藉由沈浸式資料視覺化與資料探索來分析網路威脅情資

Abstract

現今的網路攻擊多變且複雜，與信任夥伴分享網路威脅情資有助於共同防禦這些攻擊。然而，目前用於分享網路威脅情資的標準格式其實非常難以探索，除非藉由視覺化工具的幫助，但傳統視覺化方法的幫助仍有限。隨著頭戴式顯示器的發展逐漸成熟，沉浸式資料視覺化有潛力提供比傳統的二維與三維視覺化方法更好的體驗。本篇論文提出了一個可以在沉浸式環境中分析網路威脅情資的互動式系統，此系統可以在虛擬實境中視覺化上萬個節點與邊，同時保持九十幅以上的高影格率。並且我們與網路安全專家合作，設計和實作了許多探索網路威脅情資的互動技巧。最後，本篇論文以兩個實驗來評估這套系統。實驗結果顯示，比起傳統的視覺化工具，受測者用此系統能夠更快地找到必要的資訊，並在系統易用性量表和工作負擔量表上的表現都更好。若是在探索已經被資安專家整理過的網路威脅情資的情況，則使用此系統和其電腦桌面對應版本的表現非常接近，但沉浸式資料視覺化造成的心理負擔較低。

Sharing cyber threat information between organizations is important to amplify the defense against sophisticated cyber attacks. However, the standard format for describing and exchanging cyber threat information is difficult to explore without the help of visualization techniques. As the head-mounted display (HMD) technology becomes more mature, immersive visualization approaches have the potential to provide better experiences. In this work, we present an interactive system for exploring cybersecurity information in the immersive environment, which utilizes the C# job system and entity component system (ECS) architecture to visualize tens of thousands of nodes and edges with a high framerate (>90 FPS). We collaborated with cybersecurity experts to design several interaction techniques based on their insights into the analysis of cyber threat information. Finally, we conducted two user studies. The results show that participants could find essential information faster using our system compared to the 2D graph visualization tool, and the system usability and user workload were also better. When exploring the cybersecurity data which has been arranged by cybersecurity experts, users could achieve similar performance using our virtual reality (VR) system and the desktop-based counterpart. Nevertheless, immersive visualization caused a lower mental workload.