Proceedings of the Human Factors and Ergonomics Society Annual Meeting
Ben-Asher and Meyer (2018) developed a model of risk-related behavior in computer systems, named ... more Ben-Asher and Meyer (2018) developed a model of risk-related behavior in computer systems, named the Triad of Risk-related Behavior (TriRB). It identified three behaviors – the exposure to risk, the use of security features and the responses to security indications. Various factors affected the three behaviors differently. We report an experiment with 83 participants who performed the Tetris-game like task, designed for studying the TriRB. We also collected data on four measures of individual differences in risk-taking (BART, DOSPERT and questionnaires on assessing risk aversion in the utility functions). We computed the correlations between the behaviors in the TriRB and the risk measures. Different risk measures were correlated with the three behaviors, supporting the notion that these are indeed three different risk-related behaviors and not expressions of a general underlying tendency to take risks. We discuss some implications of these findings for cybersecurity research and pr...
Reactive defense mechanisms, such as intrusion detection systems, have made significant efforts t... more Reactive defense mechanisms, such as intrusion detection systems, have made significant efforts to secure a system or network for the last several decades. However, the nature of reactive security mechanisms has limitations because potential attackers cannot be prevented in advance. We are facing a reality with the proliferation of persistent, advanced, intelligent attacks while defenders are often way behind attackers in taking appropriate actions to thwart potential attackers. The concept of moving target defense (MTD) has emerged as a proactive defense mechanism aiming to prevent attacks. In this work, we conducted a comprehensive, in-depth survey to discuss the following aspects of MTD: key roles, design principles, classifications, common attacks, key methodologies, important algorithms, metrics, evaluation methods, and application domains. We discuss the pros and cons of all aspects of MTD surveyed in this work. Lastly, we highlight insights and lessons learned from this study and suggest future work directions. The aim of this paper is to provide the overall trends of MTD research in terms of critical aspects of defense systems for researchers who seek for developing proactive, adaptive MTD mechanisms.
We study the spatiotemporal correlation of terrorist attacks by al-Qaeda, the Islamic State of Ir... more We study the spatiotemporal correlation of terrorist attacks by al-Qaeda, the Islamic State of Iraq and Syria (ISIS), and local insurgents, in six geographical areas identified via k-means clustering applied to the Global Terrorism Database. All surveyed organizations exhibit near-repeat activity whereby a prior attack increases the likelihood of a subsequent one by the same group within 20 km and on average 4 (al-Qaeda) to 10 (ISIS) weeks. Near-response activity, whereby an attack by a given organization elicits further attacks from a different one, is found to depend on the adversarial, neutral, or collaborative relationship between the two. When in conflict, local insurgents respond quickly to attacks by global terror groups while global terror groups delay their responses to local insurgents, leading to an asymmetric dynamic. When neutral or allied, attacks by one group enhance the response likelihood of the other, regardless of hierarchy. These trends arise consistently in all ...
The Journal of Defense Modeling and Simulation: Applications, Methodology, Technology
Cybersecurity is one of most critical concerns for any organization, as frequency and severity of... more Cybersecurity is one of most critical concerns for any organization, as frequency and severity of cyber attacks constantly increase, resulting in loss of vital assets and/or services. To preserve key security goals such as confidentiality, integrity, and availability, a variety of defense techniques have been introduced. While intrusion detection system (IDS) has played a key role in cybersecurity for a long time, recently new proactive defense techniques, called intrusion prevention techniques, have emerged, aiming to resolve the known IDS limitations. The intrusion prevention techniques have been introduced to control actions of attackers as a proactive defense that can be deployed independently or combined with other defense techniques that have the purpose of achieving ''Defense in Breadth.'' In this work, we develop a probability model using Stochastic Petri Nets that describes an integrated defense system with the defense techniques of both intrusion detection (i.e., IDS) and intrusion prevention (i.e., honeypots and platform migration) and analyze its performance compared to single defense or partially integrated defense approaches. Our result shows that the integrated defense system outperforms the compared approaches by minimizing attack success while maximizing system lifetime (i.e., mean time to security failure). Further, we investigate the effect of the interplay between different defense techniques in terms of the defense cost and attack cost. Keywords Defense in breadth, integrated defense systems, moving target defense, deception, intrusion detection, intrusion prevention, attack, defense, mean time to security failure proactive approach aiming to prevent intrusions by controlling the courses of an attacker's actions before the attacker performs any malicious activities. Cybersecurity cannot be achieved or maintained by a single, silver-bullet solution. Instead, there is a need for a collection of defense techniques that can work together and complete one another to deal with sophisticated attacks. This type of defense is termed as Defense in Breadth, which refers to the defense based on multiple mechanisms across sophisticated multiple attack classes.
