...
  • 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>Frontiers in Psychology >Cognitive Models in Cybersecurity: Learning From Expert Analysts and Predicting Attacker Behavior
【24h】

Cognitive Models in Cybersecurity: Learning From Expert Analysts and Predicting Attacker Behavior

机译：网络安全中的认知模型：从专家分析师学习并预测攻击者行为

获取原文
   

获取外文期刊封面封底 >>

       
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Cybersecurity stands to benefit greatly from models able to generate predictions of attacker and defender behavior. On the defender side, there is promising research suggesting that Symbolic Deep Learning (SDL) may be employed to automatically construct cognitive models of expert behavior based on small samples of expert decisions. Such models could then be employed to provide decision support for non-expert users in the form of explainable expert-based suggestions. On the attacker side, there is promising research suggesting that model-tracing with dynamic parameter fitting may be used to automatically construct models during live attack scenarios, and to predict individual attacker preferences. Predicted attacker preferences could then be exploited for mitigating risk of successful attacks. In this paper we examine how these two cognitive modeling approaches may be useful for cybersecurity professionals via two human experiments. In the first experiment participants play the role of cyber analysts performing a task based on Intrusion Detection System alert elevation. Experiment results and analysis reveal that SDL can help to reduce missed threats by 25%. In the second experiment participants play the role of attackers picking among four attack strategies. Experiment results and analysis reveal that model-tracing with dynamic parameter fitting can be used to predict (and exploit) most attackers' preferences 40?70% of the time. We conclude that studies and models of human cognition are highly valuable for advancing cybersecurity.
机译：网络安全能够从能够生成对攻击者和后卫行为预测的模型中受益匪浅。在后卫方面，有希望的研究表明，可以使用符号深度学习（SDL）来根据专家决策的小样本来自动构建专家行为的认知模型。然后可以采用这种模型来为非专家用户提供决策支持，以可解释的专家的建议。在攻击者方面，有希望的研究表明，具有动态参数拟合的模型跟踪可用于在现场攻击方案期间自动构建模型，并预测单个攻击者偏好。然后可以利用预测的攻击者偏好来缓解成功攻击的风险。在本文中，我们研究这两个认知建模方法如何通过两个人类实验对网络安全专业人员有用。在第一次实验中，参与者在网络分析师基于入侵检测系统警报高程中发挥Cyber​​分析师的作用。实验结果和分析显示，SDL可以帮助减少25％的错过威胁。在第二个实验中，参与者在四个攻击战略中发挥攻击者挑选的作用。实验结果和分析显示，使用动态参数拟合的模型跟踪可用于预测（和利用）大多数攻击者的偏好40？70％的时间。我们得出结论，人类认知的研究和模型对于推进网络安全是非常有价值的。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号