Virtual geo-cyber environments: metaphorical visualization of virtual cyberspace with geographical knowledge

ABSTRACT

Cyberspace is a dynamic and complex environment that poses unique challenges in understanding and managing its intricacies. In this study, we developed a framework for ‘Geo-Cyber’ spatial correlation mapping and expression, leveraging geographical information to enhance the understanding of cyberspace. The theory of geographic metaphor is incorporated into the framework to provide a comprehensive and intuitive approach for comprehending the interplay between geographic space and cyberspace. The framework enables the modeling and visual expression of geo-cyber correlations using a layered knowledge-graph representation. To graphically represent the complex knowledge graph within cyberspace, the framework uses an ‘Object-VirtualObject-Process-Decision’ layered modeling approach, which facilitates effective navigation and comprehension of the inherent cyberspace dynamics. Based on the experimental data, we employed a virtual geo-cyber environment system to demonstrate the effectiveness of the framework. The application cases include resource navigation and situational awareness in cyberspace to showcase the practicality and relevance of the proposed framework. The analysis indicated that the framework enhances situational awareness, facilitates effective decision-making, and promotes a holistic comprehension of the interplay between geography and cyberspace by leveraging geographic information and incorporating metaphorical cognition, layered modeling, and visualization techniques.

KEYWORDS:

• Virtual geographic environment
• geographical knowledge
• virtual geo-cyber environment
• cyberspace
• geographic metaphor
• knowledge graph

1. Introduction

Cyberspace, a manmade space built on an information and communication technology (ICT) infrastructure, (Fang 2018) encompasses the physical space, virtual information space, and knowledge space, thereby providing support for various activities associated with ICT. Most existing studies focus on constructing a system for visualizing and expressing cyberspace, emphasizing its connection and mapping with the geographic space. Cyberspace has gradually emerged as a critical concern for national economic production, military warfare, and national defense security. At present, various fields are dedicated to modeling, simulating, analyzing, and depicting the complex cyberspace (Gao et al. 2019; Mohebbi et al. 2020). However, a considerable gap exists between the intangible, intricate, and dynamic nature of cyberspace and its effective expression. This can be primarily attributed to the limited detection of cyberspace resources and the insufficient description and visualization of cyberspace information. Unlike the physical world, achieving a comprehensive understanding of cyberspace becomes challenging (Gonçalves 2019), and conveying the cyberspace environment in a comprehensible manner is essential to enable users to grasp its intricacies and security landscape.

Cyberspace possesses distinct geographical characteristics that are primarily reflected in the spatial distribution of material resources within the virtual realm and the close relationship between online activities and physical geographic space. Geographic cognition and analysis tools, such as maps (Han, Tsou, and Clarke 2018) and virtual geographic environments (VGEs) are crucial for understanding cyberspace. In the era of ICT, the concept of spatial objects on maps has expanded beyond traditional geography and human interactions to encompass information, thereby creating a ternary spatial domain (Guo et al. 2018; 2021; 2022). Cyberspace mapping involves a combination of cartographic theories, technologies, and cybergeography (Kwan 2015). Cartographers have investigated cyberspace maps since the 1970s using concepts such as cybercartography (Taylor 2014), followed by the emergence of concept maps of cyberspace and three-dimensional (3D) hyperbolic space representations. Dodge and Kitchin (2000) categorized cyberspace maps into maps in cyberspace, maps of cyberspace, and maps for cyberspace navigation. Gao and Cao (2021) reported that ‘it is the responsibility of the discipline of cartography to describe cyberspace based on its development in depth and breadth’ and that ‘maps of cyberspace can serve as a reasonable extension of the concept of maps in cyberspace.’

VGEs are the latest geographic analysis tools that have evolved from maps and geographic information systems (Lin and Chen 2015; Lü et al. 2018; 2019). They present a communication and expression method that closely resembles natural human interactions, solving complex geographic problems and facilitating the sharing of geographic data and knowledge (Lin, Zhu, and Chen 2018). Since the 1990s, VGEs have significantly progressed in studying the interactions between humans and geographic space, including geographic modeling, virtual visualization, and geographic experiments (Chen et al. 2013; Chen and Lin 2018; He et al. 2023; Lin et al. 2013; Lin, Chen, and Lu 2013; Lü et al. 2018; MacEachren et al. 1999; Mekni 2018; Yu et al. 2021). As human activities have extended into the virtual realm of cyberspace (Hu, Luo, and Liu 2018; Liu et al. 2022), new perspectives have been introduced in terms of the interaction between spatial and temporal dimensions. Furthermore, the development of cyber infrastructure empowers individuals to engage in collaborative process modeling, simulation, and virtual experimentation within the realm of cyberspace (Chen et al. 2023; Klippel et al. 2021), thereby endowing the Digital Earth (DE) with advanced analytical capabilities. The virtualization of cyberspace is a major research focus for VGEs, and the mapping and correlation analysis of the geographic network relationships based on VGEs are essential for understanding and utilizing cyberspace.

The existing studies focus on VGEs to provide a virtual experimental platform and environment for studying the ‘human-place’ relationship. Thus far, the research emphasizes the modeling, representation, and study of human activities in geographic space. The expansion of the scope of geographical research from natural and human environments to information environments warrants the construction of a unified geographic network virtual environment to facilitate research on the ‘human-place-network’ relationship. However, several drawbacks exist in the current research on VGEs.

1. Lack of fundamental research on the constituent elements of the network space environment: As the cyberspace is a relatively unfamiliar space, it may be challenging to understand what it entails and specifically includes.

2. Insufficient research on modeling and representation of the network space environment: Expressing and comprehending sentiment analysis, e-commerce, network security, and social networks using fixed patterns remain challenging.

3. Reliance of the research on network-space representation on mapping network-space elements onto geographic space: The network space environment is portrayed by designing map symbols and mapping techniques. However, several virtual assets in a network space do not contain precise geographical locations, rendering it difficult to directly represent them on a map. Therefore, new approaches are required to create unified virtual environments.

