Simulations in Cyber-Security: A Review of Cognitive Modeling of Network Attackers, Defenders, and Users

Abstract

Computational models of cognitive processes may be employed in cyber-security tools, experiments, and simulations to address human agency and effective decision-making in keeping computational networks secure. Cognitive modeling can addresses multi-disciplinary cyber-security challenges requiring cross-cutting approaches over the human and computational sciences such as the following: (a) adversarial reasoning and behavioral game theory to predict attacker subjective utilities and decision likelihood distributions, (b) human factors of cyber tools to address human system integration challenges, estimation of defender cognitive states, and opportunities for automation, (c) dynamic simulations involving attacker, defender, and user models to enhance studies of cyber epidemiology and cyber hygiene, and (d) training effectiveness research and training scenarios to address human cyber-security performance, maturation of cyber-security skill sets, and effective decision-making. Models may be initially constructed at the group-level based on mean tendencies of each subject's subgroup, based on known statistics such as specific skill proficiencies, demographic characteristics, and cultural factors. For more precise and accurate predictions, cognitive models may be fine-tuned to each individual attacker, defender, or user profile, and updated over time (based on recorded behavior) via techniques such as model tracing and dynamic parameter fitting.

A Socio-technical Systems Approach to Design and Support Systems Thinking in Cybersecurity and Risk Management Education

“…This requires cybersecurity decision makers to gain more knowledge about adversarial thinking, system thinking, and risk quantification. Modeling and simulation of real-world cyber-attacks is a useful training tool for the purpose of fulfilling these requirements [15].…”

The Application of Epidemiology for Categorising DNS Cyber Risk Factors

“…The closest form of truly comprehensive aggregate risk factor analysis can be seen in research on cognitive modelling of "dynamic simulations involving attacker, defender, and user models to enhance studies of cyber epidemiology and cyber hygiene" [30]. The researchers contend the importance of "wargaming" and simulation in both health care and cybersecurity, highlighting that "just as simulations in healthcare predict how an epidemic can spread and how it can be contained, such simulations may be used in the field of cyber-security as a means of progress in the study of cyber-epidemiology" [30]. The authors argue that epidemiology can be applied for the simulation of pandemic or disease outbreak, though prediction models based on existing behavioural data of threats.…”

“…The authors argue that epidemiology can be applied for the simulation of pandemic or disease outbreak, though prediction models based on existing behavioural data of threats. These simulations provide "realistic synthetic users for full-scale training/wargame scenarios", which will "enable much-needed research in cybersecurity and cyber-epidemiology" [30]. Such simulations need to include methods to inject non-deterministic behaviours [31].…”

Development of methodology for modeling the interaction of antagonistic agents in cybersecurity systems

“…Modeling the behavior of users and defenders can be used to assess their cognitive states in real time. Models of learning and adapting the behavior of cyber conflict participants can be used in combination with the theory of behavioral games to predict possible attack scenarios and select the best defenses [3,4]. Modeling user network activity allows testing various network policies without real consequences.…”