Modelling the Security Analyst’s Role: Effects of Similarity and Past Experience on Cyber Attack Detection

Cyber attacks, the disruption of normal functioning of computers in a network due to malicious events (threats), are becoming widespread. Security analysts are likely to play an important role in protecting networks by accurately and timely detecting cyber attacks. However, currently little is known on how certain cognitive factors might influence the analyst’s accurate and timely detection. In this paper, we investigate the role of two cognitive factors, (i) similarity between present and past events and, (ii) past experience, which are likely to influence a simulated analyst’s detection of cyber attacks. We use an existing cognitive model, based upon Instance-Based Learning Theory (IBLT), which represents the decision-making process of a security analyst. We manipulate the experience and similarity assumptions in the model and evaluate their effects on the model’s accurate and timely detection of cyber attacks. An IBL model was defined by experience of threats in memory: threat-prone (75% threats and 25% non-threats) and nonthreat-prone (25% threats and 75% non-threats); and, different similarity mechanisms to compare experiences in memory with network events: geometric and feature-based. Results reveal that experience plays a significant role in cyber attack detection while the role of similarity is much smaller. We highlight the implications of our findings for training human security analysts in their job.