4. Lack of unified expression for the geographic network relationship: As networks and geographic spaces are intricately related, a unified modeling and representation approach is required to accurately describe and analyze the relationship and patterns of the ‘human-place-network’ phenomenon.

Virtual geo-cyber environments (VGCEs) are based on collaborative cyberspace, the Internet of Things (IoT), and ICT, enabling users to engage in ‘human-in-the-loop’ experiences. VGCEs connect virtual cyberspace with physical geographic space and harmonize reality and virtual spaces, focusing on human cognition to correlate, process, and share geographic and cyberspace data.

In this study, VGEs, metaphor theory, knowledge graphs, and 3D DE are integrated to construct a VGCE, which serves as a platform for perceiving, navigating, analyzing, and predicting cyberspace environments. The contributions of this study can be summarized as follows.

1. A framework is proposed for modeling and expressing the correlation between physical geographic space and cyberspace based on the cognitive demands of cyberspace considering the theories of VGEs and systems science.

2. A complex knowledge-graph construction method is introduced based on the ‘Object-VirtualObject-Process-Decision’ (OVPD) layer model for cyberspace. Cyberspace is divided into four layers and represented as a unified complex knowledge graph using the entity-relationship logic.

3. A mapping and expression method is presented for the geo-cyber relationship based on metaphor theory, enabling the visualization of geographic knowledge constraints within the virtual cyberspace. Owing to their highly dynamic and boundless nature, the virtual and process resource layers of cyberspace are intricately connected with, but not limited to, the geographic space.

2. Methods

2.1. Overall framework

As illustrated in Figure 1, geographic space achieves the modeling, simulation, and visual representation of VGEs via the process of ‘geographic space detection → geographic scene digitalization → geographic scene simulation.’ Related theories and technological systems in this field are relatively mature and are widely applied in digital cities, geographic environment cognition, virtual geographic experiments, and autonomous driving.

Figure 1. Basic framework for modeling and expressing the spatial correlation mapping of geo-cyber spaces.

The extensive research on cyberspace surveying and mapping has led to the establishment of a technological system encompassing ‘cyberspace detection → cyberspace resources → cyberspace modeling and expression.’ This system is applied to enhance cyberspace cognition, analyze patterns of cyberspace behavior, and optimize resource utilization.

The knowledge, approaches, and mature techniques derived from geographic space provide valuable insights for modeling, understanding, and representing cyberspace. Bridging the gap between the physical and virtual realms we can offer a more comprehensive understanding of the interconnectedness and interdependencies between these two spaces.

The important aspects of the framework can be summarized as follows:

1. Cyberspace surveying encompasses various technologies, such as topology detection, component recognition, and analysis of text, audio, video, and websites. It can be broadly categorized into detection channels, platform technology, detection technology, and analysis of detection results. Similar to the geodetic triangulation in geographic space, the location detection of virtual resources, such as servers and Internet protocol (IP) addresses, involves the calculation of positional distances in the cyberspace detection stage. The coordinates of the other network nodes can be inferred and determined by leveraging the geographic attributes of the key node IP servers.

2. Cyberspace resource mapping involves mapping physical resources to geographic space and virtual resources, such as virtual network characters and virtual communities, to social space. Cyberspace and geographic space are intertwined because virtual resources in cyberspace identify relevant mappings in a geographic space. For instance, servers can be mapped to geographic locations and virtual characters and role accounts can be mapped to specific areas. Manually built virtual communities and other cyberspaces, such as servers and IP networks, also exhibit intricate connections with geographic space.

3. Cyberspace modeling encompasses complex network modeling and hierarchical modeling, and cyberspace expression involves mapping and visualization. The modeling and expression of cyberspace are inspired by geospatial hierarchical modeling, facilitating the hierarchical classification of cyberspace elements and phenomena. Additionally, virtual reality (VR) and augmented reality (AR) can be employed to express the correlation and mapping between cyberspace and VGEs. This approach is essential for analyzing the behavioral patterns and evolution of cyberspace from a geographical perspective.

4. Based on metaphor theory, the construction of VGCE enables unified modeling and expression of geographic space and cyberspace, referred to as the unified expression of geo-cyber. This facilitates a unified correlation between nature, humanity, and the network, providing an environment for further research on the ternary relationship between humans, space, and networks.

5. In terms of the ‘person-geo-cyber’ collaborative computing, the exchange of energy and information flow between ‘person-space,’ ‘person-network,’ and ‘space-network’ has expanded the scope of geographical research into the realm of network space. Collaborative computing between humans, space, and the network includes three categories: ‘person-space’ information computing, which focuses on human-centered geographical simulation and computation, such as geographical process simulation and spatiotemporal pattern discovery; ‘person-network’ social computing, which focuses on the social attributes and phenomena of human activities in network space, such as social network and network behavior computations; and ‘space-network’ information representation, which primarily performs situational analysis and predictions in network space.

6. In terms of application services, the VGCE provides a collaborative computing platform for ‘person-space-network’ and other applications, including smart cities, simulation, geographic experiments, machine cognition, intelligent platform experiments, intelligent agent spatial cognition, intelligent-assisted decision-making, and social perception.

This study focuses on the metaphorical representation of geographic cyberspace, the modeling of the VGCE environment, and foundational applications.

2.2. Complex knowledge network of cyberspace based on OVPD

2.2.1. Basic concepts

Network Coordinate System: The network coordinate system is a scalable scheme for predicting Internet distances. Each participating node in a network of N nodes obtains a d-dimensional vector using a few measurements that represent the network coordinates of that node.

Network Distance: The network distance between any two nodes can be predicted using a predefined calculation rule based on their network coordinates. In a system with N network nodes, measurement complexity is O(N). Network distance is a fundamental measure used to express various cyberspace elements. The three methods for estimating the network distance are as follows:

1. Non-coordinate estimation methods: These methods involve the direct measurement of distances; examples include the IDMaps (Francis et al. 2001), dynamic distance maps (Theilmann and Rothermel 1999), and Vivaldi (Dabek et al. 2004).

