman et al, 2018(Kullman et al, , 2019a(Kullman et al, , 2019b(Kullman et al, , 2020. The visualizations produced by the VDE are interactive and can be shared between individuals thus allowing for development of shared mental models between individuals.…”