MEASURING THE EFFECTIVENESS OF VISUAL ANALYTICS AND DATA FUSION TECHNIQUES ON SITUATION AWARENESS IN CYBER-SECURITY

  • : Ms Word, Ms Word Format
  • : 70 Pages
  • : ₦3,000 | $25 | ₵60 | Ksh 2720
  • : 1-5 Chapters
  •  
  • Click to DOWNLOAD Materials

MEASURING THE EFFECTIVENESS OF VISUAL ANALYTICS AND DATA FUSION TECHNIQUES ON SITUATION AWARENESS IN CYBER-SECURITY

ABSTRACT

Cyber-security involves the monitoring a complex network of inter-related computers to prevent, identify and remediate from undesired actions. This work is performed in organizations by human analysts. These analysts monitor cyber-security sensors to develop and maintain situation awareness (SA) of both normal and abnormal activities that occur on the network. Additionally, analysts remediate compromised computers and attempt to configure networks securely to ensure that known vulnerabilities cannot be exploited.

Research and development of new fusion algorithms and visual interface, both in academia and in industry, have the objective of increasing cyber-security situation awareness. However, it is uncommon for developers to assess the actual impact on a human analyst’s performance, situational knowledge, perceived effectiveness or perceived workload. In short, it is not proven that a new tool will increase situation awareness or not, because the analyst’s SA is not measured.

This dissertation addresses the issue of measuring the impact of interface design on SA through the implementation of an SA Assessment Battery for the cyber domain. While there are a number of SA assessment techniques, they are designed for other domains, especially military command and control, aircraft piloting and air traffic control. This dissertation leverages this work and implements these assessment techniques for the cyber-security domain.

This work validates the assessment battery through the comparison of two different interface designs (“high” and “low” perceived workload) with two groups of research subjects (“novices” and “experts”) in a 2×2 between-subjects experiment. The interpretation of the results from this study demonstrates how SA assessment techniques that were previously considered incompatible can be used together to evaluate the impact of the effectiveness of the interface separately from the impact of experience of the human analyst.

 

Chapter 1 

The Importance of Situation Awareness in Cyber-security

Cyber-security is a domain in which one or more individual analysts monitor a complex inter-related network of host computers and software to defend it against unauthorized use. The computer network being monitored itself is a complex and dynamic system that is further complicated by a rapidly evolving threat landscape of attack methods from hackers. Hackers use automated tools to develop exploits, probe remote systems, launch attacks and compromise hosts. Once systems are compromised, hackers then use them to launch further attacks against their next set of targets. Analysts must develop and maintain situation awareness (SA) of the normal traffic of the networks they protect, identify anomalous traffic, classify undesired traffic, report intrusions and identify compromised hosts. Analysts must remediate these issues to ensure that systems do not remain vulnerable to future attempted exploits. Failures in maintaining good SA result in the loss of confidential data, theft of bandwidth or denial of service as systems are taken offline. Systems and services may be taken offline by the actions of the hacker directly, such as in a denial of service attack, or during remediation as the operational information technology (IT) staff attempts to repair the damage caused by malware. Potentially irrevocable damage to critical infrastructure can be caused by cyber-attacks.

New systems are rapidly being developed to correlate cyber data, fuse cyber sensor data of multiple types and from multiple sources. Additional systems are being developed to present this data in either static or dynamic visual representations to support the analytic processes in an effort to increase cyber situation awareness. However, rarely are these new systems evaluated to ensure that they are actually successful at increasing cyber situation awareness. This may be due to a failure to implement a specific instance of an SA measurement technique for the cybersecurity domain. A systematic review of the SA literature reveals several techniques, some of which are grounded in one of three competing theories of SA.

Proposed here is an Integrated Framework of SA that addresses limitations in the three prevalent theoretical models of SA. Further suggested is a method for using the apparently conflicting SA measurement techniques into a single SA Assessment Battery. Using the complex system of cyber-security, a specific implantation of the SA Assessment Battery has been created address measurement of cyber SA and to support the battery’s practicality.

