Collaborative Research: Intelligent Interactions with Risk Communication for Risk Mitigation

这项研究项目将使非技术人员能够轻松地管理他们的在线风险。目前的信息基础设施非常不安全，这在很大程度上是由于非技术人员在网上不经意间的风险寻求行为。本研究采用风险沟通与智能交互设计相结合的方法。虽然风险沟通理论已经被计算机安全所接受，但它的使用还处于萌芽阶段。智能交互工具尚未被用来帮助个人作出适合其环境的风险决定。通过将这些方法与特定的在线风险相结合，这项研究将使个人能够做出明智的安全选择。请注意，这项工作特别将工作重点放在确定的人类个体上，而不是通常抽象的Rational自我优化用户。研究的核心要素是：1)了解个人？S的风险感知，2)利用这种感知进行有效的风险沟通，3)确保中断和沟通适合手头的工作流程，4)提供自动化和无缝的风险缓解。这些创新的方法风险很高，但在潜在地使许多离散的安全工具得以广泛使用方面也有很高的回报。在这项研究中，基于知识的技术风险识别方法将与以人为中心的风险感知方法相结合，以实现自动化和情景感知的缓解。使用我们的研究结果，个人将根据他们的任务、工作流程和背景选择承担知情风险。相比之下，今天的个人被去语境化的、无叙事的、时机不当的、往往在技术上无法理解的风险缓解建议所打断。结果，人们无辜地冒着他们无法避免的风险。为了让非技术人员能够使用，该研究项目将嵌入一种新的方法来简化安全措施的使用。建议的半透明设计是通过这种关于风险的推理的组合来实现的，只有在必要时才会打断个人，使用工作流来构建集中于风险以及如何在上下文中缓解风险的连贯叙述，并将适当的缓解操作组合到简单的定制宏中。

This research project will enable nontechnical individuals to easily manage their online risks. The current information infrastructure is profoundly insecure in no small part due to the oblivious risk-seeking behaviors of nontechnical individuals online. The methods in this research are a combination of risk communication with intelligent interaction design. While the theory of risk communication has been embraced in computer security, its use is embryonic. The tools of intelligent interaction have not been adopted to assist individuals in making risk decisions appropriate to their contexts. By combining these approaches to specific online risks the research will enable individuals to make informed security choices. Note that this work specifically focuses work on the identified human individual as opposed to the commonly abstracted rational self-optimizing user. The core elements of the research are: 1) understanding the individual?s risk perception, 2) using that perception for effective risk communication, 3) ensuring the interruptions and communications are appropriate to the workflow at hand, and 4) providing risk mitigation that is automated and seamless. The innovative methods carry a high risk, but also a high payoff in potentially enabling the wide use of many discrete security tools. In this research, the knowledge-based approach to identification of technical risk will be integrated with a human-centered approach to the perception of risk to enable mitigation that is automated and contextually aware.Using the results of our research, individuals will choose to take informed risks based on their on tasks, workflows and context. In contrast, today individuals are interrupted with decontextualized, narrative-free, inappropriately timed, and often technologically incomprehensible suggestions for risk mitigation. Consequently, people innocently take risks they have no way of knowing how to avoid. To enable the nontechnical individual, this research project will embed a novel approach to simplifying the use of security measures. The proposed translucent design is enabled by this combination of reasoning about risk to interrupt the individual only when necessary, using workflow to build a coherent narrative that focuses on the risks and how to mitigate them in context, and combining the appropriate mitigating actions into simple customized macros.