TWC SBE: Small: Identifying Malicious Insiders through Mouse Cursor Movements

恶意内部人士的威胁是政府机构和企业最关心的问题。一般来说，怀有恶意的内部人士通常是心怀不满的员工，他们会遇到负面经历或压力源，作为触发事件。长期以来，犯罪学研究一直将某些应激源与恶意行为联系在一起。最近的神经科学和认知心理学研究已经明确地证明，认知过程(例如，认知冲突、情绪、唤醒等)之间存在联系。和手部动作。在人机交互环境中，越来越多的人发现情绪会影响鼠标光标的移动。重要的是，这项工作证明了与压力源相关的负面情绪会影响用户？鼠标光标移动。在此基础上，这项工作将回答有关识别鼠标光标数据特征的关键问题，这些特征可能表明应激源诱导的负面情绪。具体地说，第一年的重点是当用户知道他们被监视并试图避免被发现时，了解这种方法的有效性。在第二年，了解该方法在预测一个人是否会实时参与恶意在线活动的可能性方面的有效性。这项为期两年的研究计划将回答有关识别鼠标光标数据特征的关键问题，这些特征可能表明由应激源引发的负面情绪。这项工作的测试环境将是多轮、公平与不公平、严肃的游戏或测试场景(例如，智力测试)。在所有研究中，参与者将被随机分配到两种治疗方法中的一种：公平(没有操纵)或不公平(负面情绪诱导)体验(以及取决于特定研究目标的其他实验操纵)。在治疗条件下，说明书将解释任务将被计时，他们的分数将根据他们在分配的时间内能够正确完成的目标数来计算。为了诱发负面情绪，任务会出现加载刺激的技术问题，会提出非常困难的问题，并给参与者很短的时间来完成任务。由于这些不公平的劣势，系统会将低分归因于参与者，导致不公平、沮丧和愤怒的感觉。参与者还将被告知，由于他们的反应时间较慢，答案不正确，他们的分数表明他们的智力水平低于大多数参加过测试的人。由于他们的分数不受他们的控制(由于系统太慢，没有给他们足够的时间来回答)，以前的文献表明，参与者会因为被不公平地评判而产生负面情绪反应。在基线条件下，说明将向参与者解释他们将完成一项任务，他们的分数将根据他们正确完成的任务数来计算。在这种情况下，刺激的传递将类似于负面情绪条件，只是我们不会实施负面情绪诱导机制(即，任务不会计时；不会显示负载标志；问题很容易回答；在结束时，系统将祝贺参与者正确回答问题)。因此，负面情绪很可能不会在任务中产生。在完成每一轮任务后，两组参与者将完成一项相同的目标导向任务，在此期间，我们将记录和分析鼠标光标的移动。通过使用相同的后续任务，我们可以将鼠标光标移动的差异归因于与主要任务相比的负面情绪。第一年和第二年将使用不同的后续任务，因为每一年的目标都不同。所有实验结束后，参与者将听取简报，告知测试的真正目的，并给予最高报酬，无论他们在研究中的表现或行为如何。

The threat of malicious insiders is a top concern for governmental agencies and corporations. In general, malicious insiders are typically disgruntled employees who encounter a negative experience, or stressor, as a triggering event. Criminology research has long associated certain stressors with malicious behavior. Recent neuroscience and cognitive psychology research has unequivocally demonstrated that linkages exist between cognitive processing (e.g., cognitive conflict, emotion, arousal, etc.) and hand movements. In a human-computer interaction context, growing support has found that emotions influence mouse cursor movements. Importantly, this work has demonstrated that negative emotions associated with stressors influence users? mouse cursor movements. Building on this foundation, this work will answer critical questions regarding the identification of mouse curser data features that may indicate negative emotions induced by stressors. Specifically, year 1 will focus on understanding the efficacy of this approach when users know they are being monitored and trying to avoid being detected. And, for year 2, understand the efficacy of the approach for predicting the likelihood of whether a person will engage in a malicious online activity in real time.This two-year program of research will answer critical questions regarding the identification of mouse curser data features that may indicate negative emotions induced by stressors. The test environment for this work will be a multi-round, fair vs. unfair, serious game or testing scenario (e.g., intelligence test). In all studies, participants will be randomly assigned to one of the two treatments a fair (no manipulation) or unfair (negative emotion induced) experience (as well as other experimental manipulations depending on a particular study's objectives). In the treatment condition, the instructions will explain that the task will be timed, and that their score will be computed based on how many objectives they can complete correctly within the allotted time. To induce negative emotion, the task will appear to have technical problems loading the stimuli, will ask very difficult questions, and give participants a very short period of time to complete the tasks. Because of these "unfair" disadvantages, the system will attribute a low score to the participants, resulting in feelings of unfairness, frustration, and anger. Participants will also be told that because of their slow response time and incorrect answers, their score indicates a lower intelligence level than that of most people who have taken the test. As their score is outside of their control (resulting from the system being too slow and not giving them enough time to answer), the prior literature suggests that participants will have a negative emotional response from being judged unfairly. In the baseline condition, the instructions will explain to participants that they will complete a task and that their score will be computed based on how many tasks they complete correctly. The delivery of the stimuli in this condition will be similar to the negative-emotion condition, except that we will not implement the negative-emotion-inducing mechanisms (i.e., the task will not be timed; the loading signs will not be shown; the questions can easily be answered; and, at the conclusion, the system will congratulate participants for answering the questions correctly). Thus, negative emotion would likely not be induced in the task. After completing each round of the task, participants in both treatments will complete an identical goal-directed task, during which we will record and analyze mouse cursor movements. By using an identical follow-up task, we can attribute the difference in mouse cursor movements to negative emotion from the primary task. Different follow-up tasks will be used in Year 1 vs Year 2, as the goals of each year are different. After all experiments, participants will be debriefed, told the true purpose of the test, and given maximum payment regardless of their performance or behavior on the study.