2. Coordinate estimation methods: These methods map cyberspace to the Euclidean space, representing network distances as distances between nodes in the Euclidean space; examples include the GNP algorithm (Ng and Zhang 2002) and the IDES method (Mao, Saul, and Smith 2006).

3. Network-distance estimation based on high-precision spatiotemporal information: This method records the distance between network nodes by measuring the time delays between them. This involves adding a BeiDou receiver to each router and using unified BeiDou time synchronization to calculate the network node distances (Liu et al. 2016).

Graph. A graph can be defined as a triple $G=(V,E,\phi )$, where $V=\{v_1,v_2,\cdots ,v_N\}$ represents the set of nodes, $E=\{e_1,e_2,\cdots ,e_M\}$ indicates the set of edges, and $\phi$ denotes the mapping from the edge set to the node set, referred to as the association function. The elements $v_i$ of $V$ are the nodes or vertices, and the elements $e_m$ of E are the edges. The degree of a node refers to the number of edges connected to that node; in a directed network, the edges associated with a node are directed and can be classified as out-degree and in-degree.

Attribute Graph. A graph that assigns certain attributes to each node and edge is referred to as an attribute graph, in which different nodes or edges exhibit different attribute values. For a node set $V=\{v_1,v_2,\cdots v_{|V|}\}$, $V$ is represented as $\mathrm{VA}=\{v{a}_1,v{a}_2,\cdots v{a}_{|V|}\}$, where the node identifier is an attribute of $V$. The value domain set of $\mathrm{VA}$ is $\mathrm{LV}=U_{\mathrm{va}\in \mathrm{VA}}{L}_{\mathrm{va}}$; the attribute set of a node is $V{A}_i=\{v{a}_{i1},v{a}_{i2},\cdots v{a}_{\mathrm{ip}}\}$; and the corresponding attribute set of $V{A}_i$ is $L{V}_i=\{\mathrm{Lv}{a}_{i1},\mathrm{Lv}{a}_{i2},\cdots \mathrm{Lv}{a}_{\mathrm{ip}}\}$. The node $v_i$ is represented as $v_i(V{A}_i,L{V}_i)$, that is, $v_i=v_i((v{a}_{i1},\mathrm{Lv}{a}_{i1}),(v{a}_{i1},\mathrm{Lv}{a}_{i2}),\cdots (v{a}_{\mathrm{ip}},\mathrm{Lv}{a}_{\mathrm{ip}}))$. For an edge set$E=\{e_1,e_2,\cdots e_{|E|}\}$ with an attribute set $\mathrm{EA}=\{e{a}_1,e{a}_2,\cdots e{a}_{|\mathrm{EA}|}\}$ and node attribute $(v_i,v_j)$, the value domain set of $\mathrm{EA}$ is $E=U_{\mathrm{ea}\in \mathrm{EA}}{L}_{\mathrm{ea}}$. If the edge $e_k(v_i,v_j)$ has both the node attribute $(v_i,v_j)$and the attribute$(E{A}_k,L{E}_k)$, the edge $e_k$ is represented as $e_k((v_i,v_j),\mathrm{Upl})$, where $\mathrm{pl}=(E{A}_{\mathrm{kl}},L{E}_{\mathrm{kl}})$. The set of edges is represented as $E=U{e}_k((v_i,v_j),\mathrm{Upl})$, and $v_i$ and $v_j$ are nodes with the attributes $v_i(V{A}_i,L{V}_i)$ and $v_j(V{A}_j,L{V}_j)$, respectively. Therefore, the attribute graph is denoted as $\mathrm{GA}=(V(\mathrm{VA},\mathrm{LV}),E(\mathrm{EA},\mathrm{LE}))$.

In a complex cyberspace knowledge graph, each node and edge possesses unique attributes, and their importance and relationships within the graph may differ. For instance, backbone nodes represent highly important and influential nodes in a network. They serve as key connectors and are critical for information transmission and communication. By contrast, general nodes refer to regular nodes that, although not as prominent, contribute to connecting and transmitting information in the network.

By examining the attributes and levels of importance associated with the nodes and edges, we can gain a deeper understanding of the intricate knowledge of networks in cyberspace. This analysis helps in understanding the relationships between nodes, the pathways through which information flows, and the overall structure and functionality of the network.

2.2.2. Basic structure of the cyberspace environment

As depicted in Figure 2, cyberspace is highly interconnected with the land, sea, air, and space domains. The cyberspace environment or the information environment revolves around the use of information as its primary component. The environment is intricately linked to both natural and human environments, creating a complex tripartite world. The structure of cyberspace is often illustrated using the concept of layer, which categorizes the elements and relationships within this virtual realm (Guo et al. 2021).

Figure 2. Model of a cyberspace environment structure.

From the perspective of cyberspace cognition and utilization, elements of cyberspace can be divided into several layers.

1. Physical Resources Layer: This layer encompasses interconnected devices and physical logical networks that form a network infrastructure. It comprises communication channels, communication facilities, network equipment, electromagnetic devices, and other physical resources.

2. Virtual Resources Layer: This layer comprises operating systems, application software, software configurations on devices, and logical connections between networked devices. It includes elements such as IP addresses, operating systems, application software, firewalls, malicious processes, various information services, virtual entities, social accounts, network roles, virtual roles, and virtual information resources, including data and spectrum resources.

3. Process Resources Layer: This layer involves the activities and patterns of virtual roles within cyberspace. It encompasses process-related resources, such as cyberspace attacks, defense, operational and maintenance events, and security-related phenomena.

4. Decision Control Layer: This layer primarily focuses on decision-making processes within cyberspace. It encompasses planning, perception, and other control commands, providing authorization for supervision and initiating, terminating, modifying, or redirecting network operations.