The Scope of the Cyber-security Situation Awareness Problem

This section highlights some of the problems that occur when the lack of situation awareness in cyber-security allows for hackers to exploit computer systems. Specific cases are presented where failure to maintain cyber situation awareness have resulted in the loss of data, especially where that loss requires the disclosure of the failure as a matter of public record. This is especially problematic when the data lost can be monetized by the cybercriminal. Loss of credit card numbers, social security numbers, personally identifiable information in health records and other similar data are often required to be reported and published publicly in the United States and other countries where breach disclosure laws are in effect. However, many other organizations and government agencies do not report when their computers have been hacked and only internal data has been lost. Even though disclosure is uncommon in these cases, some highprofile cases are reported in the press because of their widespread nature, or unique circumstances. Both types of cyber-security incidents are presented in the following sections to illustrate how pervasive this problem has become.

Failures in Cyber-security Due to Lack of Situation Awareness

This section outlines several examples of recent high profile cyber-security incidents.

Each incident was implemented by highly motivated hackers, some with nation-state sponsorship. The successes of these hackers were amplified as network security personnel at these organizations failed to maintain appropriate awareness of the cyber-security situation. In some cases, there was little or no cyber-security technology in place. In others, specific cues were ignored. Had the systems in place been monitored effectively, the initial hack would have been noticed in much earlier in the timeline and the damage would have been mitigated. However, since these break-ins went undetected, often for months at a time, hackers were allowed to progress through complex multi-stage attacks to gain access to the confidential data they desired.

Table 1. Recent data breaches at U.S. colleges and universities from SC Magazine’s Data Breach Blog [1]

Organization Name Year Records Lost
The Pennsylvania State University 2010 30,000
Virginia Commonwealth Univ. 2011 175,000
Purdue University 2011 7,000
The Ohio State University 2011 760,000
University of Rhode Island 2012 1,100
University of South Carolina 2012 34,000
British Columbia Institute of Technology 2012 12,680
University of Southern California 2012 Undisclosed
University of North Florida 2012 23,246
University of Nebraska 2012 654,000
UNC Charlotte 2012 350,000
Housatonic Community College (CT) 2012 87,000
Central Connecticut State University 2012 18,275
Indiana University (Hospital) 2012 12,874

 

Data breaches at universities in the United States have received a lot of attention in recent years due to disclosure laws (See Table 1). As an example, The Pennsylvania State University may have lost 30,000 social security numbers and notified individuals in December 2009 when several different computers containing them were compromised with malware (Schackner, 2009). This is not terribly uncommon; as universities in the United States have long been targets for hackers due to historically lax security and always-on high speed computer network access. However, recently-passed state and federal laws require action when organizations have (or may have) disclosed personally identifiable information (PII) such as social security numbers, dates of birth and other information that could be used for identity theft. Other examples include Virginia Commonwealth University notifying over 175,000 people that a computer storing their PII had been compromised by malware in November 2011 (Moscaritolo, 2011b). In August 2011, Purdue University notified over 7,000 people that their PII was on a server that was compromised by hackers over 14 months prior (Moscaritolo, 2011a). In December 2010, The Ohio State University notified over 760,000 people including current and past faculty, staff and students that their PII was on a compromised critical server, costing OSU up to $4 million in costs for notification, investigation and credit monitoring (Marotti, 2010).

In each of these cases, there was no evidence that hackers had accessed the PII, or that anyone’s identity had been stolen. Instead, because the computer had been compromised and confidential information was potentially accessed, the Universities erred on the side of caution and notified the affected individuals about the breach (in compliance with notification laws). This highlights a lack of Cyber SA on several levels. Cyber-security analysts were not effectively monitoring the systems to ensure that they are patched and were not compromised. They were not aware of the high value of the data stored on these systems. Otherwise, the data at rest would be been secured more effectively through encryption. Finally, they were not monitoring the network effectively to identify inappropriate remote connection, installation of active backdoors or remote control software nor were they monitoring the network for signs of exfiltration of the sensitive data.

