The purpose of cognitive models is to make predictive simulations of human behaviour, but this is often done at the aggregate level. Cranford, Gonzalez, Aggarwal, Cooney, Tambe, and Lebiere show that they can automatically customize a model to a particular individual on‐the‐fly, and use it to make specific predictions about their next actions, in the context of a particular cybersecurity game.

Cognitive models that represent individuals provide many benefits for understanding the full range of human behavior. One way in which individual differences emerge is through differences in knowledge. In dynamic situations, where decisions are made from experience, models built upon a theory of experiential choice (instance-based learning theory; IBLT) can provide accurate predictions of individual human learning and adaptivity to changing environments. Here, we demonstrate how an instance-based learning (IBL) cognitive model, implemented in a cognitive architecture (Adaptive Control of Thought–Rational), (...) can be used to model an individual's decisions in a cybersecurity defense task, accounting for both population average and individual variances. The same IBL model structure with identical architectural parameters generates the full range of human behavior through stochastic memory retrieval processes operating over and contributing to unique experiences. Recurrence quantification analyses allow us to look beyond average behavior between and within individuals to sequential patterns of trial-to-trial behavior. We show how model-tracing and knowledge-tracing techniques can be used to align the model to an individual in real time to drive adaptive and personalized signaling algorithms for a cybersecurity defense system. We also present a method for introspecting into the cognitive model to gain further insight into the cognitive salience of features factored into individual decisions. The combination of techniques provides a blueprint for personalized modeling of individuals. We discuss the results and implications of this adaptive and personalized method for cybersecurity defense and more generally for intelligent artifacts tailored to individual differences in domains such as human–machine teaming. (shrink)

This work is an initial step toward developing a cognitive theory of cyber deception. While widely studied, the psychology of deception has largely focused on physical cues of deception. Given that present‐day communication among humans is largely electronic, we focus on the cyber domain where physical cues are unavailable and for which there is less psychological research. To improve cyber defense, researchers have used signaling theory to extended algorithms developed for the optimal allocation of limited defense resources by using deceptive (...) signals to trick the human mind. However, the algorithms are designed to protect against adversaries that make perfectly rational decisions. In behavioral experiments using an abstract cybersecurity game (i.e., Insider Attack Game), we examined human decision‐making when paired against the defense algorithm. We developed an instance‐based learning (IBL) model of an attacker using the Adaptive Control of Thought‐Rational (ACT‐R) cognitive architecture to investigate how humans make decisions under deception in cyber‐attack scenarios. Our results show that the defense algorithm is more effective at reducing the probability of attack and protecting assets when using deceptive signaling, compared to no signaling, but is less effective than predicted against a perfectly rational adversary. Also, the IBL model replicates human attack decisions accurately. The IBL model shows how human decisions arise from experience, and how memory retrieval dynamics can give rise to cognitive biases, such as confirmation bias. The implications of these findings are discussed in the perspective of informing theories of deception and designing more effective signaling schemes that consider human bounded rationality. (shrink)