All these layers provide a framework for understanding and categorizing the different elements within cyberspace, enabling the effective utilization and management of the resources and processes involved.

As different perspectives lead to different understandings of cyberspace, no consensus exists on their categorization. Owing to the close connection between cyberspace and physical space, cyberspace must be viewed from a unified perspective. As indicated in Figure 3, the natural space includes land, ocean, sky, and outer space, each with different network communication devices. These devices, such as land-, air-, space-, and sea-based sensors, form the IoT network along with servers, routers, and IP connections, which constitute the foundational network infrastructure in natural space. Manmade spaces include political, military, economic, social, infrastructural, and informational elements. Unlike geographic space, cyberspace cannot be categorized based on spatial domains; however, it maintains a close relationship with geographic space.

Figure 3. Diagram of the interweaving relationship among natural space, cyberspace, and human space.

In this study, we focused on modeling and expressing virtual and procedural resource layers. Although virtual resources, such as IP addresses, autonomous system (AS) connections, and virtual roles, often lack precise geographical locations, they are dependent on servers or programs and can reflect real-world social roles. Based on geographic space, we explored the correlation and mapping of ‘humans-land-network’ by analyzing social networks and online public opinion to reflect human and societal phenomena and patterns.

2.2.3. Complex knowledge graph in cyberspace environment based on OVPD

A knowledge graph is a representation of the human objective world knowledge (Ji et al. 2022), where different types of knowledge are represented as a triple < Entity, Relationship, Entity > . This is achieved using techniques such as knowledge extraction, association, and storage. It is a complex semantic network represented as a directed graph of nodes and edges. In the context of the cyberspace environment, a knowledge graph can be represented using a 4-tuple model: $⟨\mathrm{Concept},\mathrm{Entity},\mathrm{Realtion},\mathrm{Property}⟩$, where $\mathrm{Concept}$ denotes conceptual categorization, $\mathrm{Entity}$ indicates specific instances, $\mathrm{Relation}$ represents the set of relations (including ‘concept-entity,’ ‘entity-entity,’ and ‘entity-property’ relations), and $\mathrm{Property}$ denotes the various attributes of the entity.

An OVPD knowledge cognitive model can be constructed to describe the complex and multiple relationships within the cyberspace environment. This facilitates the construction of a knowledge graph for the cyberspace environment based on schema and data layers. The schema layer represents the concepts and the relationships between them and is divided into four categories, namely, entities, virtual entities, processes, and decisions. Figure 4 depicts the ontology system, partially constructed based on this model. Basic classes such as CObject, CVirtualObject, CProcess, and CDecision are constructed during the implementation, and the relationships between these classes are established, as shown in Figure 5. Furthermore, entities in a cyberspace environment possess various properties, $(\mathrm{TIME},\mathrm{POS},\mathrm{RGN},\mathrm{STA},\mathrm{ACT})$, indicating time, position, region, status, and action. For instance, ‘On xx/xx/20xx, the tower server located at address A is running normally’ can be represented as an attribute graph, as follows: (Towerserver, $\mathrm{TIME}$, xx/xx/20xx) (Towerserver, $\mathrm{POS}$, Address A) (Towerserver, $\mathrm{STA}$, Normal). Figure 6 depicts the OVPD knowledge graph.

Figure 4. Cyberspace environment ontology composition.

Figure 5. Example of knowledge representation of cyberspace environment.

Figure 6. Layered knowledge graph of Object-VirtualObject-Process-Decision (OVPD) in cyberspace.

The cyberspace environment can be represented as a general graph using a knowledge representation model (Figure 7). The graph exhibits several key characteristics.

1. Directed Graph: The graph is directed with edges representing the relationships between entities. These relationships can be types of attachment (e.g. ‘is-a,’ ‘own,’ ‘act-to,’ and ‘use’), circulation (e.g. ‘link,’ ‘flow-in,’ ‘flow-out,’ and ‘passthrough’), or attribute (e.g. ‘has-time,’ ‘has-pos,’ ‘has-rgn,’ and ‘has-state’).

2. Complex Network Characteristics: The graph exhibits complex network characteristics, where the importance of nodes can be determined by their in-degree and out-degree within a network.

3. Complex Attribute Graph: Herein, each node represents a cyberspace entity and is associated with attribute descriptions. For instance, the entity ‘vulnerability’ may include attributes such as name, type, CNNVD number, risk level, and release time.

4. Weighted Edges and Attribute Nodes: Different weights are assigned to edges and attribute nodes to emphasize the importance of temporal and spatial location information in the attribute properties of various elements within a cyberspace environment. These weights reflect the significance of node–attribute relationships in entities, virtual entities, processes, and decisions.

2.3. Geo-cyber mapping based on metaphor theory

Applying metaphor theory and familiar concepts from geography can help understand the cyberspace environment. Metaphor (Hartford 1987) is a process of understanding a new phenomenon by using familiar concepts from previous experiences. Geographic metaphor visualization involves using familiar geographic expressions to metaphorically represent things, events, phenomena, and their relationships and similarities in non-geographic domains. The metaphorical map is defined as a spatial text with a synthetic structure generated with a specific intention based on the composition of map symbols using map language as the carrier. The metaphorical map is used to describe the network distance (Fabrikant et al. 2004), emotion map (Ma et al. 2020), multi-scale virtual terrain for hierarchically structured non-location data, and information visualization (Wijayawardena, Abeysekera, and Maduranga 2023; Xin et al. 2021; Xin, Ai, and Ai 2018), such as distance model, map projection, feature labeling, and map design (Skupin 2000). Metaphoric maps contribute to knowledge organization and sharing by matching the ability of humans to perceive space and environment with the relations linking entities and concepts in the represented domain (Celentano and Pittarello 2012). Based on the metaphor theory, the cyberspace environment can be represented as a virtual cyberspace sphere, and the cognitive habits developed in understanding geography can be applied to understanding cyberspace.

