Introduction

The exponential proliferation of Internet-connected devices has precipitated a monumental surge in the daily volume of data generated. The advent of the Internet of Things (IoT) has not only expanded the sheer quantity of networked devices but has also diversified their types and functions. From ubiquitous smartphones and smartwatches to cutting-edge smart cars, these devices incessantly produce data packets stemming from everyday interactions, seamlessly transmitting them across the vast expanse of the Internet to network providers that serve as nodes of the intricate web of connectivity. According to the latest statistical analysis 1 , 328.77 million terabytes of data is produced daily, culminating in 120 zettabytes annually.

This data contains valuable insights into user behavior, providing a fingerprint of their activities, preferences, and desires. Although nowadays most network traffic is encrypted utilizing several techniques, such as TLS, SSL, HTTPS, etc. [1], there are still approaches that can extract knowledge from the traffic by extrapolating patterns [2]. By analyzing the information extracted from the traffic, providers can better tailor needs by promoting personalized advertisements that have a higher probability of convincing the user to navigate toward those pages [3]. Thus, the vast amounts of data generated can potentially serve as a significant source of revenue for network providers [4], at the expense of users' privacy [5]. In addition, online activities can often expose users to the wide range of cyber-attacks that characterize the web, making the user who approaches it particularly vulnerable. Malware [6], DDOS attacks [7], port scanning/mapping [8], IP spoofing, phishing [9], are just some of the types of cyber threats that an Internet user may encounter on a daily basis.

In this scenario, it is crucial to provide users with solutions that can properly assess and hopefully increase their level of awareness regarding how easily online activities could affect their privacy and make them susceptible to cyber-attacks. To this end, the literature has seen the rise of several platforms whose purpose is to monitor their activities and alert users to the risks associated with the improper use of Internet-connected devices [10] and the network anomalies to which they are exposed [11]. These approaches primarily use visual metaphors and/or the introduction of layers of abstraction to present users with the progress of their online activities [12] and be alerted to any attack that may be targeted at them [13,14].

Such platforms could significantly play a role in enhancing users' awareness; however, all of them considerably lack tailorability with respect to the mental model of the user approaching them. In fact, with the enormous expansion of the Internet and the introduction of connected features in devices of all kinds, the pool of users who need to use these devices has grown considerably, and with it the different types of technical knowledge base, awareness of cyber risks, and so on. In fact, the difference between novice and expert users, and the need to adapt the interaction process accordingly, has been the subject of recent research in the literature [15]. This diversity of mental models is not reflected in visual platforms, which maintain the same structure and presentation style regardless of the type of user approaching them. Therefore, it is necessary to develop dynamic solutions that ensure adaptability in terms of the information to be displayed and the way in which it is displayed, based on the knowledge level of the end user.

Visual interfaces that adapt to user needs are an emerging area of research aimed at enhancing user experience and performance [16]. These interfaces leverage various inputs and contextual information to tailor the user experience to individual preferences, behaviors, and requirements. Adaptive algorithms within user interface design environments show promise in improving automated design system performance by considering stylistic preferences and flexible success standards [17]. User inputs such as physiological, behavioral, qualitative, or multimodal data are being utilized to adapt visualizations and interfaces, with research trends focusing on mixed reality, physiological computing, visual analytics, and proficiency-aware systems [18]. Logical frameworks using formal knowledge and reasoning components, like Answer Set Programming (ASP), enable the generation of web user interfaces that adapt to user needs, including those of older individuals, by adjusting visual aspects like element sizes and colors [19]. Adaptive interfaces in smart environments can self-improve by observing user behavior, using user modeling algorithms to draw conclusions from user-system interactions, and triggering adaptations through an ontology-based semantic layer [20]. In addition, a range of methods and tools exist for adapting user interfaces to improve accessibility, including built-in adaptation mechanisms within applications and external transformation approaches [21]. To achieve the tailoring we advise for our interfaces, Large Language Models (LLMs) at the base of a conversational agent could provide a valuable medium to perform the assessment of the user's mental model. The use of LLMs instead of more traditional interaction approaches may be able to ensure sufficient dynamism in the assessment phase by formulating questions whose specificity results as a function of the answers obtained to previous questions. Once the type of user has been defined, along with his or her needs and gaps, the subsequent visual platform should display information in accordance with what the user's level of knowledge allows him or her to understand.

In this position paper, we present an overall architecture of an LLM-based conversational agent for human knowledge assessment in conjunction with a dynamically structured visual platform to assist users in analyzing network traffic and the attacks to which they may be susceptible.

