Towards a Cognitive Theory of Cyber Deception

This work is an initial step toward developing a cognitive theory of cyber deception. While widely studied, the psychology deception has largely focused on physical cues Given that present-day communication among humans electronic, we focus domain where are unavailable and for which there less psychological research. To improve defense, researchers have used signaling to extended algorithms developed optimal allocation limited defense resources by using deceptive signals trick human mind. However, designed protect against adversaries make perfectly rational decisions. In behavioral experiments abstract cybersecurity game (i.e., Insider Attack Game), examined decision-making when paired algorithm. We instance-based learning (IBL) model attacker Adaptive Control Thought-Rational (ACT-R) architecture investigate how decisions under in cyber-attack scenarios. Our results show algorithm more effective at reducing probability attack protecting assets signaling, compared no but than predicted adversary. Also, IBL replicates accurately. The shows arise from experience, memory retrieval dynamics can give rise biases, such as confirmation bias. implications these findings discussed perspective informing theories designing schemes consider bounded rationality.