Figure 7. Examples of conceptual layers of a complex semantic network for cyberspace environments.

The metaphor mapping of cyberspace includes the following elements, as depicted in Figure 8:

1. Coordinate Reference: The virtual cyberspace sphere uses a non-Euclidean coordinate system, such as the graph coordinate systems of Orion and Rigel. This is different from traditional geographic coordinate systems, such as the centroid and geodetic coordinate systems.

2. Layers: Similar to maps, the cyberspace environment can be represented using physical, virtual, process, and decision control layers. This enables a detailed representation of elements within each layer, similar to the representation of geographic elements, such as residential areas, water systems, transportation, and vegetation, on a map.

3. Domain Boundaries: Cyberspace domain boundaries can be compared to boundaries and national borders in the geographic space. They describe the jurisdiction and influence of different entities in the cyberspace environment, similar to the boundaries of countries.

4. Layer Zones: The physical, virtual, process, and decision-making resource circles are represented similar to the atmospheric layers in geographic space. They symbolize different areas or levels within the cyberspace environment.

5. Landmarks: In geographic space, a geodetic triangle network is used to represent the positions of various points (Figure 9). Similarly, in cyberspace, a backbone network is constructed as the base to identify the positions of various nodes, as indicated in Figure 10. This backbone network follows the triangle inequality concept, which is similar to the geodetic triangle network used in physical geography.

Figure 8. Metaphorical mapping of geospatial and cyberspace maps.

Figure 9. Geodetic control network.

Figure 10. Network backbone.

The application of metaphor theory to represent a cyberspace environment using familiar geographic concepts has several implications.

1. Conformity to human cognitive habits: Utilizing metaphorical representations based on geographic concepts aligns with the human cognitive habits of understanding geographical environments. This enables individuals to easily comprehend and conceptualize cyberspace. However, it may introduce cognitive ambiguity owing to the inherent differences between cyberspace and physical geography.

2. Unified mapping of cyberspace and geospatial space: The use of metaphorical representations enables the realization of a unified mapping of cyberspace and geospatial space. This is beneficial for joint operation commanders as they can understand and analyze cyberspace alongside traditional geospatial information on joint situational awareness maps. This integration provides a comprehensive view of the operational environment.

3. Accurate understanding of the cyberspace situation: Incorporating geographical locations into the representation of cyberspace helps in accurately grasping the cyberspace situation. Considering the impact of geographical location enables a rapid and precise assessment of the significance of situational information associated with actual physical locations. This aids in decision-making and prioritizing actions in the cyberspace environment.

Overall, the use of metaphor theory to represent cyberspace using geographic concepts has several advantages, including alignment with cognitive habits, facilitating unified mapping, and improving situational awareness. However, the generation of potential cognitive ambiguity from the metaphorical representation of the distinct and complex cyberspace must be acknowledged.

2.4. Visualization of VCE constrained by geographic knowledge

Figure 11 illustrates the basic process of visualizing a VCE constrained by geographic knowledge, which includes the following steps.

1. Representing cyberspace elements. The basic elements of a cyberspace environment are represented by an attribute graph model. This model is based on an analysis of the composition of cyberspace elements, ensuring a structured representation of the relationships and attributes of these elements, as described in Section 2.2.2.

2. Acquiring cyberspace knowledge graph. A cyberspace knowledge graph is obtained, which includes nodes representing various elements in the cyberspace environment and relationships between them, as described in Section 2.2.3. Nodes with geographical attributes and those with high degrees, yet lacking geographical attributes, are selected as control nodes. The degree of a node is determined by its weight and the weights of the edges connected to it.

3. Embedding control nodes. The selected control nodes are embedded into the Euclidean space to form a cyberspace coordinate system. The initial positioning of the cyberspace coordinate system is established by calculating the network coordinates of the control nodes.

4. Calculating network coordinates. The network distances between the normal nodes (nodes without geographical attributes) and control nodes are calculated using the network coordinates of control nodes and the in- and out-vectors of normal nodes, thereby determining the network coordinates of normal nodes in the cyberspace coordinate system.

5. Calculating geographic coordinates. Using a network distance weighting algorithm, the geographic coordinates of nodes without geographical attributes are calculated in the geographical coordinate system. This is based on nodes with geographical attributes that serve as reference points. This step enables the mapping of the cyberspace coordinates to the geographic coordinates of nodes that lack geographical information.

6. Drawing VCE. A VCE is created based on the geographic coordinates of each node in the geographical coordinate system. This facilitates the metaphorical visualization of the coordinate system, layers, and domain elements in the cyberspace environment using familiar geographic representations.

Figure 11. Visualization of virtual cyber sphere constrained by geographic knowledge.

(1) Selection of control nodes from the cyberspace knowledge graph

The attributes of each node in the cyberspace knowledge graph are evaluated to determine the control nodes. Control nodes are selected based on two criteria, as indicated in Figure 12: nodes with geographic location attributes and nodes with high degrees but without geographic location attributes. The degree of a node is calculated by considering its own weight and the weights of the edges connected to it. These control nodes serve as reference points for embedding the cyberspace coordinate system into Euclidean space, enabling accurate visualization and understanding of the VCE. (1) $D(v_i)=\omega (v_i)\sum _{v_j\in V}\omega (e_{\mathrm{ij}})\omega (v_j)$(1) where $\omega$ denotes the weight; $e_{\mathrm{ij}}$ indicates the node; and $v_i$ and $v_j$ represent the edges connected to the node.

Figure 12. Selection of control nodes in the cyberspace knowledge graph.

Note: Different fill colors represent different types of network nodes.