For the 24 month period from August 2010-2012, there has been a steady increase of reports of loss of confidential data by organizations. It is possible that the increase in reporting is simply due to new disclosure laws, and that the breaches themselves have maintained a constant rate. However, their prevalence in the mainstream media over the past two years is alarming. SC

Magazine’s Data Breach Blog collects news reports of such disclosures. Two years ago, the rate of occurrence was about two major events per month (Figure 1). Today, there is a threefold increase in incidents, with six major incidents per month being reported. The size of incidents and number of confidential records potentially disclosed is also alarmingly on the rise with single incidents often resulting in the loss of millions of records at a time.

 

Figure 1. Data breaches per month from SC Magazine Data Breach Blog [2] for all organizations  Higher profile cases of hacking have resulted in the loss of confidential data and PII in staggering numbers. In the last several years, oil companies have been targeted by hackers,

presumed to be working on behalf of the Chinese government. For example in November 2009, complex coordinated attacks (dubbed “Night Dragon” by security company MacAfee) against Clevel executives at major petrochemical corporations have had their computers compromised with highly targeted multi-stage attacks. The hackers successfully exfiltrated confidential company data about company operations, project financing and closely guarded data such as the testing data from new oil and gas fields. SQL Injection and Spear-Phishing attacks were coordinated with custom modification of Trojan variants to create back doors and the installation of remote administration tools. Implied in the report is a failure of cyber-security analysts at these companies to maintain awareness of the attacks on web servers, the installation of the Trojan applications on host systems and the lack of encryption of data at rest on the compromised computers. Most important is the failure to identify the network communication between internal systems and the command and hacker’s control computers, which was characterized as beaconing as often as every five seconds (McAfee, 2011).

In the summer of 2011, a root certificate authority (CA), DigiNotar was successfully compromised by the hacker “Janam Fadaye Rahbar.” The hacker gained control of the CA’s SSL certificate creation systems and issued over 500 fraudulent certificates. These certificates included popular web locations such as Google, Microsoft Updates, Skype, WordPress, Twitter, America Online, Facebook, Equifax and many others. The fake certificates had been issued for approximately two months and had been actively and successfully used in a complex man-in-the middle attack against people of Iran prior to the incident being reported. A blog post from an end user detailed SSL errors encountered on a browser in Iran started a more comprehensive forensic analysis which eventually uncovered the vast scope of the damage. During the forensic analysis, poor security system design and practices at DigiNotar were noted as was a failure of the intrusion prevention system. Implied in the report is a complete lack of awareness that these events occurred, which should have been identified in various system logs (Fox-IT, 2011). The

Iranian government is speculated to have sponsored the DigiNotar hack, modified the DNS at the country’s internet service providers to implement the man-in-the-middle attack and spy on the

electronic communications of its dissident citizens. (Sterling, 2011; Wisniewski, 2011).

In November, 2012, the state of South Carolina reported that its income tax electronic filing system had been compromised by hackers. The hackers used a spear-phishing campaign to deliver malware targeted at employees of the South Carolina Department of Revenue. A single employee fell victim to the attack and a single set of credentials were released to the hackers. Over the next two week period, the initial credentials acquired were used to conduct reconnaissance, access the central database and interact with a variety of different systems. Eventually, the hackers successfully located 3.8 million electronic tax filings, 5.7 million social security numbers and 3.3 million bank account numbers. The hackers operated undetected for about a month until a security firm was contacted for resolution of the breach. Not only was multi-factor authentication not used, data was left at rest unencrypted, and proper monitoring safeguards were not in place (Kaplan, 2012).

