CAREER: RUI: Understanding Human Cognition in Computer Network Defense

随着对信息技术的日益依赖，对组织和政府的网络安全威胁持续增长;同时，网络攻击背后的实体也越来越复杂。网络安全专业人员，负责保持组织安全的个人，调查网络活动以发现，识别和响应威胁。这些人是组织的最后防线。网络安全专业人员依赖自动化工具来执行工作，但必须做出影响安全的关键决策。因此，成功防御网络攻击取决于人类的决策。这项研究确定了预测成功威胁反应的认知结果。研究人员正在调查网络安全专业人员知识的内容和结构，创建网络安全专业认知的评估，并开发网络安全决策的培训技术。该项目的更广泛影响解决了网络安全劳动力发展的巨大需求。通过这项研究开发的培训将使传统计算机科学职业道路之外的个人更容易获得网络安全职业。针对网络防御的威胁响应培训为应对网络对手和日益复杂的威胁提供了战略优势。有效的人类决策是有效网络安全的决定因素。情境意识和心智模型是预测人类表现的认知结果。情境意识，定义为在任务执行过程中持有的目标相关知识，预测良好的决策。安全专业人员还利用任务环境的内部表示，例如计算机如何以心理模型的形式互连。由于多个心理模型支持态势感知，并随着任务和专业知识的变化而变化，因此理解计算机网络防御中的决策需要识别关键的心理模型。这项研究正在确定认知结果，包括心理模型和态势感知，预测计算机网络防御中成功的威胁响应，并利用它们来改善网络安全专业人员的培训。根据心智模型的知识，这项研究将导致新的培训技术，广泛转移到网络安全决策。这项培训将增加网络安全职业的机会，特别是对代表性不足的群体的成员。威胁应对培训提供了战略优势，不仅针对已知的威胁，而且针对新的和日益复杂的威胁。

The cyber security threat to organizations and governments has continued to grow with increasing dependence on information technology; meanwhile, the entities behind cyber attacks increase in sophistication. Cyber security professionals, the individuals responsible for keeping organizations secure, investigate network activity to find, identify, and respond to threats. These individuals are among the last lines of defense for an organization. Cyber security professionals depend on automated tools to perform their jobs but must make critical decisions that impact security. Therefore, successful defense against cyber attacks depends on human decision making. This research identifies cognitive outcomes that predict successful threat response. The researchers are investigating the content and structure of cyber security professionals' knowledge, creating assessments of cyber security professional cognition, and developing training techniques for cyber security decision making. This project's broader impacts address the large need for cyber security workforce development. The training developed through this research will make cyber security careers more accessible to individuals beyond traditional computer science career paths. Threat response training for network defense provides a strategic advantage against cyber adversaries and increasingly sophisticated threats.Effective human decision making is a determinant of effective cyber security. Situation awareness and mental models are cognitive outcomes that predict human performance. Situation awareness, defined as goal-relevant knowledge held during task performance, predicts good decision making. Security professionals also utilize internal representations of the task environment, such as how computers are interconnected, in the form of mental models. Because multiple mental models support situation awareness and vary as a function of task and expertise, understanding decision making in computer network defense requires identifying critical mental models. This research is identifying cognitive outcomes, including mental models and situation awareness, that predict successful threat response in computer network defense and leveraging them to improve training for cyber security professionals. Informed by knowledge of mental models, the research will lead to new training techniques that transfer broadly to cyber security decision making. This training will increase access to cyber security careers, especially to members of underrepresented groups. Threat response training provides a strategic advantage, not only against known threats, but against novel and increasingly sophisticated threats.