The weight of the edges is assigned when constructing the knowledge graph, as follows: (2) $\omega (e_{\mathrm{ij}})=\{\begin{array}{c}0.5,\mathrm{edge}\mathrm{with}\mathrm{geographic}\mathrm{location}\mathrm{attributes}\\ {\displaystyle \frac{0.5}{n},\mathrm{edge}\mathrm{without}\mathrm{geographic}\mathrm{location}\mathrm{attributes}n\mathrm{is}\mathrm{the}\mathrm{number}\mathrm{of}\mathrm{edge}}\end{array}$(2) The weight of a node, indicated as $\omega (v_j)$, is determined by the number of connected nodes. The more nodes connected, the higher the weight of the node; for instance, if a node is connected to five nodes, its weight is five.

(2) Calculation of the coordinates of the control nodes

As indicated in Figure 12, the initial coordinates ($U_{M_a},V_{M_a}$) of the control nodes are randomly initialized. Subsequently, the function is used to calculate the NPD and MD values. For each control node, the CAL_W function is used to calculate the weight matrix ${\omega }_a$. The coordinates of the control nodes in the coordinate system are determined using the MDCC coordinate calculation method, which is based on robust discrete matrix decomposition. Coordinate allocation follows the shortest distance approximation (SODA) algorithm (Cheng et al. 2016), as follows: (3) $J_n=\left[\begin{array}{c}{U}_n\\ X\end{array}\right]\left[\begin{array}{cc}{V}_n^T& Y^T\end{array}\right]=\left[\begin{array}{cc}{G}_n& U_n{Y}^T\\ X{V}_n^T& F_n\end{array}\right]$(3) where $G_n$ represents the distance matrix of the control nodes; $D_n$ indicates the distance from a control node to itself; and X and Y denote the out-vector and in-vector of the nodes, respectively. The network coordinates of the control nodes can be calculated by iteratively solving this equation and setting an error function. The out-vector of a node represents the vector pointing from that node to other nodes, whereas the in-vector represents the vector composed of other nodes pointing to the node. The matrix representing the out- and in-vectors of all control nodes are denoted as $U_n$ and $V_n$, respectively (Figure 13).

Figure 13. Calculation of the distance in cyberspace coordinates.

(3) Coordinates of normal nodes

The network distance between the normal and control nodes is used to determine the network coordinates of the normal nodes in the cyberspace coordinate system. Similar to Step 2, this step follows the SODA algorithm. The specific implementation process of this algorithm can be summarized as follows.

For each normal node $V_k$, N neighboring control nodes are selected as reference nodes to construct a distance matrix based on their network coordinates (Figure 14). (4) $Q_a=\left[\begin{array}{cc}{U}_a{V}_a^T& D(\mathrm{in},a)\\ D(\mathrm{out},a)& c_a\end{array}\right]$(4) where $U$ and $V$ denote the out and in coordinates of the reference node $i_M$, respectively; $D(\mathrm{in},a)$ and $D(\mathrm{out},a)$ represent the in and out matrices, respectively; $Q$ represents the distances between all pairs of points in the set formed by node $i_M$ and its reference nodes; and $c_a$ indicates the distance between $i_M$ and itself, which is typically $c_a=0$. The matrices $U$ and $V$ are randomly initialized, and the weight matrix is constructed based on the selected reference node $N$. The weight matrix of the normal nodes is obtained, which can be utilized in iterative calculations to determine the network coordinates of the normal nodes.

Figure 14. Calculation of the distance between the normal and control nodes.

(4) Calculation of the geographical coordinates of a node

After obtaining the network coordinates of the control and normal nodes, the shortest distance between any pair of nodes can be calculated using the formula for inner product space distance. For instance, for nodes $v_i$ and $v_j$, Equations (5(5) $L(v_i,v_j)=U_{v_i}\cdot V_{v_j}$(5) ) and (6(6) $L(v_j,v_i)=U_{v_j}\cdot V_{v_i}$(6) ) represent the distances from node $v_i$ to node $v_j$ and from node $v_j$ to node $v_i$, respectively: (5) $L(v_i,v_j)=U_{v_i}\cdot V_{v_j}$(5) (6) $L(v_j,v_i)=U_{v_j}\cdot V_{v_i}$(6) $L(v_i,v_j)$ represents the distance from node $v_i$ to node $v_j$; $U_{v_i}$ denotes the out-coordinate of node $v_i$; and $U_{v_j}$ indicates the in-coordinate of node $v_j$. These are the network coordinates of the nodes.

The distance between the control nodes with accurate geographical coordinates and other nodes can be calculated using Equations (7), (8) and (9). Based on the weighted average of the network distances between control nodes with accurate geographical coordinates and nodes with unknown geographical coordinates, the relative geographical coordinates of the latter can be determined as follows: (7) $L_j=L_i+{\displaystyle \frac{U_j}{D}\cdot L_i}$(7) (8) $B_j=B_i+{\displaystyle \frac{V_j}{D}\cdot B_i}$(8) (9) $Z_j=Z_i+\sigma \cdot Z_i$(9) where $(L_i,B_i,Z_i)$ represents the geographical coordinates (known) of nodes with accurate geographical locations; and $(L_j,B_j,Z_j)$ denotes the geographical coordinates (unknown) of nodes without accurate geographical locations. The Z value of the geographical coordinates is calculated based on the range of the spatial domain to which the network node belongs using a random number σ. To avoid excessive disturbance, we considered 0 < σ < 1.0.

3. Application prototype

3.1. Experimental data and platforms

The experimental data were collected via cyberspace mapping, encompassing the domain name system (DNS), AS, topo-scamper, topo-routeviews, topo-asnlinks, and topo-asns data; Table 1 summarizes the specific details. A visualization framework was constructed using Cesium and Three.js. This interactive visualization framework combines the VGE and virtual cyberspace sphere to facilitate cyberspace analysis.

Table 1. Details of the experimental data.

