Technology Category
Computer Vision: Multi-modal VisionHumans and AI: Game Design — Virtual Humans, NPCs and Autonomous CharactersPlanning, Routing, and Scheduling: Optimization of Spatio-temporal Systems
SecCityVR: Visualization and Collaborative Exploration of Software Vulnerabilities in Virtual Reality
🤖 AI Summary
Existing vulnerability visualization approaches—such as 2D/3D dashboards—fail to effectively represent propagation paths and concurrent dependencies among vulnerabilities, and typically provide asynchronous, non-collaborative reporting without real-time coordination. Moreover, no VR-enabled interactive security vulnerability analysis framework exists. This paper introduces SecCityVR: the first immersive, virtual reality–based security auditing system. It employs a “code city” metaphor, mapping vulnerabilities onto color-coded architectural structures and embedding call graphs to enable spatial localization and propagation-path visualization. SecCityVR pioneers a VR environment supporting real-time multi-user collaboration, context-aware navigation, and automated remediation guidance. Built on Unity and Oculus, it integrates static analysis result mapping, call-graph embedding, and network synchronization. A user study demonstrates that SecCityVR significantly improves usability, reduces cognitive load and frustration compared to conventional tools (e.g., find-sec-bugs), thereby validating VR’s efficacy and user acceptance in collaborative security analysis.
Technology Category
Application Category
📝 Abstract
Security vulnerabilities in software systems represent significant risks as potential entry points for malicious attacks. Traditional dashboards that display the results of static analysis security testing often use 2D or 3D visualizations, which tend to lack the spatial details required to effectively reveal issues such as the propagation of vulnerabilities across the codebase or the appearance of concurrent vulnerabilities. Additionally, most reporting solutions only treat the analysis results as an artifact that can be reviewed or edited asynchronously by developers, limiting real-time, collaborative exploration. To the best of our knowledge, no VR-based approach exists for the visualization and interactive exploration of software security vulnerabilities. Addressing these challenges, the virtual reality (VR) environment SecCityVR was developed as a proof-of-concept implementation that employs the code city metaphor within VR to visualize software security vulnerabilities as colored building floors inside the surrounding virtual city. By integrating the application's call graph, vulnerabilities are contextualized within related software components. SecCityVR supports multi-user collaboration and interactive exploration. It provides explanations and mitigations for detected issues. A user study comparing SecCityVR with the traditional dashboard find-sec-bugs showed the VR approach provided a favorable experience, with higher usability, lower temporal demand, and significantly lower frustration despite having longer task completion times. This paper and its results contribute to the fields of collaborative and secure software engineering, as well as software visualization. It provides a new application of VR code cities to visualize security vulnerabilities, as well as a novel environment for security audits using collaborative and immersive technologies.
Problem
Research questions and friction points this paper is trying to address.
Visualizing software vulnerabilities in VR for better spatial understanding
Enabling real-time collaborative exploration of security vulnerabilities
Improving usability and reducing frustration in security audits
Innovation
Methods, ideas, or system contributions that make the work stand out.
VR code city metaphor visualizes vulnerabilities
Multi-user collaboration in VR for security audits
Interactive exploration with contextual vulnerability explanations
🔎 Similar Papers
No similar papers found.
