![](bg8.png)
7 CONCLUSION
In this paper, we have tackled using visualizations
in an analytical workflow of cybersecurity simulator
data. To our knowledge, this paper is the first at-
tempt to conceptualize the work in this domain. We
described the state-of-the-art network simulators and
commonly used visualizations in the context of cy-
bersecurity simulation research of autonomous agents
(RQ1). ext, we mapped the analysts’ tasks and for-
malized the analyst workflow (RQ2) based on the
CYST simulator as a model environment. Finally, we
presented two prototype tools – Clustering Analyzer
and Scenario Player – and five use cases to demon-
strate their suitability to deal with several real-world
analytical goals (RQ3). We also discussed limitations
and provided lessons learned.
Further, we plan to merge the tools into a sin-
gle data analytics toolkit integrated seamlessly into a
CYST simulator workflow. It will also include inte-
grating novel visualizations and advancing the mid-
dle tier according to the defined three-tier analytical
workflow.
ACKLNOWLEDGEMENTS
The research was supported by ERDF “Cyber-
Security, CyberCrime and Critical Informa-
tion Infrastructures Center of Excellence” (No.
CZ.02.1.01/0.0/0.0/16 019/0000822).
REFERENCES
Blaha, M. R. and Rumbaugh, J. E. (2005). Object-oriented
Modeling and Design with UML, 2nd Ed. Pearson Ed.
Bostock, M., Ogievetsky, V., and Heer, J. (2011). D
3
Data-
Driven Documents. IEEE TVCG, 17(12):2301–2309.
Brehmer, M. and Munzner, T. (2013). A Multi-Level Ty-
pology of Abstract Visualization Tasks. IEEE TVCG,
19(12):2376–2385.
Brockman, G., Cheung, V., Pettersson, L., et al. (2016).
OpenAI Gym. arXiv:1606.01540.
Cutura, R., Kralj, C., and Sedlmair, M. (2020). DRUIDJS
– A JavaScript Library for Dimensionality Reduction.
In IEEE VIS 2020, pages 111–115. IEEE.
Dama
ˇ
sevi
ˇ
cius, R., Toldinas, J., et al. (2019). Visual An-
alytics for Cyber Security Domain: State-of-the-Art
and Challenges. In Information and Software Tech-
nologies, volume 1078, pages 256–270. Springer Int.
Publ., Cham.
Dra
ˇ
sar, M., Moskal, S., et al. (2020). Session-level Adver-
sary Intent-Driven Cyberattack Simulator. In Proc. of
the IEEE/ACM 24th Int. Symp. on Distrib. Simulation
and Real Time Applications (DS-RT’20), pages 7–15.
IEEE.
Dunteman, G. H. (2008). Principal Components Analysis.
Number 69 in Quantitative Applications in the Social
Sciences. Sage Publishing, Newbury Park, CA, USA.
Grunewald, D., L
¨
utzenberger, M., Chinnow, J., et al.
(2011). Agent-Based Network Security Simulation.
In The 10th Int. Conf. on Autonomous Agents and
Multiagent Systems – Vol. 3, AAMAS ’11, page
1325–1326, Richland, SC. International Foundation
for Autonomous Agents and Multiagent Systems.
Homer, J., Varikuti, A., et al. (2008). Improving Attack
Graph Visualization through Data Reduction and At-
tack Grouping. In Goodall, J. R., Conti, G., and Ma,
K.-L., editors, Visualization for Computer Security,
volume 5210 of LNCS, pages 68–79. Springer Berlin
Heidelberg.
Kru
ˇ
z
´
ık, M. (2018). Adaptive Network Attacks. Master’s
thesis, Masaryk University, Brno, Czechia.
Liljenstam, M., Liu, J., et al. (2005). RINSE: The Real-
Time Immersive Network Simulation Environment for
Network Security Exercises. In Workshop on Prin-
ciples of Adv. and Distrib. Simul. (PADS’05), pages
119–128. IEEE.
McInnes, L., Healy, J., and Melville, J. (2018). UMAP:
Uniform Manifold Approximation and Projection for
Dimension Reduction. arXiv:1802.03426.
Michal
´
ıkov
´
a, M. (2018). Implementation of Methods for
Attack Detection in Software Simulator. Bachelor’s
thesis, Masaryk University, Brno, Czechia.
Microsoft Defender Research Team (2021). CyberBat-
tleSim. github.com/microsoft/CyberBattleSim.
Minarik, P. and Dymacek, T. (2008). NetFlow Data Visual-
ization Based on Graphs. In Vis. for Comp. Sec., vol-
ume 5210 of LNCS, pages 144–151. Springer Berlin
Heidelberg.
Moskal, S. and Yang, S. J. (2020). Cyberattack Action-
Intent-Framework for Mapping Intrusion Observ-
ables. arXiv:2002.07838.
Murtagh, F. (2011). Hierarchical Clustering. In Interna-
tional Encyclopedia of Statistical Science, pages 633–
635. Springer Berlin Heidelberg, Berlin, Heidelberg.
Theron, P., Kott, A., et al. (2020). Reference Architecture
of an Autonomous Agent for Cyber Defense of Com-
plex Military Systems, pages 1–21. Springer Int. Publ.,
Cham.
van der Maaten, L. and Hinton, G. (2008). Visualizing Data
using t-SNE. Journal of Machine Learning Research,
9(11):2579–2605.
Varga, A. (2010). OMNeT++. In Modeling and Tools
for Network Simulation, pages 35–59. Springer Berlin
Heidelberg.
Yi, S., Peng, Y., et al. (2013). Overview on Attack Graph
Generation and Visualization Technology. In 2013 Int.
Conf. on Anti-Counterfeiting, Security and Identifica-
tion (ASID), pages 1–6. IEEE.
IVAPP 2023 - 14th International Conference on Information Visualization Theory and Applications
186