Abstract:<p>This work is an initial step toward developing a cognitive theory of cyber deception. While widely studied, the psychology of deception has largely focused on physical cues of deception. Given that present-day communication among humans is largely electronic, we focus on the cyber domain where physical cues are unavailable and for which there is less psychological research. To improve cyber defense, researchers have used signaling theory to extended algorithms developed for the optimal allocation of limited defense resources by using deceptive signals to trick the human mind. However, the algorithms are designed to protect against adversaries that make perfectly rational decisions. In behavioral experiments using an abstract cybersecurity game (i.e., Insider Attack Game), we examined human decision-making when paired against the defense algorithm. We developed an instance-based learning (IBL) model of an attacker using the Adaptive Control of Thought-Rational (ACT-R) cognitive architecture to investigate how humans make decisions under deception in cyber-attack scenarios. Our results show that the defense algorithm is more effective at reducing the probability of attack and protecting assets when using deceptive signaling, compared to no signaling, but is less effective than predicted against a perfectly rational adversary. Also, the IBL model replicates human attack decisions accurately. The IBL model shows how human decisions arise from experience, and how memory retrieval dynamics can give rise to cognitive biases, such as confirmation bias. The implications of these findings are discussed in the perspective of informing theories of deception and designing more effective signaling schemes that consider human bounded rationality.</p>

WiP: Deception-in-Depth Using Multiple Layers of Deception

Three Decades of Deception Techniques in Active Cyber Defense -- Retrospect and Outlook

Application Layer Cyber Deception without Developer Interaction

Decoys in Cybersecurity: An Exploratory Study to Test the Effectiveness of 2-sided Deception

Hiding and Trapping: A Deceptive Approach for Defending against Network Reconnaissance with Software-Defined Network

Deep Down the Rabbit Hole: On References in Networks of Decoy Elements

Deception Maze: A Stackelberg Game-Theoretic Defense Mechanism for Intranet Threats

Incorporating Deception into CyberBattleSim for Autonomous Defense

Deception by Design: Evidence-Based Signaling Games for Network Defense

Evaluating Deception and Moving Target Defense with Network Attack Simulation

Active Deception using Factored Interactive POMDPs to Recognize Cyber Attacker's Intent

Game of Travesty: Decoy-based Psychological Cyber Deception for Proactive Human Agents

A Proactive Decoy Selection Scheme for Cyber Deception using MITRE ATT&CK

Weaving Tangled Webs: Offense, Defense, and Deception in Cyberspace

Game Theory Approaches for Evaluating the Deception-based Moving Target Defense

A Game-theoretic Taxonomy and Survey of Defensive Deception for Cybersecurity and Privacy

Cyber Deception Reactive: TCP Stealth Redirection to On-Demand Honeypots

Towards a Cognitive Theory of Cyber Deception

From Cyber-Security Deception To Manipulation and Gratification Through Gamification

Towards a Believable Decoy System: Replaying Network Activities from Real System

Towards in-situ Psychological Profiling of Cybercriminals Using Dynamically Generated Deception Environments