We identify three risk-related behaviors in coping with cyber threats-the exposure to risk a pers... more We identify three risk-related behaviors in coping with cyber threats-the exposure to risk a person chooses, use of security features, and responses to security indications. The combinations of behaviors that users choose determine how well they cope with threats and the severity of adverse events they experience. End users' coping with risks is a major factor in cybersecurity. This behavior results from a combination of risk-related behaviors rather than from a single risk-taking tendency. In two experiments, participants played a Tetris-like game, attempting to maximize their gains, while exogenous occasional attacks could diminish earnings. An alerting system provided indications about possible attacks, and participants could take protective actions to limit the losses from attacks. Variables such as the costs of protective actions, reliability of the alerting system, and attack severity affected the three behaviors differently. Also, users dynamically adjusted each of the th...
Journal of the American Society for Information Science and Technology, 2011
Abstract The editor's decision where and how to place items on a... more Abstract The editor's decision where and how to place items on a screen is crucial for the design of information displays, such as websites. We developed a statistical model that can facilitate automating this process by predicting the perceived importance of screen items from their location and size. The model was developed based on a 2-step experiment in which we asked participants to rate the importance of text articles that differed in size, screen location, and title size. Articles were either presented for 0.5 seconds or for unlimited time. ...
Abstract Technological developments and the addition of new features to existing applications or ... more Abstract Technological developments and the addition of new features to existing applications or services require the inclusion of security mechanisms to protect the user. When using these mechanisms the user faces a tradeoff between more risky and more efficient or safer and less efficient use of the system.
Symposium on Usability, Privacy, and Security (SOUPS), Jul 14, 2010
Security mechanisms may require users to deal with the tradeoff between risky and efficient or sa... more Security mechanisms may require users to deal with the tradeoff between risky and efficient or safer yet less efficient use of a production system. We present an experimental system (microworld), based on the Tetris game, that can serve as a research tool for studying behavior regarding the usability and security tradeoff. This paper describes the system's main components and the variables the experimenter can manipulate. Also detailed here are the data collection process and the analysis methods. The collected ...
The way information is presented, using description or experience, can influence the decision mak... more The way information is presented, using description or experience, can influence the decision making process. However, little is currently known on how descriptive information is accounted for in subsequent experiential learning. In this paper, we use a computational model based upon Instance-based Learning Theory (IBLT) and use it to study hypotheses on how participants may integrate descriptive and experiential information presented in a repeated prisoner's dilemma. Two players, each simulated by an Instanced-based Learning (IBL) model, play against each other in a repeated prisoner's dilemma. They are provided with a descriptive payoff matrix as well as the experiential information in the form of each other's payoffs after making repeated decisions. Our results demonstrate that the descriptive payoff matrix information is incorporated into decisions using two mechanisms. The first is expectations derived from the description. A second mechanism, highlights the immediate and worst possible outcomes in the description, giving them more attention compared to the other outcomes. We highlight the significance of our results for decision making in social dilemmas.
Ensuring cyber security is a complex task that relies on domain knowledge and requires cognitive ... more Ensuring cyber security is a complex task that relies on domain knowledge and requires cognitive abilities to determine possible threats from large amounts of network data. This study investigates how knowledge in network operations and information security influence the detection of intrusions in a simple network. We developed a simplified Intrusion Detection System (IDS), which allows us to examine how individuals with or without knowledge in cyber security detect malicious events and declare an attack based on a sequence of network events. Our results indicate that more knowledge in cyber security facilitated the correct detection of malicious events and decreased the false classification of benign events as malicious. However, knowledge had less contribution when judging whether a sequence of events representing a cyber-attack. While knowledge of cyber security helps in the detection of malicious events, situated knowledge regarding a specific network at hand is needed to make accurate detection decisions. Responses from participants that have knowledge in cyber security indicated that they were able to distinguish between different types of cyber-attacks, whereas novice participants were not sensitive to the attack types. We explain how these findings relate to cognitive processes and we discuss their implications for improving cyber security.
Imagine you are about to write a paper for an upcoming conference. Before you decide how to write... more Imagine you are about to write a paper for an upcoming conference. Before you decide how to write it, you are likely to read a number of related articles. How many articles do you read? When do you stop searching for more articles and start writing? While we know much about how people make decisions, little is known about the search process that precedes a consequential decision. Here, we analyze participants search behavior in a binary choice task and present a cognitive model that is able to explain both, the process of information search, as well as the subsequent consequential choice.