Data type	Description	Format
DNS	DNS data: includes ISO codes, domain levels, and information related to countries/regions associated with the domain names.	JSON
AS	Asset data; includes IP addresses, timestamps, hostnames, ports, protocols, and other information.	JSON
topo-scamper	Network probing data: includes the starting IP of the network trace, the destination IP, and a list of the IPs it passes through.	JSON
topo-routeviews	Network topology data: includes routing tables, AS paths, and link states, among other information.	JSON
topo-asnlinks	Autonomous system topology data: includes the starting and ending nodes of links, as well as information about the number of routing paths.	JSON
topo-asns	Autonomous system connectivity data: includes AS numbers, names, latitudes, longitudes, and AS numbers of starting and ending nodes.	JSON

3.2. VGCE

3.2.1. Visualization of multi-layer knowledge networks in cyberspace

Based on the OVPD model, a network spatial knowledge graph was formed using the experimental data (Figure 15(a)). A force-directed graph model algorithm was employed to calculate the gravitational and repulsive forces, enabling the movement of nodes to new positions based on these net forces. Figure 15(b) illustrates the resulting graph layout in the complex network environment. This visualization of a multilayer knowledge graph in cyberspace offers an intuitive understanding of the overall scenario, including the presence of attacks and defense nodes. However, accurately determining the distribution and specificity of cyberspace resources poses a challenge, and it may be difficult for users to rapidly comprehend cyberspace. Although this approach enables cyberspace visualization, the existing methods for network coordinate systems and distance measurements in cyberspace hinder its direct mapping to geographic space. Consequently, the obtained visualization results do not offer an intuitive understanding of the distribution of cyberspace based on geographical locations.

Figure 15. Visualization of a cyberspace knowledge graph. (a) Different colors represent the example nodes from different cyberspace resource layers. The association between different cyberspace resource layers is realized based on the relationships between entities. (b) Two-dimensional (2D) node-link visualization of a cyberspace knowledge graph, including 1000 nodes and 722 edges. All nodes are displayed on a single map.

3.2.2. Visualization of VCE

Visualization of the virtual cyberspace sphere closely resembles the visualization of a 3D virtual Earth. According to the expression method for a VGE, the process involves ‘determining the coordinate system reference → constructing the control network → calculating the coordinates of cyberspace nodes → drawing the 3D sphere.’ This enables the mapping and representation of the cyberspace environment, which combines virtual and real aspects without a fixed boundary, on a 3D virtual sphere. The nodes with geographic locations and those with higher degrees (Figure 16(a)) are filtered, and the resulting visualization is depicted in Figure 16(b). The network coordinates of both the control and normal nodes were calculated using the cyberspace coordinate system. By leveraging the geographical coordinates of the control nodes with known locations, the geographical coordinates of the other network nodes were determined based on the cyberspace distance between these nodes and control nodes. The 3D visualization of the geographical coordinates for each network node was accomplished using node-link representations.

Figure 16. Selection of key nodes and visualization of a three-dimensional (3D) virtual cyberspace environment. (a) The deep blue nodes include geographical information, whereas the light blue nodes exhibit high degrees without geographical information. (b) Nodes without geographical information are assigned values based on distance calculations and visualized in a 3D scene.

3.2.3. Geographic network metaphorical relevance

Geographical metaphors are crucial for establishing a metaphorical relationship between the VGE and VCE. This approach enables the representation of the cyberspace environment using familiar geographic concepts, such as coordinate systems, territorial boundaries, and layers.

Figure 17(a) illustrates a VGE that displays a 3D DE, showcasing the relevant elements of the cyberspace environment using the DE platform. However, owing to the lack of specific geographic location information for most cyberspace elements, obtaining a complete overview of the cyberspace environment is challenging.

Figure 17. Geo-cyber space metaphorical relevance. (a) Visualization of the virtual geographic environment (VGE), including geographic coordinate system, geographic layers, and geographic boundaries. (b) Visualization of virtual cyberspace environment (VCE), including network coordinate system, cyberspace layers, and cyber domains.

Figure 17(b) depicts the VCE section that uses the metaphor of a 3D DE to depict the elements of the cyberspace environment as a virtual sphere. The surface of the sphere features a territorial map of cyberspace, establishing a metaphorical connection between cyberspace nodes and geographic space. This approach aligns with the human cognition of geographic space and enables a comprehensive understanding of the cyberspace environment. Additionally, by incorporating the metaphor of geographic space, this representation provides a perception of the association between cyberspace environment and geographic space.

3.3. Application cases

3.3.1. Physical geography, human geography, and cyberspace in VGCE

Various elements in the virtual and process resource layers of the network space lack geographical attributes. For instance, obtaining accurate geographic locations is difficult for most virtual IPs, and expressing network security protection in geographic space is challenging. Figure 18(a) depicts the network space elements with precise geographical locations; however, displaying numerous network space elements that lack geographic positions is difficult. As illustrated in Figure 18(b), all network space elements can be displayed in the VGCE space using the proposed method. Furthermore, based on the VGCE, natural, humanistic, and network space elements can be associated and displayed in a unified environment. In Figure 19, the red nodes represent the natural geographical elements, specifically road entities; the green nodes indicate the human geographical elements, such as social and cultural organizations; and the blue nodes denote the network space elements, representing network virtual IPs and other entities.

Figure 18. (a) Representation of network space elements based on a virtual geographic environment (VGE). Most network space elements that do not contain geographical locations are difficult to model and represent in a VGE. (b) Unified expression of natural, humanistic, and network space elements based on the virtual geo-cyber environment (VGCE), which displays all layers of network space elements and achieves the associated modeling of natural, humanistic, and network space elements based on entity nodes.

Figure 19. (a) Blue nodes represent entities of network space elements which are shown in 3D globe earth. (b) Red nodes represent entities of natural geographical elements, such as road entities; green nodes represent entities of human geographical elements, such as social organizations; blue nodes represent entities of network space elements, such as Internet protocol (IP) entities.

3.3.2. Cyberspace environment resource navigation

The objective of cyberspace environment resource navigation is to provide users with a convenient method to query and locate network resources within cyberspace. This includes searching for IP addresses, AS numbers, server devices, and virtual accounts. Primarily, two approaches are used to navigate resources in the virtual cyberspace sphere.

