Behavioral Determinants of Target Shifting and Deterrence in an Analog Cyber-Attack Game

Area of Science:

• Cybersecurity
• Behavioral Economics
• Decision Science

Background:

• Defensive resource allocation is crucial for security.
• Understanding attacker decision-making, including cognitive biases, is key to optimizing defenses.
• Previous research has not fully explored how probability judgment biases influence attacker choices in layered defense scenarios.

Purpose of the Study:

• To investigate how exploiting attacker biases in probability judgment can enhance deterrence with fixed defensive resources.
• To examine attacker anchoring heuristics for conjunctive events with missing information.
• To distort attacker estimates of success for targets with equal defensive resources.

Main Methods:

• A behavioral experiment simulating a cyber attack with multiple targets and three attack stages.
• Four target types with varying defensive resource allocations and success probabilities.
• A payoff system incentivizing successful attacks and penalizing failures, with 1,600 target selections from 80 players.

Main Results:

• The target type with the lowest success probability in the first layer was least preferred by attackers, showing the greatest deterrent effect.
• Targets with equally distributed success probabilities across layers were less preferred than those with concentrated inner-layer defenses.
• Findings align with attacker anchoring and ambiguity biases, and the interpretation of failed attacks as near misses.

Conclusions:

• Layered defenses are most effective when the initial stage presents the highest barrier to attackers.
• Uniformly distributed defenses offer greater deterrence than those concentrated in later stages.
• Exploiting cognitive biases in probability judgment is a viable strategy for enhancing deterrence in cybersecurity.