Visualizing Cybersecurity Diagrams: An Empirical Analysis of Common Weakness Enumeration Images

Visualizations of cybersecurity diagrams can play an important role in understanding security weaknesses, vulnerabilities, and attacks. Unlike other computing and engineering domains, cybersecurity does not have a standardized visual modeling language that characterizes its core components. This empirical study analyzes 500 public images found via Google Image Search for the 2023 Common Weakness Enumeration (CWE) Top 25 Most Dangerous Software Weaknesses. We find all CWEs include at least some diagrams. Most (52%) diagrams show weaknesses, some (16%) show solutions, and very few (6%) show both. Code is found in at least some diagrams for all but one CWE and is positively correlated with the number of elements and words. Images showing a malicious attack typically (72%) include a representation of a hacker, nearly always (93%) include a payload, and typically (79%) include a target (i.e., an asset that is attacked or more rarely a victim represented). Diagrams vary widely in how they use visual elements, even within the same CWE. Implications of these findings on the development of new cybersecurity-specific visual modeling languages are discussed.