A human-in-the-loop approach to understanding situation awareness in cyber defence analysis

Abstract

In this paper we argue for a human-in-the-loop approach to the study of situation awareness in computer defence analysis (CDA). The cognitive phenomenon of situation awareness (SA) has received significant attention in cybersecurity/CDA research. Yet little of this work has attended to the cognitive aspects of situation awareness in the CDA context; instead, the human operator has been treated as an abstraction within the larger human-technology system. A more human-centric approach that seeks to understand the socio-cognitive work of human operators as they perform CDA will yield greater insights into the design of tools and interfaces for CDA. As support for this argument, we present our own work employing the Living Lab Framework through which we ground our experimental findings in contextual knowledge of real-world practice.

The Role of User Behaviour in Improving Cyber Security Management

“…Similar findings were also found by Brustoloni and Villamarín-Salomón (2007). Responding to novel and anomalous activities are aspects of situational awareness, and key for detecting phishing attempts in a cyber or network systems (D'Amico et al, 2005;Barford, 2010;Dutt et al, 2013;Knott et al, 2013;Tyworth et al, 2013;Mancuso et al, 2014;Aggarwal et al, 2018;Veksler et al, 2018). Software engineers should develop attention-capturing security warnings and not standard message dialogs, and these also should change over time in order to increase alertness and attention in computer system users.…”

“…Most of the research on cybersecurity has focused on improving computer network systems (Nobles, 2018), as many believe that information technology advances and software development is the main way to increase information security (Sadkhan, 2019;Benson and Mcalaney, 2020). Fewer studies have been conducted on enhancing cognitive capabilities and situational awareness of system analysts (D'Amico et al, 2005;Barford, 2010;Dutt et al, 2013;Knott et al, 2013;Tyworth et al, 2013;Mancuso et al, 2014;Gutzwiller et al, 2015;Aggarwal et al, 2018;Veksler et al, 2018).…”

User, Usage and Usability: Redefining Human Centric Cyber Security

“… Dourish et al (2004) argue that security solutions should consider specific interactions factors that could improve human’s using of computers ( Figure 4 ). Both Haack et al (2009) and Tyworth et al (2013) make a case for mixed-initiative cyber security where the focus is put on humans-in-the-loop, i.e., the human ( Section 3 ) and the cyber system ( Section 4 ) working together toward usability. This humans-in-the-loop concept is more commonly referred to as orchestration, where the aim is to make all levels of user feel comfortable to interact with the system.…”

Capturing Performance in Cyber Human Supervisory Control

“…Cyber operations exist within a complex system of humanmachine interaction, where operators are tasked with monitoring the activities, efficacy, and progress of intelligent and autonomous computer systems (Tyworth et al, 2013). In these environments, cyber operators supervise intelligent systems as they execute tasks across networks.…”

“…Current research has focused on identifying important dimensions of cognition within cyber operations, such as situation awareness (Giacobe, 2012), team knowledge structures (Mancuso & McNeese, 2012), and team collaboration (Rajivan et al, 2013). However, little research has focused explicitly on specific issues related to task load and operations management -classic Human Factors research vectors.Cyber operations exist within a complex system of humanmachine interaction, where operators are tasked with monitoring the activities, efficacy, and progress of intelligent and autonomous computer systems (Tyworth et al, 2013). In these environments, cyber operators supervise intelligent systems as they execute tasks across networks.…”