Chapter 14 - Modeling the effects of network size in a deception game involving honeypots

Abstract

Cyberattacks, an intentional effort to capture information or interrupt a network, are growing. Prior research in cybersecurity has investigated the influence of network size on adversarial decisions in a deception game involving honeypots experimentally. However, little is known about the cognitive mechanisms that modulate the influence of network size on adversarial decisions. The primary objective of this research is to investigate how an instance-based learning(IBL) model involving recency, frequency, and cognitive noise would make predictions about adversarial decisions in the presence of networks of different sizes. The experimental study involved the use of a deception game (DG) across three between-subjects conditions of different network sizes: small, medium, and large (N=20 per condition). The results revealed that the proportion of honeypot and regular probes and attacks were more in the medium-sized and large-sized networks compared to small-sized networks. Similarly, the proportion of no-probe and no-attack actions were more in small-sized networks compared to medium- and large-sized networks. An IBL model was calibrated to the human decisions collected in the above experiment. An IBL model with ACT-R default parameters was also developed as a baseline. Results revealed that the IBL model with calibrated parameters explained adversary's decisions more accurately compared to the IBL model with ACT-R default parameters. Also, participants showed a greater reliance on recency and frequency of outcomes and smaller cognitive noise in their decision choices across three different network sizes. We highlight the main implications of our findings for the cognitive modeling community.