ThreatVectors: contextual workflows and visualizations for rapid cyber event triage

Miserendino, Scott; Maynard, Corey; Davis, Jacob

doi:10.1109/cyberincident.2017.8054637

Cited by 3 publications

(1 citation statement)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, few works have focused on mitigation strategies for innate vulnerabilities. Visual support systems have been used for rapid cyber event triage [27] and alert investigations [28], and eye-tracking data have been incorporated to enhance attention for phishing identification [29]. The authors in [30] perform an anthropological study in a corporate SOC to model and mitigate security analyst burnout.…”

Section: B Feint Attacks and Human Attentional Modelsmentioning

confidence: 99%

RADAMS: Resilient and Adaptive Alert and Attention Management Strategy against Informational Denial-of-Service (IDoS) Attacks

Huang,

Zhu

2021

Preprint

View full text Add to dashboard Cite

Attacks exploiting human attentional vulnerability have posed severe threats to cybersecurity. In this work, we identify and formally define a new type of proactive attentional attacks called Informational Denial-of-Service (IDoS) attacks that generate a large volume of feint attacks to overload human operators and hide real attacks among feints. We incorporate human factors (e.g., levels of expertise, stress, and efficiency) and empirical results (e.g., the Yerkes-Dodson law and the sunk cost fallacy) to model the operators' attention dynamics and their decision-making processes along with the real-time alert monitoring and inspection. To assist human operators in timely and accurately dismissing the feints and escalating the real attacks, we develop a Resilient and Adaptive Data-driven alert and Attention Management Strategy (RADAMS) that deemphasizes alerts selectively based on the alerts' observable features. RADAMS uses reinforcement learning to achieve a customized and transferable design for various human operators and evolving IDoS attacks. The integrated modeling and theoretical analysis lead to the Product Principle of Attention (PPoA), fundamental limits, and the tradeoff among crucial human and economic factors. Experimental results corroborate that the proposed strategy outperforms the default strategy and can reduce the IDoS risk by as much as 20%. Besides, the strategy is resilient to large variations of costs, attack frequencies, and human attention capacities. We have recognized interesting phenomena such as attentional risk equivalency, attacker's dilemma, and the half-truth optimal attack strategy.

show abstract

Section: B Feint Attacks and Human Attentional Modelsmentioning

confidence: 99%