SBE: Small: The Force of Habit: Using fMRI to Explain Users' Habituation to Security Warnings

警告消息是计算机安全的最后一道防线之一，是用户与技术安全交互的基础。不幸的是，研究表明，用户经常忽略安全警告。造成这种忽视的一个关键因素是习惯化，即由于频繁接触而减少注意力。然而，以前的研究只是间接地研究习惯化，通过观察习惯化对安全行为的影响，而不是测量习惯化本身。这个项目使用神经科学来打开大脑的“黑匣子”，以观察习惯化的发生。通过研究重复抑制在大脑中是如何发生的，研究人员可以更精确地设计出一种能抵抗习惯化影响的安全警告，具体来说，功能性磁共振成像（fMRI）被用来测量大脑视觉处理中心的神经活动如何随着重复暴露于警告而急剧下降。这种现象被称为重复抑制效应，它直接发生在习惯化过程之前。该项目旨在：（1）直接测量安全警告的习惯化在大脑中是如何发生的;（2）使用纵向设计来检查对安全警告的习惯化是如何随着时间的推移而发展的;（3）使用功能磁共振成像大脑数据来指导多态（动态）安全警告的设计，以及与现有的安全警告相比，经验性地测试它们的有效性。 从该项目中获得的见解有可能为警告的设计和评估提供信息，从而更有效地帮助用户应对安全威胁。

Warning messages are one of the last lines of defense in computer security, and are fundamental to users' security interactions with technology. Unfortunately, research shows that users routinely ignore security warnings. A key contributor to this disregard is habituation, the diminishing of attention due to frequent exposure. However, previous research examining habituation has done so only indirectly, by observing the influence of habituation on security behavior, rather than measuring habituation itself. This project uses neuroscience to open the "black box" of the brain to observe habituation as it occurs. By investigating how repetition suppression occurs in the brain, researchers can make a more precise approach to designing security warnings that are resistant to the effects of habituation.Specifically, functional magnetic resonance imaging (fMRI) is used to measure how neural activity in the visual processing centers of the brain sharply decrease with repeated exposure to warnings. This phenomenon, termed the repetition suppression effect, is directly antecedent to the process of habituation. This project aims to: (1) directly measure how habituation of security warnings occurs in the brain; (2) examine how habituation towards security warnings develops over time using a longitudinal design; and (3) use fMRI brain data to guide the design of polymorphic (dynamic) security warnings, as well as to empirically test their effectiveness compared with existing security warnings. The insights gained from this project have the potential to inform the design and evaluation of warnings that more effectively help users to respond to security threats.