Designing effective masking strategies for cyberdefense through human experimentation and cognitive models

Aggarwal, Palvi; Thakoor, Omkar; Jabbari, Shahin; Cranford, Edward A.; Lebière, Christian; Tambe, Milind; González, Cleotilde

doi:10.1016/j.cose.2022.102671

Cited by 10 publications

(4 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Cognitive models can help emulate the behavior of defenders, attackers, and users, allowing them to inform gametheoretic, Machine Learning, optimization algorithms, and other advanced technologies with predictions about human dynamic decision-making. This process has been demonstrated in recent work and provides great potential for the future of autonomous cyber defense (Aggarwal et al 2022) Simulation environments such as CybORG will need to be advanced and used in experimentation. We developed a research environment where IBL defense agents can perform a cyber defense task.…”

Section: Discussionmentioning

confidence: 97%

Turing-like Experiment in a Cyber Defense Game

Du,

Prebot,

Gonzalez

2024

AAAI-SS

View full text Add to dashboard Cite

During the past decade, researchers of behavioral cyber security have created cognitive agents that are able to learn and make decisions in dynamic environments in ways that assimilate human decision processes. However, many of these efforts have been limited to simple detection tasks and represent basic cognitive functions rather than a whole set of cognitive capabilities required in dynamic cyber defense scenarios. Our current work aims at advancing the development of cognitive agents that learn and make defense-dynamic decisions during cyber attacks by intelligent attack agents. We also aim to evaluate the capability of these cognitive models in ``Turing-like'' experiments, comparing the decisions and performance of these agents against human cyber defenders. In this paper, we present an initial demonstration of a cognitive model of the defender that relies on a cognitive theory of dynamic decision-making, Instance-Based Learning Theory (IBLT); we also demonstrate the execution of the same defense task by human defenders. We rely on OpenAI Gym and CybORG and adapt an existing CAGE scenario to generate a simulation experiment using an IBL defender. We also offer a new Interactive Defense Game (IDG), where \textit{human} defenders can perform the same CAGE scenario simulated with the IBL model. Our results suggest that the IBL model makes decisions against two intelligent attack agents that are similar to those observed in a subsequent human experiment. We conclude with a description of the cognitive foundations required to build autonomous intelligent cyber defense agents that can collaborate with humans in autonomous cyber defense teams.

show abstract

Section: Discussionmentioning

confidence: 97%

Turing-like Experiment in a Cyber Defense Game

Du,

Prebot,

Gonzalez

2024

AAAI-SS

View full text Add to dashboard Cite

show abstract

“…In this research we selected IBLT due to its theoretical connection to the ACT-R cognitive architecture and its wide and general applicability to a multitude of tasks. IBL models have demonstrated fidelity to human decision making processes and have demonstrated their efficacy in various domains, including repeated binary choice tasks (Gonzalez and Dutt, 2011;Lejarraga et al, 2012), sequential decision-making (Bugbee and Gonzalez, 2022), theory of mind applications (Nguyen and Gonzalez, 2022), and practical applications such as identifying phishing emails (Cranford et al, 2019), cyber defense (Cranford et al, 2020), and cyber attack decision-making (Aggarwal et al, 2022).…”

Section: Related Work Cognitive Architectures and Instance-based Lea...mentioning

confidence: 99%

Applying Generative Artificial Intelligence to cognitive models of decision making

Malloy,

Gonzalez

2024

Front. Psychol.

Self Cite

View full text Add to dashboard Cite

IntroductionGenerative Artificial Intelligence has made significant impacts in many fields, including computational cognitive modeling of decision making, although these applications have not yet been theoretically related to each other. This work introduces a categorization of applications of Generative Artificial Intelligence to cognitive models of decision making.MethodsThis categorization is used to compare the existing literature and to provide insight into the design of an ablation study to evaluate our proposed model in three experimental paradigms. These experiments used for model comparison involve modeling human learning and decision making based on both visual information and natural language, in tasks that vary in realism and complexity. This comparison of applications takes as its basis Instance-Based Learning Theory, a theory of experiential decision making from which many models have emerged and been applied to a variety of domains and applications.ResultsThe best performing model from the ablation we performed used a generative model to both create memory representations as well as predict participant actions. The results of this comparison demonstrates the importance of generative models in both forming memories and predicting actions in decision-modeling research.DiscussionIn this work, we present a model that integrates generative and cognitive models, using a variety of stimuli, applications, and training methods. These results can provide guidelines for cognitive modelers and decision making researchers interested in integrating Generative AI into their methods.

show abstract

Section: Introductionmentioning

confidence: 99%

“…Such testbeds are suitable for testing network security solutions and designs. They have also been used to conduct studies with skilled participants to understand how attackers choose nodes in a network to attack (Aggarwal et al, 2022). However, conducting experiments on such testbeds requires a team of engineers to manage the services and scenarios.…”

Section: Introductionmentioning

confidence: 99%

SpearSim-V₂: Synthetic Task Environment for Evaluating Attacker Behaviors

Mehrabi,

Xu,

Rajivan

2023

Proceedings of the Human Factors and Ergonomics Society Annual

View full text Add to dashboard Cite

Despite extensive research on phishing, a severe lack of work centered on attackers has resulted in a limited understanding of the adversarial behaviors conducive to attack success and failures. This work describes a novel method for conducting controlled laboratory studies of cognitive vulnerabilities that attackers experience during the design and execution phases of spear-phishing attacks. Based on the SpearSim platform, the new simulation environment integrates cognitive agents that model and predict end-user responses to spear-phishing attacks. This advancement to SpearSim allows the generation of real-time, automated, “human-like” responses to simulated spear-phishing attacks. This enables the execution of experiments focused on attackers and attacker behaviors. We describe the proposed simulation framework, provide details about the implemented simulation environment, and present results to evaluate the performance of the simulation environment. Compared to the earlier version of SpearSim involving human end-users, the new approach generates responses at a much faster rate (3 times faster than human end-users) and importantly with less variance in the time to respond. The cognitive agents used in the simulation predicted human responses to phishing and spear-phishing attackers with moderate accuracy (about 60%). Our proposed method intends to provide an effective and robust way to conduct laboratory experiments on spear-phishing attacks and further understand attackers' decision-making processes that could be exploited to thwart future attacks.

show abstract

Designing effective masking strategies for cyberdefense through human experimentation and cognitive models

Cited by 10 publications

References 19 publications

Turing-like Experiment in a Cyber Defense Game

Turing-like Experiment in a Cyber Defense Game

Applying Generative Artificial Intelligence to cognitive models of decision making

SpearSim-V₂: Synthetic Task Environment for Evaluating Attacker Behaviors

Contact Info

Product

Resources

About

Designing effective masking strategies for cyberdefense through human experimentation and cognitive models

Cited by 10 publications

References 19 publications

Turing-like Experiment in a Cyber Defense Game

Turing-like Experiment in a Cyber Defense Game

Applying Generative Artificial Intelligence to cognitive models of decision making

SpearSim-V2: Synthetic Task Environment for Evaluating Attacker Behaviors

Contact Info

Product

Resources

About

SpearSim-V₂: Synthetic Task Environment for Evaluating Attacker Behaviors