SBE: Small: The Force of Habit: Using fMRI to Explain Users' Habituation to Security Warnings

警告消息是计算机安全的最后一道防线，是用户与技术进行安全交互的基础。不幸的是，研究表明，用户经常忽略安全警告。这种忽视的一个关键因素是习惯性，即由于频繁暴露而导致的注意力减少。然而，以前对习惯化的研究只是通过观察习惯化对安全行为的影响，而不是测量习惯化本身，间接地做到了这一点。这个项目使用神经科学打开大脑的“黑匣子”，观察习惯化的发生。通过研究重复抑制是如何在大脑中发生的，研究人员可以做出更精确的方法来设计抵抗习惯影响的安全警告。具体地说，功能磁共振成像(FMRI)被用来测量大脑视觉处理中心的神经活动如何随着反复暴露在警告中而急剧下降。这种现象被称为重复抑制效应，它直接先于习惯化的过程。本项目的目标是：(1)直接测量安全警告的习惯性如何在大脑中发生；(2)使用纵向设计检查对安全警告的习惯化是如何随着时间的推移而发展的；以及(3)使用fMRI大脑数据来指导多态(动态)安全警告的设计，并从经验上测试其与现有安全警告的有效性。从该项目中获得的见解有可能为设计和评估警告提供信息，从而更有效地帮助用户应对安全威胁。

Warning messages are one of the last lines of defense in computer security, and are fundamental to users' security interactions with technology. Unfortunately, research shows that users routinely ignore security warnings. A key contributor to this disregard is habituation, the diminishing of attention due to frequent exposure. However, previous research examining habituation has done so only indirectly, by observing the influence of habituation on security behavior, rather than measuring habituation itself. This project uses neuroscience to open the "black box" of the brain to observe habituation as it occurs. By investigating how repetition suppression occurs in the brain, researchers can make a more precise approach to designing security warnings that are resistant to the effects of habituation.Specifically, functional magnetic resonance imaging (fMRI) is used to measure how neural activity in the visual processing centers of the brain sharply decrease with repeated exposure to warnings. This phenomenon, termed the repetition suppression effect, is directly antecedent to the process of habituation. This project aims to: (1) directly measure how habituation of security warnings occurs in the brain; (2) examine how habituation towards security warnings develops over time using a longitudinal design; and (3) use fMRI brain data to guide the design of polymorphic (dynamic) security warnings, as well as to empirically test their effectiveness compared with existing security warnings. The insights gained from this project have the potential to inform the design and evaluation of warnings that more effectively help users to respond to security threats.