Cyber-security is a Complex Problem

Cyber-security analysts have the job of ensuring that their network of computers is operating normally, that individual hosts have not been compromised by hackers or malware, and that systems are protected against unauthorized access. They accomplish this goal through proper system configuration, patch management and good system design. The cyber-security job is often a collateral duty for network or server administrators in small to mid-sized organizations. Even in enterprise-sized organizations such as the United States Navy, information assurance jobs are only recently becoming standardized and personnel with appropriate training are being utilized (Exner, 2011). Generally in large organizations, the cyber-security job is intentionally divided between policy analysts, network operators, server operators, dedicated intrusion detection analysts and post-detection incident managers (Lehtinen, Russell, & Gangemi, 2006, Chapter 5).

Regardless of the size of the organization and how the roles are divided, analysts must maintain

SA of the activities that occur on the network that they manage.

Table 2. Complicating factors in cyber-security

Complexity Description
Security as a collateral duty Small organizations add network security as additional duties to network or systems administrators.
Division of Labor Large organizations divide roles of security, which put up information sharing walls between defenders.
Lack of Physical Domain There is no limitation of time and distance. Hackers can penetrate systems from around the world and at all hours of the day.
Reliance on Sensors There is no way to directly observe the cyber environment. It must be observed by sensors.
Rapidly evolving attack vectors New attack vectors emerge frequently.
Automated Attack Tools Hackers do not need to be sophisticated. They can use existing toolkits to launch attacks.
Confusing Defensive Tools Defensive tools are difficult to use and have a high learning curve.
Lack of Integration of Defensive Tools Defensive tools exist in their own silos and do not share information between each other.
High False Alert Rates In particular, IDS systems are notoriously high in false alarm rates.
Lack of Future Projection Systems have no ability to project a hacker’s next likely step.

 

From the perspective of the analyst, cyber-security is a complex problem due to limited visibility of actions on the network, lack of connection to normal physics such as time and space, and is compounded by the operational tempo of cyber events. Table 2 outlines a number of factors that make the cyber-security job difficult. Analysts must rely on sensors to observe actions of hackers and malware on the network. As compared to other domains where SA plays a role, there is a complete disconnect from physical constraints such as time and distance. As compared to other domains, the cyber analyst’s problem space is not constrained to a geographic area of operation nor is it constrained by natural laws such as physics and gravity. To make the problem more complex, threats in cyber-security can be characterized as a continuously evolving

landscape with rapidly appearing actors, new methods and novel application of technologies. Attack tools propagate from threat developers to unsophisticated repeat hackers much faster than patches and fixes propagate from software vendors to computer network operators (Brumley, Poosankam, Song, & Zheng, 2008).

From a defensive perspective, there are numerous cyber-security tools. Each potentially offers different types of data about the defensive status network devices, but the analyst must sift through this data manually to identify departures from normal operation that may be hints about undesired behavior. While pattern matching and anomaly-based intrusion detection systems (IDSs) are a part of the suite of tools used by analysts, the data from these tools only provide indications of potential problems and are plagued with high false alert rates. Log data from servers and hosts provide another incomplete picture of the cyber-security landscape. Connection or flow data across the network can provide yet another by presenting evidence of communication between systems (Kowalski & Beheshti, 2008; Peterson, 2004). A better understanding needs to be developed through a suite of tools that provides analysts with the necessary and sufficient information to maintain awareness of the events that occur on the network.

Unfortunately, the current state-of-the-art in cyber-security maintains these tools as separate and isolated from the others, forcing the analyst to select and use them individually. At best, the human analyst may interact with a presentation dashboard of multiple sections, each providing data from individual toolsets. More commonly, the analyst has access to data from different systems on multiple monitors or multiple computers. The analyst develops an understanding of what is normal for a particular network over time, often with a total immersion on-the-job training program that can last six or more months before becoming an independent operator capable of successfully perceiving individual attacks. Even with training, an analyst operates in an isolated domain and has a limited ability to understand the context of the larger cyber situation. In many cases, even senior analysts are unable to project future states and future adversary actions.

