This work is an initial step toward developing a cognitive theory of cyber deception. While widely studied, the psychology of deception has largely focused on physical cues of deception. Given that present-day communication among humans is largely electronic, we focus on the cyber domain where physical cues are unavailable and for which there is less psychological research. To improve cyber defense, researchers have used signaling theory to extended algorithms developed for the optimal allocation of limited defense resources by using deceptive signals to trick the human mind. However, the algorithms are designed to protect against adversaries that make perfectly rational decisions. In behavioral experiments using an abstract cybersecurity game (i.e., Insider Attack Game), we examined human decision-making when paired against the defense algorithm. We developed an instance-based learning (IBL) model of an attacker using the Adaptive Control of Thought-Rational (ACT-R) cognitive architecture to investigate how humans make decisions under deception in cyber-attack scenarios. Our results show that the defense algorithm is more effective at reducing the probability of attack and protecting assets when using deceptive signaling, compared to no signaling, but is less effective than predicted against a perfectly rational adversary. Also, the IBL model replicates human attack decisions accurately. The IBL model shows how human decisions arise from experience, and how memory retrieval dynamics can give rise to cognitive biases, such as confirmation bias. The implications of these findings are discussed in the perspective of informing theories of deception and designing more effective signaling schemes that consider human bounded rationality.

中文翻译：

---

走向网络欺骗的认知理论

这项工作是发展网络欺骗认知理论的第一步。虽然被广泛研究，但欺骗心理学主要集中在欺骗的物理线索上。鉴于当今人类之间的交流主要是电子化的，我们专注于无法获得物理线索且心理学研究较少的网络领域。为了改善网络防御，研究人员使用信号理论来扩展算法，通过使用欺骗性信号来欺骗人类思想，以优化有限的防御资源的分配。但是，这些算法旨在防止对手做出完全合理的决定。在使用抽象网络安全游戏（即内部攻击游戏）的行为实验中，我们检查了与防御算法配对时的人类决策。我们使用思想理性自适应控制 (ACT-R) 认知架构开发了攻击者的基于实例的学习 (IBL) 模型，以研究人类如何在网络攻击场景中以欺骗手段做出决策。我们的结果表明，与不使用信号相比，防御算法在使用欺骗性信号时在降低攻击概率和保护资产方面更有效，但在对抗完全理性的对手时不如预测的有效。此外，IBL 模型准确地复制了人类攻击决策。IBL 模型显示了人类决策如何从经验中产生，以及记忆检索动态如何引起认知偏差，例如确认偏差。