Related Work

In this section, we present several network data analytics tools presented in the literature whose purposes are to visualize and summarize network traffic through simplified visual metaphors.

One of the pioneering approaches documented in literature is FlowScan [22], which scrutinizes and presents insights from flow data extracted by Internet Protocol routers. It comprises Perl scripts and modules, serving as the cohesive element integrating various freely available components, including a flow collection engine, a high-performance database, and a visualization tool. Once integrated, the FlowScan system generates graphical images suitable for web pages, offering a continuous, nearly real-time depiction of network traffic across a network's perimeter.

In [12], the authors propose CHRAVAT, a visual platform focused on monitoring network traffic during normal web browsing. The tool tracks incoming and outgoing traffic from the computer and identifies the providers that receive requests made while web pages are loading. Each provider is then represented by a node in a graph, colored differently depending on the type of provider, and populated in real-time, as well as a set of quantitative data showing the number of providers contacted.

Nfsight [23] is a tool aimed at enhancing network awareness with three main features: passive identification of client and server assets, a web interface for querying and visualizing network activity, and a heuristic-based intrusion detection and alerting system. The Service Detector identifies endpoints using heuristics and Bayesian inference from NetFlow flows, while the Intrusion Detector flags suspicious activity with graphlet-based signatures.

NetMod [24] is a tool offering detailed analysis of system performances for designers working on large interconnected local area networks. Tested on a campus-wide network, NetMod employs simple analytical models and a user-friendly interface.

MVSec, as described in [25], is a visual analytics system assisting analysts in comprehending information flows over secure networks. This system facilitates data fusion activities among heterogeneous datasets using various visual metaphors. The authors established multiple coordinated views to enable analysts to characterize loud events, uncover subtle events, and explore relationships within datasets. Case studies demonstrate MVSec's capability in constructing analytical storylines of networking and understanding network changes.

The study by Attipoe et al. [26] examined 13 network visualization tools to delineate their strengths and weaknesses. Employing qualitative coding as part of their research methodology, they extracted metrics from the advantages and disadvantages of these tools. Their aim is to aid analysts in constructing evaluation methodologies for measuring visualization tool effectiveness via usability studies.

In [27], Constantinescu et al. introduce a prototype 3D visualization system for real-time monitoring of networked devices' status (wired, wireless, IoT devices) and network dynamics ("pulse"), including configuration, load, traffic, abnormal events, and suspicious connections. Users can intuitively visualize network status from any location on the Internet, including mobile devices, and receive alerts via short text or instant messages for significant network events.

Other approaches reviewed in the literature proposed solutions to increase awareness by alerting users to phishing attacks, the type of attack to which end users are more susceptible. For example, the authors in [28] propose the development of a real-time tool to detect and distinguish phishing websites from safe ones using machine learning techniques, mainly linear regression, multinomial NB and logistic regression. The aim is to increase cybersecurity awareness by preventing users from accessing risky URLs and protecting their personal data. [14] introduce an approach for generating warning dialogs in response to phishing attacks. Unlike traditional solutions that simply alert users about the attack, this technique provides explanations concerning why a website is deemed suspicious. The underlying premise is that offering these explanations helps users comprehend the presented information, instills trust in the communicated message, and enhances awareness of the situation.

Although all of the tools discussed in this section provide important support in improving the level of user awareness and knowledge of risks, none of them contemplates the possibility of preemptively assessing the end user's level of knowledge, and subsequently making the decision to adapt the content of the information shown based on the user's assessment, which limits the use of the platforms exclusively to that group of users who can understand them when shown. In the following, we propose the addition of a dynamic assessment module with consequent adaptability of the tools to the user's level of knowledge.

Dynamic human knowledge assessment using Large-Language-Models

In this section, we describe the features we envisage in our proposal regarding the introduction of a module that should interpose between the user and the network traffic visualization platform. In our vision, the purpose of this module is to provide a mechanism to dynamically assess the level of basic technical knowledge, i.e., to present the user who approaches it with a series of questions of different natures to determine the level of knowledge he or she has. The dynamic nature of the approach lies in its adaptability to the type of questions asked, based on the answers given by the user. In fact, a series of wrong and/or inaccurate answers is an indication of important lacks in that particular aspect, which is why certain features of the platform need to be removed or simplified to make the user's experience easier. For example, if the user responds "I don't know" or gives an incorrect answer to the question "What is a graph?", this may be sufficient to provide sufficient guidance not to use such a visual metaphor to present such information to the user. However, such an approach runs the risk of reducing the assessment process to a checklist, where a set of questions about a particular concept is associated with a particular answer and an interface adaptation. This poses the danger of oversimplifying the assessment process, potentially resulting in inaccurate evaluations. In fact, to return to the graph example, the user may not even be aware of the term "graph, " but he or she may still be able to interpret the visual metaphor correctly. Verifying this possibility is something that can be done if, for example, the user's ability to understand the representation of connected nodes and arcs has been inferred from the previous questions.