Cyber-security is Performed by Individuals and Requires Situation Awareness

Situation awareness (SA) is a human cognitive capability that becomes more important in complex work environments, especially where low frequency/high risk events take place.

Traditionally, these types of work environments have included aircraft piloting (M. R. Endsley,

1993; M. R. Endsley, Farley, Jones, Midkiff, & Hansman, 1998), military command and control (Dudfield, Macklin, Fearnley, Simpson, & Hall, 2001; Gorman, Cooke, & Winner, 2006) , nuclear power plant operation (David, Folles, Strand-Volden, & Torralba, 1995) , air traffic control (M. R. Endsley & Rodgers, 1994), ship navigation (Lee & Sanquist, 2000) and other domains where failure to maintain awareness of cues can result in potentially tragic outcomes. The cyber-security domain has the potential for the same low frequency/high risk event because current commerce, military and critical infrastructure are all interconnected via networks that need to be defended against cyber-attacks. Cyber-security analysts must develop and maintain awareness of events that occur on the network so that they can protect systems under their care to ensure that they are operating correctly, have not been compromised and are not being exploited in further attacks against others.

Endsley describes SA as the “perception of the elements of the environment within a volume of time and space and the projection of their status in the near future” (Endsley 1988,

p.97). She further describes the three levels of SA as being the ability to perceive relevant information (Level 1), interpret this information in context of the operators goals (Level 2) and project potential future states (Level 3) to allow for effective decisions to be made in a timely manner (M. Endsley, 1995). This contrasts with the viewpoint of SA proposed by Bedny and Meister, based on Russian Activity Theory, which describes SA as an intensely dynamic cognitive activity that is intricately tied to the “notations of goal, operative image, meaning and sense” (Bedny & Meister, 1999). Smith and Hancock (1995) suggest a perceptual cycle model of SA, which views it as an externally directed consciousness that generates behavior directed at achieving goals in a specific task. That type of SA produces knowledge about the environment that is being observed. These three perspectives on SA give rise to different measurement techniques to assess whether an individual has good SA or whether a given interface provides the appropriate cues to assist in the development and maintenance of SA.

Technical Solutions for Improving Cyber Situation Awareness

The data reduction capabilities of sensors allow for network monitoring without requiring the human to read every single packet (Y. Wang, 2009). However, this means that sensors only provide a part of the picture. Multi-sensor data fusion allows the combination of individual sensor reports into a more complete picture, to represent entities and entire situations so that future possibilities can be examined and decisions can be made (Hall & McMullen, 2004). Visual analytics provides a methodology for exploring complex data using dynamic visual representations that can be manipulated by the analyst to discover emerging trends that would not be apparent with a more static data presentation (Ren, 2006). Both of these solution domains provide data reduction, combination and exploration capabilities. Both require interaction from the analyst and are designed to support human cognition.

New tools and technologies such as visual analytics and multi-sensor data fusion can play a positive role in enhancing the analyst’s cognition. These new technology domains are suggested frequently in the literature to increase cyber SA. These two technological solution domains provide for data reduction, correlation and fusion of independent sensor observation and dynamic visual representations suitable for the exploration of these data. These algorithms and techniques are not in themselves SA, nor do they provide SA to the human analyst directly. Instead, they provide the information to a human analyst in a way that facilitates the development and maintenance of analyst’s SA. They are cognitive aids that provide access to the data and provide the analyst with a rapid method of understanding the large volumes of raw data common in cybersecurity. These tools are developed with the intent of increasing cyber SA, but are generally not tested to assess whether they are actually successful in their goal.

Research Questions

There are two research questions addressed in this dissertation. The first seeks to understand the important cues that are relevant in cyber-security. These cues are uncovered in a contextual inquiry process using semi-structured interviews and surveys to query practicing cyber-security analysts about the tools they use and data that is presented by these tools. Analysts are asked about how they use this data to make sense of the cyber-security environment and the inferences they make. This is explored through the first research question:

 

RQ1: What are the important cues that an analyst needs to observe in a

computer network operations security context?

