A Human Factors Psychology Approach to Immersive Cyber Incident Response

沉浸式网络事件响应的人为因素心理学方法

• 批准号: 2883572
• 金额: --
• 依托单位: CARDIFF UNIVERSITY
• 依托单位国家: 英国
• 项目类别: Studentship
• 财政年份: 2023
• 资助国家: 英国
• 起止时间: 2023 至 无数据
• 项目状态: 未结题
• 来源: https://gtr.ukri.org/projects?ref=studentship-2883572
• 关键词: Human; Factors; Psychology; Approach; Immersive

Context. Cybersecurity incident response is a form of emergency response. The incidents might involve an individual actor responding to an isolated attack, or a multi-agency group of actors responding to a multi-pronged attack on national infrastructure. This project concerns understanding cybersecurity incident response in the context of opportunities for actors to make use of (i) automated alerts to cyber attacks, from rule-based systems, and (ii) increasingly AI-driven responses. The interdisciplinary problem space is to understand: (i) the individual and group dynamics that lead to an in/effective cyber incident response; (ii) the role played by automated methods for attack detection and how "dialling automated alerts up and down" have an impact of accuracy/effectiveness of decision making under pressure; and (iii) how humans develop trust with algorithmic approaches (e.g. AI-driven cyber incident responses) that enable hybrid approaches that can handle small and large-scale attacks. Approach. The experimental work will use our immersive cyber attack labs to launch attacks on a replica enterprise IT network, and will study how experts (drawn from industry partners and broader emergency responders) respond to these attacks in our immersive dome and Security Operations Centre (depending on which is best suited to task). Experimental scenarios will vary in complexity, and include the provision and integration of automated alerts. In each case, we will study the responses of actors and groups, and tailor decision-making playbooks to improve the response. For the automated cyber incident response, we will conduct experiments to help improve human acceptability of and trust in algorithmic decision making, using well-established questionnaires and correlated real-time behavioural indices of trust. To the best of our knowledge this is all novel research Value to the field. The value to Psychology will be new insights into decision making under pressure for cybersecurity incident response, building on the award winning work with the UK Fire and Rescue Service and broader emergency services (e.g., Strategic Coordinating Groups). It will lead to journal articles on this topic. In Computer Science, the research will lead to new insights into how AI can drive automated cyber responses in such a way that humans are content to work with the algorithmic approaches, and will work towards adopting them as part of everyday practice.

上下文网络安全事件响应是应急响应的一种形式。这些事件可能涉及单个行为体应对孤立的攻击，也可能涉及多机构行为体群体应对对国家基础设施的多管齐下的攻击。该项目涉及了解网络安全事件响应的背景下，行动者利用机会（i）自动警报网络攻击，从基于规则的系统，和（ii）越来越多的人工智能驱动的响应。 跨学科的问题空间是要理解：（i）个人和团体的动态，导致在/有效的网络事件响应;（ii）攻击检测的自动化方法所发挥的作用，以及“向上和向下拨打自动警报”如何影响压力下决策的准确性/有效性;以及（iii）人类如何通过算法方法（例如人工智能驱动的网络事件响应）建立信任，这些方法能够实现可以处理小型和大型攻击的混合方法。 Approach.实验工作将使用我们的沉浸式网络攻击实验室对复制的企业IT网络发起攻击，并将研究专家（来自行业合作伙伴和更广泛的应急响应人员）如何在我们的沉浸式圆顶和安全运营中心（取决于哪一个最适合任务）应对这些攻击。实验场景的复杂性各不相同，包括自动警报的提供和集成。在每一种情况下，我们将研究演员和团体的反应，并定制决策剧本，以改善反应。对于自动网络事件响应，我们将进行实验，以帮助提高人类对算法决策的接受度和信任度，使用完善的问卷和相关的实时行为信任指数。据我们所知，这是所有新的研究价值的领域。对心理学的价值将是对网络安全事件响应压力下决策的新见解，建立在与英国消防和救援服务以及更广泛的紧急服务（例如，战略协调小组）。它将导致关于这个主题的期刊文章。在计算机科学领域，这项研究将为人工智能如何驱动自动化网络响应提供新的见解，使人类满足于使用算法方法，并将努力将其作为日常实践的一部分。