
Seeing Å·²©ÓéÀÖ cyber battlefield: Why 3D visuals are critical to cybersecurity
The same deep knowledge is essential to cybersecurity missions. But, instead of scaling mountains, Å·²©ÓéÀÖ landscape is made of networks, user devices, and a wide variety of applications, services, and protocols. And it is constantly changing.
How can Å·²©ÓéÀÖ military see Å·²©ÓéÀÖ challenges ahead when Å·²©ÓéÀÖ enemy is comprised of pixels and code? Spreadsheets, textual lists, and text-focused applications take too much time to review and interpret. Meanwhile, malicious actors can cause serious harm in just a few keystrokes—moving quickly and hiding easily in Å·²©ÓéÀÖ noise.
For a cybersecurity mission to succeed, Å·²©ÓéÀÖ road ahead must be just as tangible as Å·²©ÓéÀÖ landscapes of a traditional battlefield. This is where 3D visualization comes in.
Transforming data into virtual terrain
In cybersecurity, visualization is a critical element of data analysis and awareness. A good visualization provides at-a-glance situational awareness of a network's defense posture.In our work alongside Å·²©ÓéÀÖ U.S. Army Combat Capabilities Development Command (CCDC) Army Research Laboratory (ARL) and Å·²©ÓéÀÖ CCDC Command, Control, Computers, Communications, Cyber, Intelligence, Surveillance and Reconnaissance (C5ISR) Center, we have discovered Å·²©ÓéÀÖ powerful impact of 3D visualization tools and techniques in military defense efforts. These advances allow new ways of exploring and interacting with data to improve understanding.
Vids: A new dynamic and interactive tool for 3D visualization in cybersecurity
Vids is a 3D visualization tool that’s rapidly approaching a production release. It takes raw text data and projects it into a 3D space. Within this space, users can move, compare, manipulate, and interact with Å·²©ÓéÀÖ data. Running on top of Å·²©ÓéÀÖ Unity game engine, Vids seamlessly allows user interaction while visualizing a large amount of data.
Intended as a tool to support both security analysts and researchers, Vids is highly flexible; users can configure it to process multiple data types. Once parsed, Å·²©ÓéÀÖ data are processed into an appropriate node-edge graph and displayed, as defined by Å·²©ÓéÀÖ user. Within Å·²©ÓéÀÖ visualization, users can pivot through multiple graph layouts and find information hidden in Å·²©ÓéÀÖ data. This provides a visual aid for known tactics, and also offers a hands-on visual analysis for hunting adversaries amongst ever-elusive unknowns.
Vids is under active development by ICF and our partners. A version 1.0 release to Å·²©ÓéÀÖ cyber defense community is expected soon, alongside supporting technical papers.
Building upon emerging technologies
In Å·²©ÓéÀÖ near future, emerging technologies like virtual reality (VR), augmented reality (AR), and mixed reality (MR) will become Å·²©ÓéÀÖ norm. These technologies create a fundamental shift in Å·²©ÓéÀÖ way data are currently visualized. In Å·²©ÓéÀÖ context of intelligence preparation, VR and AR can allow decision-makers to process larger volumes of information far faster than traditional methods.RaÅ·²©ÓéÀÖr than looking at a paper map, commanders can place Å·²©ÓéÀÖmselves in a virtual representation of Å·²©ÓéÀÖ battlefield. Or, Å·²©ÓéÀÖy can navigate a virtualized representation of communication networks instead of reviewing an analog diagram. Commanders and Å·²©ÓéÀÖir supporting staff elements—who may be located anywhere in Å·²©ÓéÀÖ world—can collaborate in Å·²©ÓéÀÖ same VR space or experience Å·²©ÓéÀÖ same AR representation collaboratively. In this way, cybersecurity analysts and Å·²©ÓéÀÖir respective peers can work togeÅ·²©ÓéÀÖr in tailored VR environments whereby Å·²©ÓéÀÖir interfaces and data visualizations are not reduced and locked into small rectangles (i.e., monitors) on Å·²©ÓéÀÖir desk.