 

The second research question explores specific cognitive concerns for the cyber-security analyst when presented with a new representation of the cyber data. As will be presented in Chapter 2, researchers and solution providers are rapidly developing new techniques to attempt to improve situation awareness in cyber-security. However, it is rare that the developers of these techniques assess whether their tools actually provide the improvement that they promise. This may be due to the lack of a cyber-security situation awareness measurement technique, or to the challenge of conducting such experiments with trained, experienced human participants, which is highlighted in the second research question:

 

RQ2: How can situation awareness in cyber-security be measured?

 

The research activities in this dissertation explore these two research questions in an attempt to provide a better understanding of cyber-security situation awareness from the perspective of the human beings who do this work.

Using the Living Labs Framework to Explore Situation Awareness in Cyber-security

This dissertation pursues these two research questions using several different research techniques. These different research activities pursue the exploration of the cyber-security situation awareness problem using the Living Lab. The Living Lab Approach is a research methodology from the cognitive systems engineering field that provides the tools and methods for developing interface components and the evaluation of the impact of those components on human cognition. The outputs of the living lab approach can provide a practice-based application of theory to drive better system design, or theoretical-based exploration of practice and human cognition to study these impacts (McNeese, 2004).

 

 

Figure 2. The Living Lab Approach adapted from McNeese (2004)

 

The living lab has four major areas of research activity: (1) ethnographic study to understand the real world context of a domain, (2) knowledge elicitation from domain practitioners to understand cognitive issues of importance (such as situation awareness in this dissertation), (3) scaled world experimentation to asses hypotheses related to the impact of cognitive aids, tools, interfaces and algorithms on human cognition, and (4) development of reconfigurable prototypes to transition experiments to practice. While they can be completed in any in either direction around the loop, the problem-based approach implies that a study of the problem and affected stakeholders is a likely place to initiate research activities.

In this dissertation, four individual research activities follow the review of literature. Using the Living Lab Approach each research activity is described here and how they all fit together. Two separate Knowledge Elicitation activities were performed. The first is a set of semi-structured interviews with practicing cyber-security analysts. This is followed by a survey of analysts that was emailed to mailing lists of over 3500 individuals to confirm the findings identified in the interviews. These two Knowledge Elicitation activities and their findings are reported in Chapter 5 of this dissertation. These findings help to identify the important features, data and cues that are important to represent in the development of the cyber-security interfaces

(considered Reconfigurable Prototypes) that are presented in Chapter 6. These two interface types (Text and Visual Analytic) were utilized in the Scaled World Simulation experiment, which is presented in Chapter 7. Chapter 8 follows with a discussion of the results of these research activities and review of contributions made in this dissertation.

Contributions of this Dissertation

The contributions in this dissertation are in four broad categories: 1) Literature Surveys; 2) Knowledge Elicitation; 3) Artifact Development; and 4) Human Subjects Experiments (see

Table 3). Each of these contributions is summarized below.

Table 3. Summary of Contributions

Literature Surveys 1.

2.

A literature survey of data fusion and visualization techniques aimed at improving situation awareness in cyber-security.

A literature survey of SA that explores several different theoretical perspectives of SA and their associated measurement techniques.

Knowledge

Elicitation

3.

4.

Interviews of computer network operations analysts to discover the relevant cues important in this sub-domain of cyber-security.

A survey with over 60 responses from practicing cyber-security analysts that confirm the findings elicited in the interviews.

Artifact

Development

5. The development of two reconfigurable prototype interfaces that present cyber-security data using either a text or visual analytic representation.
Human Subjects Experiment 6.

7.

The development of a measurement technique to evaluate the impact of new cyber visualizations or fusion tools on analyst SA.

The design, conduct & analysis of human in the loop experiment to measure SA in cybersecurity using multiple SA assessment instruments.