1. Interactive navigation through the virtual cyberspace sphere: In this approach, users can interactively navigate through the virtual cyberspace sphere to obtain specific resources; Figure 20 illustrates this process. Users can click on a query in the cyberspace asset vulnerability node to access detailed information on the right-hand side. This information includes the vulnerability app name, device manufacturer, asset type, vulnerability count, and protocol. Additionally, the VGE on the left-hand side enables rapid navigation to the corresponding geographic location connected to the resource.

2. Interactive navigation through the network logic layer: This approach involves using the node-link graphical representation method to construct a layered knowledge graph of cyberspace; Figure 21 illustrates this technique. Users can access linkages with geographic space by clicking on the network nodes located in different layers. This navigation facilitates a comprehensive understanding of network connectivity and asset associations between various layers within cyberspace.

Figure 20. Interactive navigation through virtual cyberspace sphere.

Figure 21. Interactive navigation through the cyberspace logic layer.

Users can efficiently query and locate network resources in cyberspace using the aforementioned interactive navigation methods. The combination of the virtual network globe and network logic layer enhances the overall understanding of the interconnections and associations between different elements of the cyberspace environment.

3.3.3. Cyberspace environment situational awareness

The purpose of situational awareness in the cyberspace environment is to provide an analysis of the current state of cyberspace attacks, defense, and operations, as well as to predict and assess unknown network security threats. Figure 22 illustrates this concept, where the left-hand side represents cyberspace based on the layers of Earth’s sphere, whereas the right-hand side represents the logical interaction expression of various resource layers within cyberspace. Users can utilize the virtual resource layers to select network link-type nodes and access attributes, such as the AS number, IP quantity, and virtual machine registration number. Additionally, the VGE facilitates rapid navigation to the corresponding location. Examining the distribution and connections of the network virtual resource layer nodes displayed on the right-hand side of Figure 22 can provide insight into the overall situation of network attacks and defenses. The geographic distribution of the cyberspace nodes on the left-hand side provides a clear understanding of the distribution of cyberspace resources associated with the different geographic layers. Based on this approach, the cyberspace situational awareness enables a comprehensive analysis and understanding of the overall state of cyberspace, including the interplay between the different resource layers and their geographic associations.

Figure 22. Geographical space layers versus the network space logic layers.

4. Conclusions and outlook

In this study, we propose a fundamental framework for geo-cyber spatial correlation mapping, modeling, and expression based on the theory of geographic metaphor to completely utilize the benefits of geographic information in understanding the cyberspace environment. The developed VGCE system is validated by demonstrating its ability to model and visually express geo-cyber correlations. This visualization method aligns with human cognitive habits in the geographic environment and enhances the comprehension of the cyberspace environment. Furthermore, it facilitates unified mapping of cyberspace and geographic space, facilitating the accurate grasping of the cyberspace situation by considering the impact of geographic location and assessing the importance of situational information.

The proposed method of geographic metaphor correlation mapping and expression presents three advantages. First, the metaphorical cognition of fundamental concepts, such as coordinates, layers, domain boundaries, circles, and landmarks is realized by mapping geographic concepts to cyberspace, providing a geographical perspective in understanding the cyberspace environment. Second, the OVPD layered modeling approach is utilized to graphically model the complex knowledge network in cyberspace, effectively leveraging the advantages of cyberspace. Third, by calculating the impact of geographic location on the network nodes, the association visualization of VGE + VCE is achieved, connecting geospatial and cyberspace through physical nodes. This improves the ability to query and navigate, enhancing the situational awareness of virtual assets in cyberspace.

However, the following limitations were observed in our analysis.

1. Cognitive illusion of metaphor: The metaphor-based approach uses the cognitive habits of geographic space to achieve cognitive understanding of the virtual and dynamic network space environments; however, this may lead to cognitive illusions. For instance, if users view only the VGCE without the comparison display of VGE, they may misinterpret the boundaries of cyberspace as geographical boundaries. Additionally, spherically constraining the boundless network space environment can cause an unclear understanding of the network space environment.

2. Metaphorical problem of the geographical location of virtual assets in cyberspace: To represent geographical and network information in a unified environment, we performed mapping based on network and geographical distances to calculate the position attributes of virtual nodes. However, this deviates from the actual geographical location of virtual IPs (if any), and certain virtual assets do not comprise specific locations. For instance, geographical locations have no relevance to virtual IPs or virtual roles, which may lead users to incorrectly interpret that all virtual nodes have geographical location information.

3. Integration of natural, humanistic, and cyberspace expressions: The unified association and expression of the three aspects are realized based on the semantic space, providing a new method for the unity of the ternary space. However, the actual relationship between the three aspects is complex and may be biased to achieve their association in the same space only from a semantic perspective.

Despite its effectiveness in studying cyberspace, VGE is a complex artificial space where reality is intertwined with virtual elements. Therefore, perceiving scene elements, forming boundaries, and understanding changing dynamics using only our senses are challenging. This implies that comprehensible expression is vital for users to comprehend cyberspace and its security landscape. Cross-domain information mapping is a major concern in the field of cyberspace, which includes the challenge of mapping between information, geographic, and human environments. In the future, we intend to introduce dynamic information expression methods in VGEs by employing techniques such as multi-view collaborative correlation analysis, human–computer collaborative interaction analysis, and mapping visualization. These techniques can facilitate the analysis and mining of complex high-dimensional network data, achieving a global cognition of cyberspace. Furthermore, user experiences can be enhanced by immersion in virtual environments using technologies such as VR, AR, and extended reality, enabling the cognitive integration of geographic space and cyberspace.

Acknowledgements

Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author and do not necessarily reflect the views of the National Science Foundation.

Disclosure statement

No potential conflict of interest was reported by the author(s).

Additional information

Funding

This work was supported by National Natural Science Foundation of China [grant number 42171456].