TWC SBE: Small: Identifying Malicious Insiders through Mouse Cursor Movements

恶意内部人员的威胁是政府机构和公司最关心的问题。一般来说，恶意内部人员通常是心怀不满的员工，他们遇到了负面经历或压力源，作为触发事件。犯罪学研究长期以来将某些压力源与恶意行为联系起来。最近的神经科学和认知心理学研究已经明确表明，认知处理（例如，认知冲突、情绪、觉醒等）和手部动作。在人机交互环境中，越来越多的支持者发现情绪会影响鼠标光标的移动。重要的是，这项工作表明，与压力源相关的负面情绪会影响用户？鼠标光标移动。 在此基础上，这项工作将回答有关识别鼠标光标数据特征的关键问题，这些特征可能表明压力源引起的负面情绪。具体而言，第一年将侧重于了解当用户知道他们被监视并试图避免被发现时这种方法的有效性。第二年，了解该方法在预测一个人是否会在真实的时间从事恶意在线活动的可能性方面的有效性。这项为期两年的研究计划将回答有关识别鼠标光标数据特征的关键问题，这些特征可能表明压力源引起的负面情绪。这项工作的测试环境将是一个多轮，公平与不公平，严重的游戏或测试场景（例如，智力测验）。在所有研究中，参与者将被随机分配到两种治疗之一：公平（无操纵）或不公平（负面情绪诱导）体验（以及其他实验操纵，取决于特定研究的目的）。在治疗条件下，说明将解释任务将被计时，并且他们的分数将根据他们在分配的时间内正确完成的目标数量来计算。为了诱发负面情绪，任务会出现加载刺激的技术问题，会提出非常困难的问题，并给参与者很短的时间来完成任务。由于这些“不公平”的缺点，系统会将低分归因于参与者，导致不公平，沮丧和愤怒的感觉。参与者还将被告知，由于他们的反应时间慢和回答错误，他们的分数表明他们的智力水平低于大多数参加测试的人。由于他们的分数超出了他们的控制范围（由于系统太慢，没有给他们足够的时间来回答），先前的文献表明，参与者会因为受到不公平的评判而产生负面的情绪反应。在基线条件下，说明将向参与者解释他们将完成一项任务，并且他们的分数将根据他们正确完成的任务数量计算。在这种情况下，刺激的传递将类似于消极情绪条件，除了我们不会实施消极情绪诱导机制（即，任务将不计时;装载标志将不显示;问题可以容易地回答;并且在结束时，系统将祝贺参与者正确地回答了问题）。因此，在任务中可能不会诱发负面情绪。在完成每一轮任务后，两种治疗的参与者将完成相同的目标导向任务，在此期间，我们将记录和分析鼠标光标的移动。通过使用相同的后续任务，我们可以将鼠标光标移动的差异归因于主要任务的负面情绪。由于每年的目标不同，第1年和第2年将使用不同的后续任务。在所有的实验之后，参与者将被听取汇报，被告知测试的真正目的，并且无论他们在研究中的表现或行为如何，都会得到最高的报酬。

The threat of malicious insiders is a top concern for governmental agencies and corporations. In general, malicious insiders are typically disgruntled employees who encounter a negative experience, or stressor, as a triggering event. Criminology research has long associated certain stressors with malicious behavior. Recent neuroscience and cognitive psychology research has unequivocally demonstrated that linkages exist between cognitive processing (e.g., cognitive conflict, emotion, arousal, etc.) and hand movements. In a human-computer interaction context, growing support has found that emotions influence mouse cursor movements. Importantly, this work has demonstrated that negative emotions associated with stressors influence users? mouse cursor movements. Building on this foundation, this work will answer critical questions regarding the identification of mouse curser data features that may indicate negative emotions induced by stressors. Specifically, year 1 will focus on understanding the efficacy of this approach when users know they are being monitored and trying to avoid being detected. And, for year 2, understand the efficacy of the approach for predicting the likelihood of whether a person will engage in a malicious online activity in real time.This two-year program of research will answer critical questions regarding the identification of mouse curser data features that may indicate negative emotions induced by stressors. The test environment for this work will be a multi-round, fair vs. unfair, serious game or testing scenario (e.g., intelligence test). In all studies, participants will be randomly assigned to one of the two treatments a fair (no manipulation) or unfair (negative emotion induced) experience (as well as other experimental manipulations depending on a particular study's objectives). In the treatment condition, the instructions will explain that the task will be timed, and that their score will be computed based on how many objectives they can complete correctly within the allotted time. To induce negative emotion, the task will appear to have technical problems loading the stimuli, will ask very difficult questions, and give participants a very short period of time to complete the tasks. Because of these "unfair" disadvantages, the system will attribute a low score to the participants, resulting in feelings of unfairness, frustration, and anger. Participants will also be told that because of their slow response time and incorrect answers, their score indicates a lower intelligence level than that of most people who have taken the test. As their score is outside of their control (resulting from the system being too slow and not giving them enough time to answer), the prior literature suggests that participants will have a negative emotional response from being judged unfairly. In the baseline condition, the instructions will explain to participants that they will complete a task and that their score will be computed based on how many tasks they complete correctly. The delivery of the stimuli in this condition will be similar to the negative-emotion condition, except that we will not implement the negative-emotion-inducing mechanisms (i.e., the task will not be timed; the loading signs will not be shown; the questions can easily be answered; and, at the conclusion, the system will congratulate participants for answering the questions correctly). Thus, negative emotion would likely not be induced in the task. After completing each round of the task, participants in both treatments will complete an identical goal-directed task, during which we will record and analyze mouse cursor movements. By using an identical follow-up task, we can attribute the difference in mouse cursor movements to negative emotion from the primary task. Different follow-up tasks will be used in Year 1 vs Year 2, as the goals of each year are different. After all experiments, participants will be debriefed, told the true purpose of the test, and given maximum payment regardless of their performance or behavior on the study.