COMMANDO-HUMANS: COMputational Modelling and Automatic Non-intrusive Detection Of HUMan behAviour based iNSecurity

该项目主要解决新加坡-英国联合呼吁的人为因素挑战，它拥有一个跨学科团队，具有网络安全，认知心理学和人机界面（HCI）方面的专业知识。它旨在通过应用人类认知模型来模拟和模拟安全系统中涉及的人类，从而产生与人类行为相关的不安全可以自动检测的直接证据。该项目的一个关键成果将是一个可被研究人员和实践者用于此目的的工作软件系统。该项目将把重点放在人类用户身份验证系统上，作为一个代表性的用例，并将产生关于人类行为在此类系统和一般安全系统中的作用的新知识。软件框架和关于人类行为的新知识也可以帮助解决呼叫的其他挑战（例如，检测入侵者/极端分子需要了解他们的行为方式；保护用户隐私需要了解人类用户如何处理个人数据；政策制定者需要了解其组织员工的行为和针对其组织的人类攻击者以做出更明智的决策）。众所周知，人为因素是网络安全的一个非常重要的方面，正如世界各国政府所认识到的那样，例如英国网络安全战略（2011年），新加坡2018年国家网络安全总体规划（2013年）和美国联邦网络安全研发战略计划（2011年）。人类相关的不安全感通常与有意或无意（可能是潜意识的）不安全的人类行为有关。为了研究人类行为（在网络安全、人机交互、心理学等相关领域），研究人员通常依靠真实人类用户的参与，通过调查、访谈、模拟场景、观察真实案例、互动游戏或其他专门设计的用户研究。这些方法通常耗时且昂贵，并且还存在其他问题，如有限和/或有偏见的样本，可疑的生态有效性，再现结果的困难，以及由于伦理/隐私/法律问题而无法进行某些研究。该项目旨在开发第一个（据我们所知）通用计算框架和支持软件工具，以便在不需要真正的人类用户参与的情况下，在HCI级别自动检测与不安全相关的人类行为。该框架将建立在人类认知过程、hci、人类行为相关攻击和安全措施的计算模型之上。框架将是非侵入性的：框架将评估系统和相关人员的抽象可执行模型，而不是评估正在运行的系统本身。将真实的人类用户从流程中移除，可以更快、更客观地检查给定安全系统的潜在不安全性。自动化过程仍然可以与传统的用户研究相结合，以便更好地利用有限的资源，自动检测值得进一步人工分析的潜在不安全问题。所开发的框架和软件工具对于网络安全研究人员、安全系统设计/开发人员和安全行业为最终用户提供更安全的系统具有重要价值。作为一个自然的副产品，它们还可以更容易地评估具有HCI的安全和非安全相关计算机系统的可用性。正如我们在上面的总结中提到的，对呼叫的其他挑战有关注的人也可以从项目的结果中受益。在这个项目中，我们将主要关注hci级别（“微观”）的人类行为，但也将研究对更高级别（“宏观”）行为的可能扩展（例如，人类用户如何通过排练和学习随着时间的推移适应他们的行为），为我们未来的研究铺平道路。

This project addresses mainly the Human Factors challenge of the joint Singapore-UK call, and it has an interdisciplinary team with expertise in cyber security, cognitive psychology, and human-computer interface (HCI). It aims at producing direct evidence that human behaviour related insecurity can be detected automatically by applying human cognitive models to model and simulate humans involved in security systems. A key outcome of the project will be a working software system that can be used for this purpose by researchers and practitioners. The project will focus on human user authentication systems as a representative use case and will produce new knowledge on the role of human behaviours in such systems and security systems in general. Both the software framework and new knowledge on human behaviours can also help address other challenges of the call (e.g., detection of intruders/extremists requires knowledge on how they behave; protection of user privacy require knowledge on how human users handle personal data; policy makers need to understand behaviours of their organisations' employees and human attackers targeting their organisations to make more informed decisions).It has been well known that human factors are a very important aspect of cyber security, as recognised by governments all over the world e.g., in the UK Cyber Security Strategy (2011), in Singapore's National Cyber Security Masterplan 2018 (2013), and in the US Federal Cybersecurity Research and Development Strategic Plan (2011). Human related insecurity is often related to intended or unintentional (maybe subconscious) insecure human behaviours. To conduct research on human behaviours (in cyber security, HCI, psychology and other related fields), researchers normally depend on involvement of real human users via surveys, interviews, simulated scenarios, observations of real cases, interactive games, or other specially designed user studies. Such approaches are often time-consuming and costly, and suffer from other issues like limited and/or biased samples, questionable ecological validity, difficulties in reproducing results, and impossibility of running some studies due to ethical/privacy/legal concerns.This project aims at developing the first (to the best our knowledge) general-purpose computational framework and supporting software tools that will enable automatic detection of human behaviour related insecurity at the HCI level without the need to involve real human users. The framework will be built on computational models of human cognitive processes, HCIs, human behaviour related attacks and (in)security measures. The framework will be non-intrusive: instead of evaluating the running system itself, the framework will evaluate an abstract executable model of the system and humans involved. Removing real human users from the process allows faster and more objective inspection of potential insecurity of a given security system. The automated process can still be combined with traditional user studies to make better use of limited resources in automatically detecting potential insecurity problems deserving further manual analysis.The framework and software tools developed will be of great value for cyber security researchers, security system designers/developers and security industry to deliver securer systems to end users. As a natural byproduct, they will also allow easier evaluation of usability of security and non-security related computer systems with an HCI. As we mentioned above in this summary, people having concerns on other challenges of the call can benefit from the project's outcomes as well.In this project we will focus mainly on HCI-level ("micro") human behaviours, but possible extensions to higher-level ("macro") behaviours (e.g., how human users adapt their behaviours over time via rehearsals and learning) will be looked at as well to pave the way for our future research.