Seeing the cyber battlefield: Why 3D visuals are critical to cybersecurity
Vids: A new dynamic and interactive tool for 3D visualization in cybersecurity
Vids is a 3D visualization tool that’s rapidly approaching a production release. It takes raw text data and projects it into a 3D space. Within this space, users can move, compare, manipulate, and interact with the data. Running on top of the Unity game engine, Vids seamlessly allows user interaction while visualizing a large amount of data.
Intended as a tool to support both security analysts and researchers, Vids is highly flexible; users can configure it to process multiple data types. Once parsed, the data are processed into an appropriate node-edge graph and displayed, as defined by the user. Within the visualization, users can pivot through multiple graph layouts and find information hidden in the data. This provides a visual aid for known tactics, and also offers a hands-on visual analysis for hunting adversaries amongst ever-elusive unknowns.
Vids is under active development by ICF and our partners. A version 1.0 release to the cyber defense community is expected soon, alongside supporting technical papers.
Building upon emerging technologiesIn the near future, emerging technologies like virtual reality (VR), augmented reality (AR), and mixed reality (MR) will become the norm. These technologies create a fundamental shift in the way data are currently visualized. In the context of intelligence preparation, VR and AR can allow decision-makers to process larger volumes of information far faster than traditional methods.
Rather than looking at a paper map, commanders can place themselves in a virtual representation of the battlefield. Or, they can navigate a virtualized representation of communication networks instead of reviewing an analog diagram. Commanders and their supporting staff elements—who may be located anywhere in the world—can collaborate in the same VR space or experience the same AR representation collaboratively. In this way, cybersecurity analysts and their respective peers can work together in tailored VR environments whereby their interfaces and data visualizations are not reduced and locked into small rectangles (i.e., monitors) on their desk.
To explore these virtual environments, new tools are needed to translate network data into 3D visualizations, enable interactivity, and integrate into an analyst’s workflow.
For example, the Vids software (referenced above) leverages off-the-shelf modern game development technology using the Unity development platform—enabling faster development than a ground-up solution. The platform also allows for compatibility through targeted builds for different operating systems, including Windows and Linux. Vids is a tool that works on a computer supported by a traditional 2D monitor, but is intended for future VR/AR technologies. Analysts today are testing the tool and plan to integrate it into their workflows. And when future technologies are common and readily available, analysts will have an established precedent and a degree of familiarity.
These tools and concepts sound futuristic now, but they continue to progress rapidly towards field-ready applications. Once in the hands of cybersecurity experts, the U.S. military will be able to plan and execute cyber missions faster than ever before.
What the U.S. Army CCDC C5ISR wants to learnFor now, our work with the U.S. Army approaches 3D visualization with one goal: to provide a modern, highly flexible, and functional research and development platform relevant to network security and awareness. Its primary intent focuses on research purposes.
The programs allow testing of multiple visualizations simultaneously with prospective users. Results from user evaluations are then used as feedback for new development or refinement of network security visualizations.
Once this research and evaluation phase is complete, the program may move into active use through collaboration with CCDC C5ISR Center. It can operate as a visualization analysis tool for cybersecurity analysts across workstations and large screens, or as a training tool to interact with and understand data.
The future of cybersecurity analysis
Future development includes the following new and expanded features—all aimed at reaching the goal of wider flexibility and functionality:
- Expanded abilities for the user to interact with data sources and perform transparent configuration. Data sources will be reread, and the graph will be dynamically reconfigured to accommodate changes since the last reading and rendering.
- Novel layouts based on new algorithms or user feedback as to the most helpful data views.
- New styles for nodes and edges to allow maximum options for data visualization.
- Expanded interaction options, including node and edge-to-graph translation. This feature would allow data contained within an individual node or edge to be shown and interacted with graphically rather than through text. For example, a timeline graph could show activity over time for two connecting partners.
- Work toward future integration with the CCDC C5ISR Center Virtual Reality Data Analysis Environment (VRDAE). This collaborative environment has already integrated a 3D visualization model (Virtual Data Explorer) by Mr. Kaur Kullman from the CCDC ARL Open Campus program. So, Vids is primed for future integration thanks to this existing collaboration.
Faced with ever-increasing data volumes, new solutions are needed to ensure situational understanding. Visualizations are one way to enable cybersecurity professionals to process and—most importantly—understand a larger volume of data.
By using a modern game development platform, projects like the collaboration between ICF, U.S. Army CCDC ARL, and CCDC C5ISR Center allow streamlined development, strong compatibility across systems, and enhanced 3D, VR, and AR display options. It is a first step to bridge the gap between network and security visualizations as they currently exist and the future—where visualizations act as a ubiquitous and crucial aid to operations in cyberspace.