Title: Cyber security: testing the effects of attack strategy, similarity, and experience on cyber attack detection
Authors: Varun Dutt; Amanjot Kaur
Addresses: School of Computing and Electrical Engineering and School of Humanities and Social Sciences, Indian Institute of Technology, Mandi, PWD Rest House 2nd Floor, Mandi – 175 001, H.P., India ' School of Computing and Electrical Engineering, Indian Institute of Technology, Mandi, PWD Rest House 2nd Floor, Mandi – 175 001, H.P., India
Abstract: Cyber attacks, the disruption of normal functioning of computers in a network due to malicious events (threats), are becoming widespread and the role of security analysts is becoming important in protecting networks by accurately and timely detecting cyber attacks. In this paper, we investigate the role of two internal factors, similarity and experience, and an external factor, strategy of an attacker, to influence a simulated analyst's detection of cyber attacks. We use an existing cognitive model, based upon instance-based learning theory, which represents the decision-making process of a security analyst. We manipulate the attack strategy, experience, and similarity assumptions and evaluate their effects on model's accurate and timely detection of cyber attacks. Results revealed that although experience and strategy played a significant role in cyber attack detection; the role of similarity was much smaller. We highlight the implications of our findings for training human security analysts in their job.
Keywords: cyber attacks; instance-based learning theory; IBLT; security analysts; similarity; experience; attack strategy; accuracy; timeliness; cognitive modelling; cyber security; cyber attack detection; network security; cognitive modelling; analyst training.
International Journal of Trust Management in Computing and Communications, 2013 Vol.1 No.3/4, pp.261 - 273
Received: 07 Dec 2012
Accepted: 08 Jan 2013
Published online: 16 Sep 2013 *