Towards a Cognitive Theory of Cyber Deception

Area of Science:

• Cognitive Psychology
• Cybersecurity
• Behavioral Economics

Background:

• Traditional deception research focuses on physical cues, neglecting the cyber domain.
• Cybersecurity defense algorithms often assume rational adversaries, overlooking human bounded rationality.
• Effective cyber defense requires understanding human decision-making under deception.

Purpose of the Study:

• To develop a cognitive theory of cyber deception.
• To investigate human decision-making against cyber defense algorithms using deceptive signaling.
• To model human attackers using the Adaptive Control of Thought-Rational (ACT-R) cognitive architecture.

Main Methods:

• Behavioral experiments using an abstract cybersecurity game (Insider Attack Game).
• Development of an instance-based learning (IBL) model within the ACT-R cognitive architecture.
• Comparison of defense algorithm effectiveness with and without deceptive signaling.

Main Results:

• Deceptive signaling significantly improves defense algorithm effectiveness in reducing attack probability and protecting assets.
• The defense algorithm is less effective against human adversaries than predicted for perfectly rational ones.
• The IBL model accurately replicates human attack decisions and demonstrates how experience and memory retrieval lead to cognitive biases like confirmation bias.

Conclusions:

• Deceptive signaling is a valuable tool for enhancing cyber defense, but its effectiveness is moderated by human bounded rationality.
• The IBL model provides insights into the cognitive mechanisms underlying human deception in cyber scenarios.
• Findings inform the development of more effective cybersecurity strategies and cognitive theories of deception.