Search

Objective: We aim to learn about the cognitive mechanisms governing the decisions of attackers and defenders in cybersecurity involving intrusion detection systems (IDSs)., Background: Prior research has experimentally studied the role of the presence and accuracy of IDS alerts on attacker's and defender's decisions using a game-theoretic approach. However, little is known about the cognitive mechanisms that govern these decisions., Method: To investigate the cognitive mechanisms governing the attacker's and defender's decisions in the presence of IDSs of different accuracies, instance-based learning (IBL) models were developed. One model (NIDS) disregarded the IDS alerts and one model (IDS) considered them in the instance structure. Both the IDS and NIDS models were trained in an existing dataset where IDSs were either absent or present and they possessed different accuracies. The calibrated IDS model was tested in a newly collected test dataset where IDSs were present 50% of the time and they possessed different accuracies., Results: Both the IDS and NIDS models were able to account for human decisions in the training dataset, where IDS was absent or present and it possessed different accuracies. However, the IDS model could accurately predict the decision-making in only one of the several IDS accuracy conditions in the test dataset., Conclusions: Cognitive models like IBL may provide some insights regarding the cognitive mechanisms governing the decisions of attackers and defenders in conditions not involving IDSs or IDSs of different accuracies., Application: IBL models may be helpful for penetration testing exercises in scenarios involving IDSs of different accuracies.

Objective: To determine the effects of an adversary's behavior on the defender's accurate and timely detection of network threats., Background: Cyber attacks cause major work disruption. It is important to understand how a defender's behavior (experience and tolerance to threats), as well as adversarial behavior (attack strategy), might impact the detection of threats. In this article, we use cognitive modeling to make predictions regarding these factors., Method: Different model types representing a defender, based on Instance-Based Learning Theory (IBLT), faced different adversarial behaviors. A defender's model was defined by experience of threats: threat-prone (90% threats and 10% nonthreats) and nonthreat-prone (10% threats and 90% nonthreats); and different tolerance levels to threats: risk-averse (model declares a cyber attack after perceiving one threat out of eight total) and risk-seeking (model declares a cyber attack after perceiving seven threats out of eight total). Adversarial behavior is simulated by considering different attack strategies: patient (threats occur late) and impatient (threats occur early)., Results: For an impatient strategy, risk-averse models with threat-prone experiences show improved detection compared with risk-seeking models with nonthreat-prone experiences; however, the same is not true for a patient strategy., Conclusions: Based upon model predictions, a defender's prior threat experiences and his or her tolerance to threats are likely to predict detection accuracy; but considering the nature of adversarial behavior is also important., Application: Decision-support tools that consider the role of a defender's experience and tolerance to threats along with the nature of adversarial behavior are likely to improve a defender's overall threat detection.

In decisions from experience, there are 2 experimental paradigms: sampling and repeated-choice. In the sampling paradigm, participants sample between 2 options as many times as they want (i.e., the stopping point is variable), observe the outcome with no real consequences each time, and finally select 1 of the 2 options that cause them to earn or lose money. In the repeated-choice paradigm, participants select 1 of the 2 options for a fixed number of times and receive immediate outcome feedback that affects their earnings. These 2 experimental paradigms have been studied independently, and different cognitive processes have often been assumed to take place in each, as represented in widely diverse computational models. We demonstrate that behavior in these 2 paradigms relies upon common cognitive processes proposed by the instance-based learning theory (IBLT; Gonzalez, Lerch, & Lebiere, 2003) and that the stopping point is the only difference between the 2 paradigms. A single cognitive model based on IBLT (with an added stopping point rule in the sampling paradigm) captures human choices and predicts the sequence of choice selections across both paradigms. We integrate the paradigms through quantitative model comparison, where IBLT outperforms the best models created for each paradigm separately. We discuss the implications for the psychology of decision making., (© 2011 American Psychological Association)

Systematicity is a property of cognition where capacity for certain cognitive abilities implies capacity for certain other (structurally related) cognitive abilities. This property is thought to derive from a capacity to represent/process common structural relations between constituents of cognizable entities, however, systematicity may not always materialize in such admissible contexts. A theoretical challenge is to explain why systematicity fails to materialize in contexts that allow the realization (e.g., by induction) of common structure (universal construction). We hypothesize that one cause of failure arises when the potential gain afforded by induction of common structure is overshadowed by the immediate benefit of learning the task as independent stimulus-response associations. This hypothesis was tested in an experiment that required learning two series of pair maps that involved products (universal construction), or non-products (control) of varied size: the number of unique cue/target elements (three to six) constituting pairs. Each series was learned in either ascending or descending order of size. Only performance on the product series was affected by order: systematicity was obtained universally in the descend group, but only on large sets in the ascend group, as revealed by the significant order size interaction for errors in the product condition, F(3, 87) = 3.38, p < 0.05. Smaller maps are more easily learned without inducing the common product structure, which is more readily observable with larger maps: larger maps provide more evidence for relationships between stimulus dimensions that facilitate the discovery of the common structure. The new challenge, then, is to explain the systematic learnability of stimulus-response maps, i.e., second-order systematicity. [ABSTRACT FROM AUTHOR]