Proceedings of the Human Factors and Ergonomics Society Annual Meeting
Ben-Asher and Meyer (2018) developed a model of risk-related behavior in computer systems, named ... more Ben-Asher and Meyer (2018) developed a model of risk-related behavior in computer systems, named the Triad of Risk-related Behavior (TriRB). It identified three behaviors – the exposure to risk, the use of security features and the responses to security indications. Various factors affected the three behaviors differently. We report an experiment with 83 participants who performed the Tetris-game like task, designed for studying the TriRB. We also collected data on four measures of individual differences in risk-taking (BART, DOSPERT and questionnaires on assessing risk aversion in the utility functions). We computed the correlations between the behaviors in the TriRB and the risk measures. Different risk measures were correlated with the three behaviors, supporting the notion that these are indeed three different risk-related behaviors and not expressions of a general underlying tendency to take risks. We discuss some implications of these findings for cybersecurity research and pr...
Reactive defense mechanisms, such as intrusion detection systems, have made significant efforts t... more Reactive defense mechanisms, such as intrusion detection systems, have made significant efforts to secure a system or network for the last several decades. However, the nature of reactive security mechanisms has limitations because potential attackers cannot be prevented in advance. We are facing a reality with the proliferation of persistent, advanced, intelligent attacks while defenders are often way behind attackers in taking appropriate actions to thwart potential attackers. The concept of moving target defense (MTD) has emerged as a proactive defense mechanism aiming to prevent attacks. In this work, we conducted a comprehensive, in-depth survey to discuss the following aspects of MTD: key roles, design principles, classifications, common attacks, key methodologies, important algorithms, metrics, evaluation methods, and application domains. We discuss the pros and cons of all aspects of MTD surveyed in this work. Lastly, we highlight insights and lessons learned from this study and suggest future work directions. The aim of this paper is to provide the overall trends of MTD research in terms of critical aspects of defense systems for researchers who seek for developing proactive, adaptive MTD mechanisms.
We study the spatiotemporal correlation of terrorist attacks by al-Qaeda, the Islamic State of Ir... more We study the spatiotemporal correlation of terrorist attacks by al-Qaeda, the Islamic State of Iraq and Syria (ISIS), and local insurgents, in six geographical areas identified via k-means clustering applied to the Global Terrorism Database. All surveyed organizations exhibit near-repeat activity whereby a prior attack increases the likelihood of a subsequent one by the same group within 20 km and on average 4 (al-Qaeda) to 10 (ISIS) weeks. Near-response activity, whereby an attack by a given organization elicits further attacks from a different one, is found to depend on the adversarial, neutral, or collaborative relationship between the two. When in conflict, local insurgents respond quickly to attacks by global terror groups while global terror groups delay their responses to local insurgents, leading to an asymmetric dynamic. When neutral or allied, attacks by one group enhance the response likelihood of the other, regardless of hierarchy. These trends arise consistently in all ...
The Journal of Defense Modeling and Simulation: Applications, Methodology, Technology
Cybersecurity is one of most critical concerns for any organization, as frequency and severity of... more Cybersecurity is one of most critical concerns for any organization, as frequency and severity of cyber attacks constantly increase, resulting in loss of vital assets and/or services. To preserve key security goals such as confidentiality, integrity, and availability, a variety of defense techniques have been introduced. While intrusion detection system (IDS) has played a key role in cybersecurity for a long time, recently new proactive defense techniques, called intrusion prevention techniques, have emerged, aiming to resolve the known IDS limitations. The intrusion prevention techniques have been introduced to control actions of attackers as a proactive defense that can be deployed independently or combined with other defense techniques that have the purpose of achieving ''Defense in Breadth.'' In this work, we develop a probability model using Stochastic Petri Nets that describes an integrated defense system with the defense techniques of both intrusion detection (i.e., IDS) and intrusion prevention (i.e., honeypots and platform migration) and analyze its performance compared to single defense or partially integrated defense approaches. Our result shows that the integrated defense system outperforms the compared approaches by minimizing attack success while maximizing system lifetime (i.e., mean time to security failure). Further, we investigate the effect of the interplay between different defense techniques in terms of the defense cost and attack cost. Keywords Defense in breadth, integrated defense systems, moving target defense, deception, intrusion detection, intrusion prevention, attack, defense, mean time to security failure proactive approach aiming to prevent intrusions by controlling the courses of an attacker's actions before the attacker performs any malicious activities. Cybersecurity cannot be achieved or maintained by a single, silver-bullet solution. Instead, there is a need for a collection of defense techniques that can work together and complete one another to deal with sophisticated attacks. This type of defense is termed as Defense in Breadth, which refers to the defense based on multiple mechanisms across sophisticated multiple attack classes.