For this reason, the knowledge assessment is based on the need for something that is necessarily non-deterministic, and for which the determination of the next question to be asked for the evaluation phase takes into account the direction of the interaction. In this scenario, the use of complex natural language models turns out to be a particularly suitable choice for accomplishing this kind of task. In fact, it may be possible to set up the evaluation phase as a simple conversation between the user and what is essentially an LLM-based conversational agent. Conversational agents powered by LLMs are increasingly sophisticated tools that simulate human-like interactions and support a variety of applications, from language learning to mental well-being. LLMs are used in language learning, acting as virtual teachers or conversational partners to enhance vocabulary, pronunciation, and conversational skills [29]. For instance, fine-tuned LLMs demonstrated the ability to perceive and generate multimodal content, indicating a move towards models that can handle multiple modalities seamlessly [30]. LLMs have been used for conversational interaction with mobile UIs, allowing for language-based mobile interactions without the need for task-specific datasets and models [31]. Moreover, personality traits can be measured and shaped in LLM outputs, which is important for the effectiveness of communication in conversational agents [32]. Finally, in conversational recommender systems, LLMs can provide personalized recommendations and engage in multi-turn dialogues, despite challenges in understanding and controlling complex conversations [33]. To seek our goal, in this manuscript, we will discuss a way to achieve the human knowledge assessment inspired by the type of approach pursued in [32], where the authors used LLMs to conduct an assessment of a user's personal traits. They did this by instructing LLMs through a prompt engineering activity. Subsequently, they pinpointed basic components that specify the behavioral requirements for LLMs to fulfill the given task. In this position paper, we outline the primary components that a prompt should encompass for effective assessment:

• Task Description -Describes the type of analysis to be performed, for example, assessing the level of knowledge of a particular term, assessing the level of awareness of a particular cyber-attack, and so on. • Target Topic -Indicates the domain of terms, or aspects, on which the assessment is to be carried out. • Test Instruction -Summarizes the features of which the test is to be composed, particularly the manner in which it is to be administered, the number of questions to be asked, and the manner in which the result of the test administered is to be reported. In the following, we outline an example of a preliminary engineered prompt for assessing the user's knowledge about graphs as a visual metaphor for a specific task.

"Your task is to assess my ability to understand graphs as a medium to represent how packets are transferred between network providers. Ask questions that can become easier or harder according to how I answer each question. After 5 questions, output your decision about my knowledge level."

An initial analysis of the interaction process resulting from this prompt reveals the LLM's adeptness (in this specific case ChatGPT) in conducting evaluations by posing diverse questions to grasp the potential representations of nodes and arcs in depicting the exchange of network packets between providers.

Figure 1 provides an overview of the pipeline of components engaged in the proposed approach. Initially, the process starts with the assessment phase, wherein an interaction, whether voice or text-based, occurs between the user and the LLM-based Human Knowledge Assessment Module (1). Following the assessment phase, the generated report determining the user's level of knowledge and understanding is transmitted to the Tailoring Module (2), which adapts and refines the interface mechanism of the visual platform based on the insights derived from the report (3). Subsequently, the user gains access to a platform featuring visual elements and interfaces aligned with their comprehension level, fostering a more effective user experience (4). Additionally, we envision ongoing communication between the platform and the tailoring module during the user-platform interaction, enabling further interface modifications based on the user's interactions with the platform (5).

Conclusion

In conclusion, our proposal outlines a dynamic approach to assessing users' technical knowledge through an intermediary module that engages users in a conversational evaluation. By leveraging sophisticated language models, such as ChatGPT, this module can adaptively pose questions based on previous user responses, enabling a nuanced understanding of user capabilities beyond mere checklist assessments. This approach aims to enhance user experiences with visualization platforms by tailoring interface adaptations to individual skill levels, ensuring effective and user-friendly interactions. Through prompt engineering activities inspired by prior work in personality assessment, we advocate for thoughtful integration of language models into knowledge assessment processes, fostering more personalized and engaging user interactions in diverse applications.