 

The literature survey in Chapter 2 reviews data fusion and visualization techniques applied in the cyber-security domain. Specifically, those projects that were designed to increase cyber-security situation awareness are highlighted. These techniques include low level (entity extraction and property assignment) as well as high level (awareness and future projection) fusion techniques. From the visualization community, a variety of different visualization techniques are surveyed that include methods for representing data from individual computers to enterprises of inter-related networks. Each technique promises to increase cyber-security situation awareness.

Chapter 3 reviews the situation awareness literature to understand exactly what it is that the tools and techniques reviewed in Chapter 2 intend to improve. Several theoretical interpretations of situation awareness are reviewed and organized. A number of situation awareness measurement techniques are also reviewed. The more prominent of these techniques are identified and proposed for use in a combined battery of situation awareness measurement. Chapter 4 organizes several of the theories of situation awareness and their measurement techniques into a combined SA Assessment Battery.

This dissertation addresses the need for understanding the work domain of practicing analysts. This work adds to body of work using cognitive systems engineering approaches studying the work domain of cyber-security professionals (D’Amico, Whitley, Tesone, OBrien, &

Roth, 2005; D’Amico & Whitley, 2007; Killcrece, Kossakowski, Ruefle, & Zajicek, 2003). Chapter 5 outlines two different knowledge elicitation activities that were utilized to address the development of a reconfigurable prototype for presenting cyber-security data in Chapter 6.

Chapter 6 describes the two interfaces that were designed. These interfaces both present the same underlying cyber-security data. These reconfigurable prototypes were developed and intended for use in a scaled world simulation experiment with human participants. Chapter 7 presents the design of this experiment, the interfaces used, the data that was manipulated into individual scenarios for presentation to the participants. Situation awareness was assessed using an in-trial freeze probe (M.R. Endsley, 1988); perceived effectiveness through two different measures: post-trial SA assessment (R. Taylor, 1990) and perceived workload assessment (Hart & Staveland, 1988); and an assessment of task effectiveness (Wellens & Ergener, 1988). Chapter 7 concludes with a presentation of the results and conclusions from this experiment.

Chapter 8 provides a discussion of the important findings in each of these research activities. An overall assessment of the utility of data fusion and visualization techniques to improve situation awareness is presented. This chapter and dissertation end with a discussion of the appropriate methods to measure situation awareness in cyber-security and the importance of doing so when developing new interfaces.

Summary

Cyber-security is difficult problem because of the volume and complexity of the cyber data, the difficulties in assessing the cyber-security analyst’s SA, and the failure of the designers of new cyber-security tools to measure their effectiveness of increasing SA. Human analysts perform the cyber-security task on the behalf of organizations and require SA about the problem space in which they operate. However, due to the size of the volumes of data and the complexity of the cyber landscape, cyber-security analysts suffer from lack of SA and are further hampered by organizational structure and division of labor. While new tools are constantly being developed to overcome the problems in cyber SA, they are generally not evaluated to ensure that they actually increase the SA of the human analyst. This failure to evaluate is possibly due to the complex nature of evaluating SA because there are several competing theories of the nature of SA.

An Integrated Framework of SA has been developed in this dissertation that overcomes the limitations of the three prevalent theoretical models of SA. Also suggested is a method for combining the several SA measurement techniques into a single SA Assessment Battery. An implementation of this SA Assessment Battery for the cyber-security domain is proposed in this dissertation to address measurement of cyber SA and to provide evidence of the battery’s

practicality.                                                 

[1] SC Magazine’s Data Breach Blog is available online at http://www.scmagazine.com/thedatabreachblog/section/1263/

[2] SC Magazine’s Data Breach Blog is available online at http://www.scmagazine.com/thedatabreachblog/section/1263/

MEASURING THE EFFECTIVENESS OF VISUAL ANALYTICS AND DATA FUSION TECHNIQUES ON SITUATION AWARENESS IN CYBER-SECURITY

Sharing is caring!

Leave a Reply