Visual Analytics for Non-Expert Users in Cyber Situation Awareness

Abstract

Situation awareness is often described as the perception and comprehension of the current situation, and the projection of future status. Whilst this may be well understood in an organisational cybersecurity context, there is a strong case to be made for effective cybersecurity situation awareness that is tailored to the needs of the Non-Expert User (NEU). Our online usage habits are rapidly evolving with smartphones and tablets being widely used to access resources online. In order for NEUs to remain safe online, there is a need to enhance awareness and understanding of cybersecurity concerns, such as how devices may be acting online, and what data is being shared between devices. In this paper, we extend our proposal of the Enhanced Personal Situation Awareness (ePSA) framework to consider the key details of cyber situation awareness that would be of concern to NEUs, and we consider how such information can be effectively conveyed using a visual analytic approach. We present the design of our visual analytics approach to show how this can represent the key details of cyber situation awareness whilst maintaining a simple and clean design scheme so as to not result in information-overload for the user. The guidance developed through the course of this work can help practitioners develop tools that could help NEUs better understand their online actions, with the aim of giving users greater control and safer experiences when their personal devices are acting online.

What Makes for Effective Visualisation in Cyber Situational Awareness for Non-Expert Users?

“…He believes that an artist has at his or her disposal various devices for engaging our attention, drawing us in to the world of the painting and colouring our view of that world [19]. In 2016, Legg proposed a system for capturing and visualising network activity, with a view of this informing non-expert users [13], [14]. Whilst informative and interactive, these 2D plots of a network environment do not fully satisfy the need to be engaging, appealing, and designed such that users will want to continually monitor activity.…”

“…Traditional tools for capturing and analysing network activity, such as Wireshark are clearly not designed for general users. Previously, we have developed tools for exploring and investigating network packet captures using interactive visualisation tools [13] [14]. However, for selfmonitoring tools to be effective, there is a need for an engaging experience that encourages continually revisiting by the user.…”

A Taxonomy of Malicious Traffic for Intrusion Detection Systems

“…The Human factor also plays a decisive role in network security, without appropriate training and awareness [24]. Humans can also be seen as the weak link, hence, when designing intrusion detection systems it is also important to identify attacks against the end-users and expert-users [25]. As shown in Figure 1 (3.5.1) phishing and spear phishing attacks.…”

Losing Our Senses Online: Investigating How Aesthetics Might Be Used to Ground People in Cyberspace

“…They saw it as a space that can be difficult to monitor and navigate; they spent five years exploring rich and varied visual representations of cyberspace's diversity, structure and content to further improve people's understanding of and navigation within it. More recently, Legg [23] discusses the importance of situational awareness in cyberspace (i.e. the perception and comprehension of the current situation, and the projection of future status) stating that the big challenge lies in facilitating the user's understanding through effective visualization.…”