Cyber security: testing the effects of attack strategy, similarity, and experience on cyber attack detection. (1st January 2013)

• Record Type: Journal Article
• Authors: Dutt, Varun; Kaur, Amanjot
• Is Part Of: International journal on trust management in computing and communications. Volume 1:Number 3/4(2013)
• Page Start: 261
• Page End: 273
• Publication Date: 2013-01-01
• Subjects: cyber attacks -- instance-based learning theory -- IBLT -- security analyst -- similarity -- experience -- attack strategy -- accuracy -- timeliness -- cognitive modelling; Data protection -- Periodicals; Database management -- Periodicals; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.8
• Languages: English
• ISSNs: 2048-8378

Abstract

Cyber attacks, the disruption of normal functioning of computers in a network due to malicious events (threats), are becoming widespread and the role of security analysts is becoming important in protecting networks by accurately and timely detecting cyber attacks. In this paper, we investigate the role of two internal factors, similarity and experience, and an external factor, strategy of an attacker, to influence a simulated analyst's detection of cyber attacks. We use an existing cognitive model, based upon instance-based learning theory, which represents the decision-making process of a security analyst. We manipulate the attack strategy, experience, and similarity assumptions and evaluate their effects on model's accurate and timely detection of cyber attacks. Results revealed that although experience and strategy played a significant role in cyber attack detection; the role of similarity was much smaller. We highlight the implications of our findings for training human security analysts in their job.