SBE: Medium: Understanding and Influencing Security and Privacy Decision-making

网络安全越来越多地被视为经济权衡的管理：平衡实际攻击造成的损失(例如，金钱成本、隐私丧失造成的心理成本等)。降低威胁/攻击缓解机制的成本(例如，货币成本、性能和生产率下降等)。当在高度动态和不确定的环境中处理这种多属性决策问题时，个体经常偏离理性。为了更好地理解理性行为的偏离并找到有效的补救方法(在必要时)，将对恶意行为者(攻击者)、非恶意行为者--意图维护系统安全的那些人以及其行为/态度与系统安全无关但不打算攻击系统(终端用户)的行为者--的人类行为进行系统研究。研究方法涉及：(1)生成各种攻击/缓解决策问题的代表性场景，(2)使用场景模拟进行调查以识别与每个场景相关的人类行为的驱动因素，(3)开发涉及应用来自行为经济学的各种规范和描述性模型的人类行为模型，(4)比较模型的结果，(5)对人类受试者进行受控实验室实验，以揭示预测的和观察到的用户行为之间的差异，(6)使用所开发的模型来帮助确定可以采用什么措施来改变人类行为，以及(7)实施、模拟、该项目有三个关键任务：(1)探索是什么因素促使对手选择特定的网络攻击，以及是什么促使良性用户采取或不采取行动。这项拟议的研究还将研究可以采取哪些步骤来改变人类行为--要么不攻击，要么采取特定的攻击路径，或者对于善良的用户，采取步骤来避免或减轻攻击。(2)探索最佳安全决策和实际安全决策之间的潜在差异，确定偏离最佳决策的时间和原因，并找到有效的方法来纠正阻碍实现良好安全结果的理性偏差。(3)调查攻击者如何利用感知和实际风险之间的差距，以及攻击者？冒险行为。这对于确保开发和实施有效的监测和缓解技术至关重要。研究将开发技术和模型，为未来以安全为重点的行为建模研究奠定基础，提供急需的经验数据，并开发、测试和评估研究人类安全决策的方法和模型的软件工具包。

Cyber security is increasingly seen as the management of economic trade-offs: balancing losses from actual attacks (e.g., monetary costs, psychological costs due to loss of privacy, etc.) against the costs of threat/attack mitigation mechanisms (e.g., monetary costs, degradation of performance and productivity, etc.). While tackling this multi-attribute decision problem in a highly dynamic and uncertain environment, individuals frequently diverge from rationality. To better understand the deviation from rational behavior and to find effective ways to remediate this (when necessary), a systematic study will be undertaken with the results used to model the human behavior of malicious actors (attackers), non-malicious actors - those who intend to maintain the security of a system (defenders) and actors whose behavior/attitudes are indifferent to system security, but do not intend to attack the system (end users).The research methodology involves: (1) generating representative scenarios of various attack / mitigation decision problems, (2) conducting surveys using scenario simulations to identify the drivers of human behavior relative to each scenario, (3) developing models of human behavior that involve the application of various normative and descriptive models from behavioral economics, (4) comparing the outcomes of the models, (5) conducting controlled laboratory experiments with human subjects to reveal differences between predicted and observed user behavior, (6) using the developed models to help determine what measures can be employed to change human behavior, and (7) implementing, simulating, and evaluating the developed models in a multi-agent system.The project has three key tasks:(1) Explore what factors drive an adversary to select a particular cyber-attack and what motivates the benign user to either take or not take action. The proposed research also will examine what steps can be taken to change human behavior - either to not attack, take certain attack paths, or, for a benign user, take steps to avoid or mitigate an attack.(2) Explore the potential difference between optimal and actual security decisions, to determine when and why deviation from the optimal decision occurs, and identify effective means to correct deviations from rationality that impede the realization of good security outcomes.(3) Investigate how attackers can take advantage of the gap between perceived and actual risk, as well as attackers? risk taking behavior. This is critical to ensuring the development and implementation of effective monitoring and mitigation technologies.The research will develop techniques and models delivering the foundation for future security-focused behavioral modeling research, provide much needed empirical data, and produce a software toolkit for developing, testing and evaluating methods and models to study human security decision-making.