TWC SBE: Small: Identifying Malicious Insiders through Mouse Cursor Movements

点击翻译按钮获取中文摘要

The threat of malicious insiders is a top concern for governmental agencies and corporations. In general, malicious insiders are typically disgruntled employees who encounter a negative experience, or stressor, as a triggering event. Criminology research has long associated certain stressors with malicious behavior. Recent neuroscience and cognitive psychology research has unequivocally demonstrated that linkages exist between cognitive processing (e.g., cognitive conflict, emotion, arousal, etc.) and hand movements. In a human-computer interaction context, growing support has found that emotions influence mouse cursor movements. Importantly, this work has demonstrated that negative emotions associated with stressors influence users? mouse cursor movements. Building on this foundation, this work will answer critical questions regarding the identification of mouse curser data features that may indicate negative emotions induced by stressors. Specifically, year 1 will focus on understanding the efficacy of this approach when users know they are being monitored and trying to avoid being detected. And, for year 2, understand the efficacy of the approach for predicting the likelihood of whether a person will engage in a malicious online activity in real time.This two-year program of research will answer critical questions regarding the identification of mouse curser data features that may indicate negative emotions induced by stressors. The test environment for this work will be a multi-round, fair vs. unfair, serious game or testing scenario (e.g., intelligence test). In all studies, participants will be randomly assigned to one of the two treatments a fair (no manipulation) or unfair (negative emotion induced) experience (as well as other experimental manipulations depending on a particular study's objectives). In the treatment condition, the instructions will explain that the task will be timed, and that their score will be computed based on how many objectives they can complete correctly within the allotted time. To induce negative emotion, the task will appear to have technical problems loading the stimuli, will ask very difficult questions, and give participants a very short period of time to complete the tasks. Because of these "unfair" disadvantages, the system will attribute a low score to the participants, resulting in feelings of unfairness, frustration, and anger. Participants will also be told that because of their slow response time and incorrect answers, their score indicates a lower intelligence level than that of most people who have taken the test. As their score is outside of their control (resulting from the system being too slow and not giving them enough time to answer), the prior literature suggests that participants will have a negative emotional response from being judged unfairly. In the baseline condition, the instructions will explain to participants that they will complete a task and that their score will be computed based on how many tasks they complete correctly. The delivery of the stimuli in this condition will be similar to the negative-emotion condition, except that we will not implement the negative-emotion-inducing mechanisms (i.e., the task will not be timed; the loading signs will not be shown; the questions can easily be answered; and, at the conclusion, the system will congratulate participants for answering the questions correctly). Thus, negative emotion would likely not be induced in the task. After completing each round of the task, participants in both treatments will complete an identical goal-directed task, during which we will record and analyze mouse cursor movements. By using an identical follow-up task, we can attribute the difference in mouse cursor movements to negative emotion from the primary task. Different follow-up tasks will be used in Year 1 vs Year 2, as the goals of each year are different. After all experiments, participants will be debriefed, told the true purpose of the test, and given maximum payment regardless of their performance or behavior on the study.