Modularizing cyber defense situational awareness - Technical integration before human understanding

Abstract

Human cyber situational awareness can only be achieved through appropriate visualization. Observation, understanding and projecting the status of cyber resources need to be supported by novel display and interaction techniques. These displays can only be realized if the cyber security-related data is sufficiently structured. We propose a two-stage creation of human cyber situational awareness: the first stage consists of technically integrating all security-related knowledge about the defended systems into a comprehensive model. In the second stage, this semantically enriched data can be visualized in a way that intuitively supports the operators' understanding of the current security situation as well as analysis techniques that go beyond the current state of the art. © 2012 Springer-Verlag.