title: Cyber situation awareness: modeling detection of cyber attacks with instance-based learning theory.
abstract: OBJECTIVE
  To determine the effects of an adversary's behavior on the defender's accurate and timely detection of network threats.
  
  
  BACKGROUND
  Cyber attacks cause major work disruption. It is important to understand how a defender's behavior (experience and tolerance to threats), as well as adversarial behavior (attack strategy), might impact the detection of threats. In this article, we use cognitive modeling to make predictions regarding these factors.
  
  
  METHODS
  Different model types representing a defender, based on Instance-Based Learning Theory (IBLT), faced different adversarial behaviors. A defender's model was defined by experience of threats: threat-prone (90% threats and 10% nonthreats) and nonthreat-prone (10% threats and 90% nonthreats); and different tolerance levels to threats: risk-averse (model declares a cyber attack after perceiving one threat out of eight total) and risk-seeking (model declares a cyber attack after perceiving seven threats out of eight total). Adversarial behavior is simulated by considering different attack strategies: patient (threats occur late) and impatient (threats occur early).
  
  
  RESULTS
  For an impatient strategy, risk-averse models with threat-prone experiences show improved detection compared with risk-seeking models with nonthreat-prone experiences; however, the same is not true for a patient strategy.
  
  
  CONCLUSIONS
  Based upon model predictions, a defender's prior threat experiences and his or her tolerance to threats are likely to predict detection accuracy; but considering the nature of adversarial behavior is also important.
  
  
  CONCLUSIONS
  Decision-support tools that consider the role of a defender's experience and tolerance to threats along with the nature of adversarial behavior are likely to improve a defender's overall threat detection.
authors.affiliation: School of Computing and Electrical Engineering, School of Humanities and Social Sciences, Indian Institute of Technology, Mandi, PWD Rest House 2nd Floor, Mandi - 175 001, H.P., India. varun@iitmandi.ac.in
authors.forename: Varun
authors.initials: V
authors.lastname: Dutt
authors.forename: Young-Suk
authors.initials: YS
authors.lastname: Ahn
authors.forename: Cleotilde
authors.initials: C
authors.lastname: Gonzalez
mesh_terms: D001364:Awareness; D016494:Computer Security; D003198:Computer Simulation; D003657:Decision Making; D006801:Humans; D007858:Learning; D008960:Models, Psychological; D018570:Risk Assessment