Security under Uncertainty: Adaptive Attackers Are More Challenging to Human Defenders than Random Attackers

Moisan, Frédéric; González, Cleotilde

doi:10.3389/fpsyg.2017.00982

Cited by 15 publications

(10 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…A useful framework for studying decision‐making under deception is with economic signaling games (Jenkins, Zhu, & Hsu, 2016; Moisan & Gonzalez, 2017). Signaling games are two‐player games involving a sender and a receiver with incomplete information (Pawlick, Colbert, & Zhu, 2019).…”

Section: Introductionmentioning

confidence: 99%

Towards a Cognitive Theory of Cyber Deception

et al. 2021

Self Cite

View full text Add to dashboard Cite

This work is an initial step toward developing a cognitive theory of cyber deception. While widely studied, the psychology of deception has largely focused on physical cues of deception. Given that present-day communication among humans is largely electronic, we focus on the cyber domain where physical cues are unavailable and for which there is less psychological research. To improve cyber defense, researchers have used signaling theory to extended algorithms developed for the optimal allocation of limited defense resources by using deceptive signals to trick the human mind. However, the algorithms are designed to protect against adversaries that make perfectly rational decisions. In behavioral experiments using an abstract cybersecurity game (i.e., Insider Attack Game), we examined human decision-making when paired against the defense algorithm. We developed an instance-based learning (IBL) model of an attacker using the Adaptive Control of Thought-Rational (ACT-R) cognitive architecture to investigate how humans make decisions under deception in cyber-attack scenarios. Our results show that the defense algorithm is more effective at reducing the probability of attack and protecting assets when using deceptive signaling, compared to no signaling, but is less effective than predicted against a perfectly rational adversary. Also, the IBL model replicates human attack decisions accurately. The IBL model shows how human decisions arise from experience, and how memory retrieval dynamics can give rise to cognitive biases, such as confirmation bias. The implications of these findings are discussed in the perspective of informing theories of deception and designing more effective signaling schemes that consider human bounded rationality.

show abstract

Section: Introductionmentioning

confidence: 99%

Towards a Cognitive Theory of Cyber Deception

et al. 2021

Self Cite

View full text Add to dashboard Cite

show abstract

“…This is because a random agent was less likely to turn back to the original location given a nonvisible swap event, and the IBL observer "thought" that the random agent saw the swap event. This is an interesting and unexpected result given situations in which random agents could be used to deceive humans (Moisan & Gonzalez, 2017).…”

Section: Discussionmentioning

confidence: 90%

Theory of Mind From Observation in Cognitive Models and Humans

Nguyen

González

2021

Topics in Cognitive Science

View full text Add to dashboard Cite

A major challenge for research in artificial intelligence is to develop systems that can infer the goals, beliefs, and intentions of others (i.e., systems that have theory of mind, ToM). In this research, we propose a cognitive ToM framework that uses a well-known theory of decisions from experience to construct a computational representation of ToM. Instance-based learning theory (IBLT) is used to construct a cognitive model that generates ToM from the observation of other agents' behavior. The IBL model of the observer distinguishes itself from previous models of ToM that make unreasonable assumptions about human cognition, are hand-crafted for particular settings, complex, or unable to explain a cognitive development of ToM compared to human's ToM. The IBL model learns from the observation of goal-directed agents' behavior in a gridworld navigation task, and it infers and predicts the behaviors of the agents in new gridworlds across different degrees of decision complexity in similar ways to the way human observers do. We provide evidence for the alignment of the IBL observer's predictions under various levels of decision complexity. We also advance the demonstration of the IBL predictions using a classic test of false beliefs (the Sally-Anne test), which is commonly used to test ToM in humans. We discuss our results and the potential of the IBL observer model to improve human-machine interactions.

show abstract

“…Moisan and Gonzalez found that game theoretical algorithms miss out on advantages provided by knowledge of the threat actorsâĂŹ cognition [21]. These game theoretical solutions assume an idealized decision making on the part of the threat actors, and therefore have limited adaptability against them.…”

Section: Customized Deceptionmentioning

confidence: 99%

Physics-Driven Page Fault Handling for Customized Deception against CPS Malware

Rrushi

2022

ACM Trans. Embed. Comput. Syst.

View full text Add to dashboard Cite

Malware crafted to attack cyber-physical systems (CPS) such as the electrical power grid have a physics-centric nucleus. CPS malware understand physics, and hence use their knowledge to guide how they initiate physical damage on a compromised industrial computer. We develop a physics-driven page fault handler in the seL4 microkernel, which, in addition to reducing the page fault rate, differentiates active physics in main memory from passive physics in the backing store. We aid the identification of active physics via a CPU scheduler that tracks the evolution of active physics over time. We exploit the concept of active physics to develop deception that is customized to attack the physics-centric nucleus of malware. We evaluated this research against a variety of malware samples and techniques, including both numerous samples from publicly available repositories and custom-made academic code, and present our findings in the paper. The physics data of reference pertain to an electrical substation, with a higher focus on a power transformer and related industrial computer algorithms.

show abstract

Security under Uncertainty: Adaptive Attackers Are More Challenging to Human Defenders than Random Attackers

Cited by 15 publications

References 31 publications

Towards a Cognitive Theory of Cyber Deception

Towards a Cognitive Theory of Cyber Deception

Theory of Mind From Observation in Cognitive Models and Humans

Physics-Driven Page Fault Handling for Customized Deception against CPS Malware

Contact Info

Product

Resources

About