Simulations in Cyber-Security: A Review of Cognitive Modeling of Network Attackers, Defenders, and Users

• Published in: Frontiers in psychology Vol. 9; p. 691
• Main Authors: Veksler, Vladislav D., Buchler, Norbou, Hoffman, Blaine E., Cassenti, Daniel N., Sample, Char, Sugrim, Shridat
• Format: Journal Article
• Language: English
• Published: Switzerland Frontiers Media S.A 15.05.2018
• Subjects: behavioral simulations; cognitive modeling; cyber-security; human factors; model tracing; network simulations; Psychology; behavioral simulations; cognitive modeling; human factors; embedded cognition; network simulations; cyber-security; training effectiveness; model tracing
• ISSN: 1664-1078; 1664-1078
• DOI: 10.3389/fpsyg.2018.00691

Computational models of cognitive processes may be employed in cyber-security tools, experiments, and simulations to address human agency and effective decision-making in keeping computational networks secure. Cognitive modeling can addresses multi-disciplinary cyber-security challenges requiring cross-cutting approaches over the human and computational sciences such as the following: (a) adversarial reasoning and behavioral game theory to predict attacker subjective utilities and decision likelihood distributions, (b) human factors of cyber tools to address human system integration challenges, estimation of defender cognitive states, and opportunities for automation, (c) dynamic simulations involving attacker, defender, and user models to enhance studies of cyber epidemiology and cyber hygiene, and (d) training effectiveness research and training scenarios to address human cyber-security performance, maturation of cyber-security skill sets, and effective decision-making. Models may be initially constructed at the group-level based on mean tendencies of each subject's subgroup, based on known statistics such as specific skill proficiencies, demographic characteristics, and cultural factors. For more precise and accurate predictions, cognitive models may be fine-tuned to each individual attacker, defender, or user profile, and updated over time (based on recorded behavior) via techniques such as model tracing and dynamic parameter fitting.