A task analysis toward characterizing cyber-cognitive situation awareness (CCSA) in cyber defense analysts

Abstract

Cyberspace is an increasingly crucial part of everyday living. We have long recognized that defending this space is complex, requiring information integration, and decisions of man and machine to coalesce in a dynamic environment full of shifting priorities. These properties suggest that, as in other domains with similar characteristics, situation awareness (SA) of a human cyber defender is paramount to the quality of decision outcomes in cyber defense. The majority of existing research in cyber situation awareness, centers on information systems and computers, which piece together disparate data. Fused data from multiple sources, for example, is necessary for cyberspace visualization efforts. The judgment for successful cyber SA from this perspective is different from one that is human-centered. In comparison, we rarely assess human cognitive awareness in cyberspace. In part, this reflects a need, based on prior theory, to first define critical elements of information that the human must perceive, work to elucidate how humans combine these elements to comprehend the state of the network, and how together, this awareness helps analysts predict the future state of the network. In other words, although data fusion can provide value by reducing the cognitive load created to piece together disparate sources of information, human awareness of the network (cyber-cognitive situation awareness-CCSA) is perhaps the ultimate intermediary for defense performance. Toward such an understanding, we discuss the results of a cognitive task analysis (CTA) which sought to determine the goals and abstracted elements of awareness that cyber analysts seek in network defense. We present the foundation for a series of planned experiments that establishes CCSA measurement, and baselines the efforts of cyber defenders. Once assessed, we can then begin to consider the help offered by fusion systems, automation of defensive capabilities, and cyber visualizations in a methodologically rigorous manner that has been lacking.

Development of the intelligent decision-making support system to manage cyber protection at the object of informatization

“…Therefore, given the potential of application of DSS in IPCS, which implement preventive strategy of OBI cyberprotection [18,19], it appears a relevant problem to develop the methods, models and applied SW applicable to the practical implementation in IDMSS. In particular, these studies are topical in the area of intelligent decision-making support for planning the rational structure of IPS, assessment and prediction of risk of violating the IS and CS, as well as management of IP under conditions of uncertainty in the potential impacts from cybercriminals.…”

“…The task on choosing the rational structure of CIPM for OBI is carried out according to the following criteria [22,23]: minimal probability of the intruder accomplishing all goals; minimum of average level of losses at OBI from the intruder accomplishing all goals; maximum probability of success in the counteraction by CIPM of the intruder accomplishing all goals; minimum value of the integral indicator "cost -risk". For the proposed architecture of IPCS, we used the model of optimization of structural-technological resource (STR) for mission-critical IM and OBI infrastructure components by the criterion of minimum probability of failure to solve the task [18,22].…”

Development of a support system for managing the cyber protection of an information object

“…It was mentioned in the works [14,15] that ISMS, in which intelligent technologies of cyberthreat identification and reacting to occurrences of IS breaches are realized, are products of private companies, and that a customer in general doesn't have any information about methods and models of leading effects forming in systems [16]. In the works [17,18] all the disadvantages of many DSS and ES systems in the field of IS are shown: lack of highly qualified experts; difficulties that appear in the process of ISMS methods and models adapting to the needs of any particular organization; impossibility of certain ISMS efficiency assessing protection; and demanding true statistics of IS and CS incidents.…”

“…On the opinion of some authors [12][13][14][17][18][19][20], existing standards in the field of IS management don't form effective methods of cyber-security management.…”

“…For solving a task in conditions of uncertainty, inconsistency and lack of knowledge about the information environment status under attack, mechanisms of fuzzy inference are activated in IDSS because of the fact that the MO system has some time limits for processing and analysing command information. Incoming information for a fuzzy inference module is the quantity and information value of unusual system events [16,18,21]. Information that is formed getting out of a fuzzy inference system corresponds to an outcome variable which is the probability of the fact that a group of unusual events in a network is an attack.…”