Toward Personalized Deceptive Signaling for Cyber Defense Using Cognitive Models

Area of Science:

• Cybersecurity
• Cognitive Science
• Game Theory

Background:

• Current cybersecurity active defense strategies rely on game theory and deceptive signaling, assuming rational human behavior.
• Empirical evidence suggests human attackers deviate significantly from perfect rationality in simulated insider attack scenarios.

Purpose of the Study:

• To develop a cognitive model that accurately predicts human attacker behavior in cybersecurity games.
• To propose an adaptive signaling method for enhanced cybersecurity defenses based on real-time cognitive modeling.

Main Methods:

• An instance-based learning cognitive model was developed within the ACT-R framework.
• Human participants played an online game simulating insider attacks to gather behavioral data.
• The cognitive model was used to predict human performance and biases in the game.

Main Results:

• The instance-based learning model accurately predicted human attacker frequency, which was higher than predicted by rational models.
• Observed human behavior demonstrated significant deviations from perfect rationality in the simulated attack environment.
• The proposed adaptive signaling method leverages the cognitive model for real-time tracing of individual attacker experience.

Conclusions:

• Human behavior in cybersecurity contexts is not perfectly rational, necessitating more sophisticated predictive models.
• Adaptive signaling, informed by cognitive models, offers a pathway to personalized and more effective cybersecurity defenses.
• Understanding and modeling cognitive biases is crucial for improving the robustness of active defense strategies.