Cyber security: testing the effects of attack strategy, similarity, and experience on cyber attack detection

Abstract

Cyber attacks, the disruption of normal functioning of computers in a network due to malicious events (threats), are becoming widespread and the role of security analysts is becoming important in protecting networks by accurately and timely detecting cyber attacks. In this paper, we investigate the role of two internal factors, similarity and experience, and an external factor, strategy of an attacker, to influence a simulated analyst’s detection of cyber attacks. We use an existing cognitive model, based upon instance-based learning theory, which represents the decision-making process of a security analyst. We manipulate the attack strategy, experience, and similarity assumptions and evaluate their effects on model’s accurate and timely detection of cyber attacks. Results revealed that although experience and strategy played a significant role in cyber attack detection; the role of similarity was much smaller. We highlight the implications of our findings for training human security analysts in their job.