NetworkTouch: A vibrotactile check-in device for cyberattack detection and monitoring

Gaining situational awareness to cybersecurity threats in computer networks requires effective tools for traffic monitoring and analysis. The scale of network traffic volumes makes monitoring and visualizing information challenging for human operators. This work develops a vibrotactile feedback system to monitor network traffic for cyberattacks, relying upon human perceptual abilities to detect changes in traffic patterns. To address potential issues with change blindness, a hand-shaped, rest-able desktop device is designed to condense traffic until the operator decides to "check-in" for a replay, as opposed to being pushed notifications or receiving continuous feedback. Each of five TCP control flags are assigned to vibrate a finger digit. To convey temporal changes in frequency of TCP control flags, five vibrational patterns of a diverging nature were created, with flags presented to successive fingers as a wave. Perceptual studies were conducted to evaluate change detection, as well as differentiability and recognition of the five vibrational patterns, and cyberattack detection of simulated port scan and synchronization flood attacks. The results indicate the five patterns are detectable, discriminable, and recognizable per finger, with accuracies above 85%. Moreover, without extensive training or knowledge of network traffic, all participants could readily detect simulated cyberattacks amidst normal traffic.