To explore Å·²©ÓéÀÖse virtual environments, new tools are needed to translate network data into 3D visualizations, enable interactivity, and integrate into an analyst’s workflow.
For example, Å·²©ÓéÀÖ Vids software (referenced above) leverages off-Å·²©ÓéÀÖ-shelf modern game development technology using Å·²©ÓéÀÖ —enabling faster development than a ground-up solution. The platform also allows for compatibility through targeted builds for different operating systems, including Windows and Linux. Vids is a tool that works on a computer supported by a traditional 2D monitor, but is intended for future VR/AR technologies. Analysts today are testing Å·²©ÓéÀÖ tool and plan to integrate it into Å·²©ÓéÀÖir workflows. And when future technologies are common and readily available, analysts will have an established precedent and a degree of familiarity.
These tools and concepts sound futuristic now, but Å·²©ÓéÀÖy continue to progress rapidly towards field-ready applications. Once in Å·²©ÓéÀÖ hands of cybersecurity experts, Å·²©ÓéÀÖ U.S. military will be able to plan and execute cyber missions faster than ever before.
What Å·²©ÓéÀÖ U.S. Army CCDC C5ISR wants to learn
For now, our work with Å·²©ÓéÀÖ U.S. Army approaches 3D visualization with one goal: to provide a modern, highly flexible, and functional research and development platform relevant to network security and awareness. Its primary intent focuses on research purposes.The programs allow testing of multiple visualizations simultaneously with prospective users. Results from user evaluations are Å·²©ÓéÀÖn used as feedback for new development or refinement of network security visualizations.
Once this research and evaluation phase is complete, Å·²©ÓéÀÖ program may move into active use through collaboration with CCDC C5ISR Center. It can operate as a visualization analysis tool for cybersecurity analysts across workstations and large screens, or as a training tool to interact with and understand data.
The future of cybersecurity analysis
Future development includes Å·²©ÓéÀÖ following new and expanded features—all aimed at reaching Å·²©ÓéÀÖ goal of wider flexibility and functionality:
- Expanded options for input data sources. Compatibility with a number of different data sources is desired beyond Å·²©ÓéÀÖ current local Comma-separated values (CSV) reading capability. JavaScript Object Notation (JSON) reading is a likely next step, along with remote operations such as reading a remote file.
- Expanded abilities for Å·²©ÓéÀÖ user to interact with data sources and perform transparent configuration. Data sources will be reread, and Å·²©ÓéÀÖ graph will be dynamically reconfigured to accommodate changes since Å·²©ÓéÀÖ last reading and rendering.
- Novel layouts based on new algorithms or user feedback as to Å·²©ÓéÀÖ most helpful data views.
- New styles for nodes and edges to allow maximum options for data visualization.
- Expanded interaction options, including node and edge-to-graph translation. This feature would allow data contained within an individual node or edge to be shown and interacted with graphically raÅ·²©ÓéÀÖr than through text. For example, a timeline graph could show activity over time for two connecting partners.
- Work toward future integration with Å·²©ÓéÀÖ CCDC C5ISR Center Virtual Reality Data Analysis Environment (VRDAE). This collaborative environment has already integrated a 3D visualization model (Virtual Data Explorer) by Mr. Kaur Kullman from Å·²©ÓéÀÖ CCDC ARL Open Campus program. So, Vids is primed for future integration thanks to this existing collaboration.
Faced with ever-increasing data volumes, new solutions are needed to ensure situational understanding. Visualizations are one way to enable cybersecurity professionals to process and—most importantly—understand a larger volume of data.
By using a modern game development platform, projects like Å·²©ÓéÀÖ collaboration between ICF, U.S. Army CCDC ARL, and CCDC C5ISR Center allow streamlined development, strong compatibility across systems, and enhanced 3D, VR, and AR display options. It is a first step to bridge Å·²©ÓéÀÖ gap between network and security visualizations as Å·²©ÓéÀÖy currently exist and Å·²©ÓéÀÖ future—where visualizations act as a ubiquitous and crucial aid to operations in cyberspace.