We identify three risk-related behaviors in coping with cyber threats-the exposure to risk a pers... more We identify three risk-related behaviors in coping with cyber threats-the exposure to risk a person chooses, use of security features, and responses to security indications. The combinations of behaviors that users choose determine how well they cope with threats and the severity of adverse events they experience. End users' coping with risks is a major factor in cybersecurity. This behavior results from a combination of risk-related behaviors rather than from a single risk-taking tendency. In two experiments, participants played a Tetris-like game, attempting to maximize their gains, while exogenous occasional attacks could diminish earnings. An alerting system provided indications about possible attacks, and participants could take protective actions to limit the losses from attacks. Variables such as the costs of protective actions, reliability of the alerting system, and attack severity affected the three behaviors differently. Also, users dynamically adjusted each of the th...
Journal of the American Society for Information Science and Technology, 2011
Abstract The editor's decision where and how to place items on a... more Abstract The editor's decision where and how to place items on a screen is crucial for the design of information displays, such as websites. We developed a statistical model that can facilitate automating this process by predicting the perceived importance of screen items from their location and size. The model was developed based on a 2-step experiment in which we asked participants to rate the importance of text articles that differed in size, screen location, and title size. Articles were either presented for 0.5 seconds or for unlimited time. ...
Abstract Technological developments and the addition of new features to existing applications or ... more Abstract Technological developments and the addition of new features to existing applications or services require the inclusion of security mechanisms to protect the user. When using these mechanisms the user faces a tradeoff between more risky and more efficient or safer and less efficient use of the system.
Symposium on Usability, Privacy, and Security (SOUPS), Jul 14, 2010
Security mechanisms may require users to deal with the tradeoff between risky and efficient or sa... more Security mechanisms may require users to deal with the tradeoff between risky and efficient or safer yet less efficient use of a production system. We present an experimental system (microworld), based on the Tetris game, that can serve as a research tool for studying behavior regarding the usability and security tradeoff. This paper describes the system's main components and the variables the experimenter can manipulate. Also detailed here are the data collection process and the analysis methods. The collected ...
The way information is presented, using description or experience, can influence the decision mak... more The way information is presented, using description or experience, can influence the decision making process. However, little is currently known on how descriptive information is accounted for in subsequent experiential learning. In this paper, we use a computational model based upon Instance-based Learning Theory (IBLT) and use it to study hypotheses on how participants may integrate descriptive and experiential information presented in a repeated prisoner's dilemma. Two players, each simulated by an Instanced-based Learning (IBL) model, play against each other in a repeated prisoner's dilemma. They are provided with a descriptive payoff matrix as well as the experiential information in the form of each other's payoffs after making repeated decisions. Our results demonstrate that the descriptive payoff matrix information is incorporated into decisions using two mechanisms. The first is expectations derived from the description. A second mechanism, highlights the immediate and worst possible outcomes in the description, giving them more attention compared to the other outcomes. We highlight the significance of our results for decision making in social dilemmas.
Ensuring cyber security is a complex task that relies on domain knowledge and requires cognitive ... more Ensuring cyber security is a complex task that relies on domain knowledge and requires cognitive abilities to determine possible threats from large amounts of network data. This study investigates how knowledge in network operations and information security influence the detection of intrusions in a simple network. We developed a simplified Intrusion Detection System (IDS), which allows us to examine how individuals with or without knowledge in cyber security detect malicious events and declare an attack based on a sequence of network events. Our results indicate that more knowledge in cyber security facilitated the correct detection of malicious events and decreased the false classification of benign events as malicious. However, knowledge had less contribution when judging whether a sequence of events representing a cyber-attack. While knowledge of cyber security helps in the detection of malicious events, situated knowledge regarding a specific network at hand is needed to make accurate detection decisions. Responses from participants that have knowledge in cyber security indicated that they were able to distinguish between different types of cyber-attacks, whereas novice participants were not sensitive to the attack types. We explain how these findings relate to cognitive processes and we discuss their implications for improving cyber security.
Imagine you are about to write a paper for an upcoming conference. Before you decide how to write... more Imagine you are about to write a paper for an upcoming conference. Before you decide how to write it, you are likely to read a number of related articles. How many articles do you read? When do you stop searching for more articles and start writing? While we know much about how people make decisions, little is known about the search process that precedes a consequential decision. Here, we analyze participants search behavior in a binary choice task and present a cognitive model that is able to explain both, the process of information search, as well as the subsequent consequential choice.
Uploads
Papers by Noam Ben-Asher