We analyze the dynamics of repeated interaction of two players in the Prisoner's Dilemma ( PD) under various levels of interdependency information and propose an instance-based learning cognitive model ( IBL- PD) to explain how cooperation emerges over time. Six hypotheses are tested regarding how a player accounts for an opponent's outcomes: the selfish hypothesis suggests ignoring information about the opponent and utilizing only the player's own outcomes; the extreme fairness hypothesis weighs the player's own and the opponent's outcomes equally; the moderate fairness hypothesis weighs the opponent's outcomes less than the player's own outcomes to various extents; the linear increasing hypothesis increasingly weighs the opponent's outcomes at a constant rate with repeated interactions; the hyperbolic discounting hypothesis increasingly and nonlinearly weighs the opponent's outcomes over time; and the dynamic expectations hypothesis dynamically adjusts the weight a player gives to the opponent's outcomes, according to the gap between the expected and the actual outcomes in each interaction. When players lack explicit feedback about their opponent's choices and outcomes, results are consistent with the selfish hypothesis; however, when this information is made explicit, the best predictions result from the dynamic expectations hypothesis. [ABSTRACT FROM AUTHOR]

Hills and Hertwig (2012) challenge the proposed similarity of the exploration-exploitation transitions found in Gonzalez and Dutt (2011) between the 2 experimental paradigms of decisions from experience (sampling and repeated-choice), which was predicted by an instance-based learning (IBL) model. The heart of their argument is that in the sampling paradigm, an impression of reduced exploration over time (alternation rate, A-rate) is produced by an inverse relationship between the sample size and the A-rate, and the aggregation of participants with different sample sizes. They suggest a normalization of the A-rate, which produces constant A-rate curves during sampling, and conclude with certain "ensuing problems for the IBL model." We show that the reduction of A-rate during sampling occurs even when sample length is controlled for; that regardless of the sampling length, the maximization behavior during sampling predicts the final choice; and that the IBL model accounts for a negative correlation between sample size and the predicted A-rate. Furthermore, when the IBL model's A-rates are normalized they result in a flattened exploration curve similar to that found in human data. These results indicate that the transition from exploration to exploitation in the sampling paradigm (which has also been found in the repeated-choice paradigm) is not an illusion resulting from data aggregation; and furthermore, the same data with or without normalization may be interpreted differently, but such interpretations do not invalidate the mechanisms of the IBL model. [ABSTRACT FROM AUTHOR]

Abstract: This paper focuses on the creation and presentation of a user-friendly experience for developing computational models of human behavior. Although computational models of human behavior have enjoyed a rich history in cognitive psychology, they have lacked widespread impact, partly due to the technical knowledge and programming required in addition to the complexities of the modeling process. We describe a modeling tool called IBLTool that is a computational implementation of the Instance-based Learning Theory (IBLT). IBLT is a theory that represents how decisions are made from experience in dynamic tasks. The IBLTool makes IBLT usable and understandable to a wider community of cognitive and behavioral scientists. The tool uses graphical user interfaces that take a modeler step-by-step through several IBLT processes and help the modeler derive predictions of human behavior in a particular task. A task would connect and interact with the IBLTool and store the decision-making data while the tool collects statistical data from the execution of a model for the task. We explain the functioning of the IBLTool and demonstrate a concrete example of the design and execution of a model for the Iowa Gambling task. The example is intended to provide a concrete demonstration of the capabilities of the IBLTool. [Copyright &y& Elsevier]

ABSTRACT A common practice in cognitive modeling is to develop new models specific to each particular task. We question this approach and draw on an existing theory, instance-based learning theory (IBLT), to explain learning behavior in three different choice tasks. The same instance-based learning model generalizes accurately to choices in a repeated binary choice task, in a probability learning task, and in a repeated binary choice task within a changing environment. We assert that, although the three tasks are different, the source of learning is equivalent and therefore, the cognitive process elicited should be captured by one single model. This evidence supports previous findings that instance-based learning is a robust learning process that is triggered in a wide range of tasks from the simple repeated choice tasks to the most dynamic decision making tasks. Copyright © 2010 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]