In 1974 an article appeared in Science magazine with the dry-sounding title “Judgment Under Uncertainty: Heuristics and Biases” by a pair of psychologists who were not well known outside their discipline of decision theory. In it Amos Tversky and Daniel Kahneman introduced the world to Prospect Theory, which mapped out how humans actually behave when faced with decisions about gains and losses, in contrast to how economists assumed that people behave. Prospect Theory turned Economics on its head by demonstrating through a series of ingenious experiments that people are much more concerned with losses than they are with gains, and that framing a choice from one perspective or the other will result in decisions that are exactly the opposite of each other, even if the outcomes are monetarily the same. Prospect Theory led cognitive psychology in a new direction that began to uncover other human biases in thinking that are probably not learned but are part of our brain’s wiring.

Thinking fast and slow.

An attack graph is a succinct representation of all paths through a system that end in a state where an intruder has successfully achieved his goal. Today Red Teams determine the vulnerability of networked systems by drawing gigantic attack graphs by hand. Constructing attack graphs by hand is tedious, error-prone, and impractical for large systems. By viewing an attack as a violation of a safety property, we can use off-the-shelf model checking technology to produce attack graphs automatically: a successful path from the intruder's viewpoint is a counterexample produced by the model checker In this paper we present an algorithm for generating attack graphs using model checking as a subroutine. Security analysts use attack graphs for detection, defense and forensics. In this paper we present a minimization analysis technique that allows analysts to decide which minimal set of security measures would guarantee the safety of the system. We provide a formal characterization of this problem: we prove that it is polynomially equivalent to the minimum hitting set problem and we present a greedy algorithm with provable bounds. We also present a reliability analysis technique that allows analysts to perform a simple cost-benefit trade-off depending on the likelihoods of attacks. By interpreting attack graphs as Markov Decision Processes we can use the value iteration algorithm to compute the probabilities of intruder success for each attack the graph.

Two Formal Analyses of Attack Graphs

Cybercrime is estimated to have cost the global economy just under USD 1 trillion in 2020, indicating an increase of more than 50% since 2018. With the average cyber insurance claim rising from USD 145,000 in 2019 to USD 359,000 in 2020, there is a growing necessity for better cyber information sources, standardised databases, mandatory reporting and public awareness. This research analyses the extant academic and industry literature on cybersecurity and cyber risk management with a particular focus on data availability. From a preliminary search resulting in 5219 cyber peer-reviewed studies, the application of the systematic methodology resulted in 79 unique datasets. We posit that the lack of available data on cyber risk poses a serious problem for stakeholders seeking to tackle this issue. In particular, we identify a lacuna in open databases that undermine collective endeavours to better manage this set of risks. The resulting data evaluation and categorisation will support cybersecurity researchers and the insurance industry in their efforts to comprehend, metricise and manage cyber risks.The online version contains supplementary material available at 10.1057/s41288-022-00266-6. 

/pdf/cyber-risk-and-cybersecurity-a-systematic-review-of-data-twh9lpjv.pdf

Cyber risk and cybersecurity: a systematic review of data availability

/pdf/cyber-risk-and-cybersecurity-a-systematic-review-of-data-1k47k809.pdf

Human-centricity is the core value behind the evolution of manufacturing towards Industry 5.0. Nevertheless, there is a lack of architecture that considers safety, trustworthiness, and human-centricity at its core. Therefore, we propose an architecture that integrates Artificial Intelligence (Active Learning, Forecasting, Explainable Artificial Intelligence), simulated reality, decision-making, and users' feedback, focusing on synergies between humans and machines. Furthermore, we align the proposed architecture with the Big Data Value Association Reference Architecture Model. Finally, we validate it on three use cases from real-world case studies.

Human-Centric Artificial Intelligence Architecture for Industry 5.0 Applications

/pdf/malware-in-the-future-forecasting-of-analyst-detection-of-3w5rfzot2l.pdf

Malware in the future? Forecasting of analyst detection of cyber events

We describe a web and standalone Shiny app for calculating the common, linear within-individual association for repeated assessments of paired measures with multiple individuals: repeated measures correlation (rmcorr). This tool makes rmcorr more widely accessible, providing a graphical interface for performing and visualizing the output of analysis with rmcorr. In contrast to rmcorr, most widely used correlation techniques assume paired data are independent. Incorrectly analyzing repeated measures data as independent will likely produce misleading results. Using aggregation or separate models to address the issue of independence may obscure meaningful patterns and will also tend to reduce statistical power. rmcorrShiny (repeated measures correlation Shiny) provides a simple and accessible solution for computing the repeated measures correlation. It is available at: https://lmarusich.shinyapps.io/shiny_rmcorr/.

rmcorrShiny: A web and standalone application for repeated measures correlation.

