Decision-Making Biases and Cyber Attackers

Johnson, Chelsea K.; Gutzwiller, Robert S.; Gervais, Joseph; Ferguson-Walter, Kimberly

doi:10.1109/asew52652.2021.00038

Cited by 10 publications

(12 citation statements)

References 42 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…While decision-making is a promising way of disrupting attackers, interactions with machines are by no means the only place CB may be present. The choices of confirmation bias and framing effects in general limited our examination of biases in decision-making, despite the existence of other cyber-relevant biases at large (Johnson et al, 2020; Johnson et al, 2022).…”

Section: Discussionmentioning

confidence: 99%

“…There is some limited conceptual evidence that several biases affect attackers (Johnson et al, 2021). For example, notionally, attackers are often loss averse when it comes to using zero-day attacks.…”

Section: Introductionmentioning

confidence: 99%

“…The goal was to show evidence that attackers commit decision-making biases, to learn about the surrounding conditions, and to learn how to measure biased behaviors. Previously, a list of 89 biases was surveyed (Johnson et al, 2020). The team of Subject Matter Experts (SMEs) reviewing biases for investigation consisted of cognitive psychologists (RSG, HR, and CJ) and cybersecurity professionals (KFW and MM).…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Exploratory Analysis of Decision-Making Biases of Professional Red Teamers in a Cyber-Attack Dataset

Gutzwiller,

Rheem,

Ferguson-Walter

et al. 2023

Journal of Cognitive Engineering and Decision Making

Self Cite

View full text Add to dashboard Cite

Attacker psychology is currently under-examined in cybersecurity research. A prior, large-scale study sought to understand attackers’ behavior by testing both technological and psychological deception. Professional “red team” members participated over two days in various conditions. This data was examined for further evidence that cognitive biases, a potential disruption for attackers, may be present, and may be affecting the outcome. An applied, novel methodology for measuring confirmation bias and framing effects is presented using this realistic dataset. Both confirmation bias and the framing effect occurred in this interpretation. The framing effect appears to have reduced attacker interactions with systems in the network, which may benefit cyber defenders. These results provide additional, exploratory evidence that biases in the decision-making of cyber attackers could be used as part of a defensive cyber strategy. Limitations to the approach and directions for future study of attackers are discussed.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Exploratory Analysis of Decision-Making Biases of Professional Red Teamers in a Cyber-Attack Dataset

Gutzwiller,

Rheem,

Ferguson-Walter

et al. 2023

Journal of Cognitive Engineering and Decision Making

Self Cite

View full text Add to dashboard Cite

show abstract

“…Some researchers have pointed out that traditional CTF events were not designed for measuring human performance and that controlled red team experiments can be advantageous [6]. For example, Johnson et al used lab-based experiments to study deception and decision making [9]. Our work seeks to overcome some of these limitations by creating new data collection and analysis of human behavior that would work equally well in controlled experiments.…”

Section: Related Workmentioning

confidence: 99%

Battle Ground: Data Collection and Labeling of CTF Games to Understand Human Cyber Operators

Savin,

Asseri,

Dykstra

et al. 2023

2023 Cyber Security Experimentation and Test Workshop

View full text Add to dashboard Cite

Industry standard frameworks are now widespread for labeling the high-level stages and granular actions of attacker and defender behavior in cyberspace. While these labels are used for atomic actions, and to some extent for sequences of actions, there remains a need for labeled data from realistic full-scale attacks. This data is valuable for better understanding human actors' decisions, behaviors, and individual attributes. The analysis could lead to more effective attribution and disruption of attackers.We present a methodological approach and exploratory case study for systematically analyzing human behavior during a cyber offense/defense capture-the-flag (CTF) game. We describe the data collection and analysis to derive a metric called keystroke accuracy. After collecting players' commands, we label them using the MITRE ATT&CK framework using a new tool called Pathfinder. We present results from preliminary analysis of participants' keystroke accuracy and its relation to score outcome in CTF games. We describe frequency of action classification within the MITRE ATT&CK framework and discuss some of the mathematical trends suggested by our observations. We conclude with a discussion of extensions for the methodology, including performance evaluation during games and the potential use of this methodology for training artificial intelligence. CCS CONCEPTS• Security and privacy → Network security; Human and societal aspects of security and privacy.

show abstract

“…This is potentially far more scalable than any technological implementation, as making use of common human limitations assumes only that the attacker is human. Biasing behavior is a useful tool toward detecting and mitigating attackers (Johnson et al, 2021).…”

Section: Introductionmentioning

confidence: 99%

Frustration, Confusion, Surprise, Confidence, And Self-Doubt: Cyber Operators’ Affects During A Realistic Experiment

Gutzwiller,

Gilbert,

Drescher

et al. 2023

Proceedings of the Human Factors and Ergonomics Society Annual

Self Cite

View full text Add to dashboard Cite

In this paper we examine data from a complex two-day experiment with professional cyber red teamers to determine what creates, or contributes, to affective states that may further disrupt attackers. Participants rated their frustration, surprise, confidence, self-doubt, and confusion at the end of each day, and these responses were scored on a Likert scale and using Thematic analysis. We found several elements strongly contributed to the frequency and severity of these affective states, supporting our initial hypothesis, and further that (1) experiencing a Lack of Progress impacted four of the five states with moderate severity, and (2) interacting with elements in the environment that Deviated from what was expected was associated strongly with surprise. Implications for cyber defense and limitations of the method are discussed.

show abstract

Decision-Making Biases and Cyber Attackers

Cited by 10 publications

References 42 publications

Exploratory Analysis of Decision-Making Biases of Professional Red Teamers in a Cyber-Attack Dataset

Exploratory Analysis of Decision-Making Biases of Professional Red Teamers in a Cyber-Attack Dataset

Battle Ground: Data Collection and Labeling of CTF Games to Understand Human Cyber Operators

Frustration, Confusion, Surprise, Confidence, And Self-Doubt: Cyber Operators’ Affects During A Realistic Experiment

Contact Info

Product

Resources

About