: We describe the design of human-machine conversation experiments that support the evaluation of our context aware approach in coalition decision making at or near the network edge. The studies, named SHERLOCK (for Simple Human Experiments Regarding Locally Observed Collective Knowledge), involve humans participating in simple intelligence, surveillance, and reconnaissance (ISR) tasks in physical environments, using mobile devices in situ, or online. Experimental tasks are undertaken by multiple participants operating as a coalition, with collaboration mediated by machine agents. We illustrate the SHERLOCK using two specific experiment designs. In each one, the participants task is to locate a number of target individuals and identify their specific features. Experiment 1 is a crowdsourcing whodunit scenario involving intelligence in synthetic, natural, and hidden situations. All human input is via a conversational agent which mediates information sharing between participants. Experiment 2 is an ISR asset assignment scenario, using simulated sensing assets selected either by a human, via an algorithm, or a combination of the human and machine. Participants success in both experiments depends on their ability to make effective use of the conversational system, including being able to provide interpretable information to the conversational agent, and to obtain information via the conversational interface to assist them.

SHERLOCK: Simple Human Experiments Regarding Locally Observed Collective Knowledge

The increasing use of Artificial Intelligence (AI) systems in face recognition and video processing in recent times creates higher stakes for their application in daily life Increasingly, critical decisions are being made using these AI systems in application domains such as employment, finance, and crime prevention These applications are done through the use of more abstract concepts such as emotions, trait evaluations (eg, trustworthiness), and behavior (eg, deception) These abstract concepts are learned by the AI system using the verbal and non-verbal cues from the human subject stimuli (e,g, facial expressions, movements, audio, text) for inference Because the use of AI systems often happens in high stakes scenarios, it is of utmost importance that the AI system participating in the decision-making process is highly reliable and credible In this paper, we specifically consider the feasibility of using such an AI system for deception detection We examine if deception can be caught using multimodal aspects such as facial expressions and movements, audio cues, video cues, etc We experiment using three different datasets with varying degrees of deception to explore the problem of deception detection We also study state-of-the-art deception detection systems and investigate whether we can extend their algorithm into new datasets We conclude that there is a lack of reasonable evidence that AI-based deception detection is generalizable over different scenarios of lying (lying deliberately, lying under duress, and lying through half-truths) and that in the future additional factors will need to be considered to make such a claim

MultiModal Deception Detection: Accuracy, Applicability and Generalizability*

Whether in meta-analysis or single experiments, selecting results based on statistical significance leads to overestimated effect sizes, impeding falsification. We critique a quantitative synthesis that used significance to score and select previously published effects for situation awareness-performance associations (Endsley, 2019). How much does selection using statistical significance quantitatively impact results in a meta-analytic context? We evaluate and compare results using significance-filtered effects versus analyses with all effects as-reported. Endsley reported high predictiveness scores and large positive mean correlations but used atypical methods: the hypothesis was used to select papers and effects. Papers were assigned the maximum predictiveness scores if they contained at-least-one significant effect, yet most papers reported multiple effects, and the number of non-significant effects did not impact the score. Thus, the predictiveness score was rarely less than the maximum. In addition, only significant effects were included in Endsley's quantitative synthesis. Filtering excluded half of all reported effects, with guaranteed minimum effect sizes based on sample size. Results for filtered compared to as-reported effects clearly diverged. Compared to the mean of as-reported effects, the filtered mean was overestimated by 56%. Furthermore, 92% (or 222 out of 241) of the as-reported effects were below the mean of filtered effects. We conclude that outcome-dependent selection of effects is circular, predetermining results and running contrary to the purpose of meta-analysis. Instead of using significance to score and filter effects, meta-analyses should follow established research practices.

/pdf/statistical-significance-filtering-overestimates-effects-and-2c4nb2qm6k.pdf

Jonathan Z. Bakdash

Papers

Malware in the future? Forecasting of analyst detection of cyber events

rmcorrShiny: A web and standalone application for repeated measures correlation.

SHERLOCK: Simple Human Experiments Regarding Locally Observed Collective Knowledge

MultiModal Deception Detection: Accuracy, Applicability and Generalizability*

Statistical Significance Filtering Overestimates Effects and Impedes Falsification: A Critique of.