The authors seek to characterize the behavioral costs of attentional switches between points in a network map and assess the efficacy of interventions intended to reduce those costs.
Background:
Cybersecurity network operators are tasked with determining an appropriate attentional allocation scheme given the state of the network, which requires repeated attentional switches. These attentional switches may result in temporal performance decrements, during which operators disengage from one attentional fixation point and engage with another.
Method:
We ran two experiments where participants identified a chain of malicious emails within a network. All interactions with the system were logged and analyzed to determine if users experienced disengagement and engagement delays.
Results:
Both experiments revealed significant costs from attentional switches before (i.e., disengagement) and after (i.e., engagement) participants navigated to a new area in the network. In our second experiment, we found that interventions aimed at contextualizing navigation actions lessened both disengagement and engagement delays.
Conclusion:
Attentional switches are detrimental to operator performance. Their costs can be reduced by design features that contextualize navigations through an interface.
Application:
This research can be applied to the identification and mitigation of attentional switching costs in a variety of visual search tasks. Furthermore, it demonstrates the efficacy of noninvasive behavioral monitoring for inferring cognitive events.
AguinisH.GottfredsonR. K.JooH. (2013). Best-practice recommendations for defining, identifying, and handling outliers. Organizational Research Methods, 16(2), 270–301. http://doi.org/10.1177/1094428112470848
2.
AhmadA.HadgkissJ.RuighaverA. B.(2012). Incident response teams—Challenges in supporting the organisational security function. Computers and Security, 31(5), 643–652. http://doi.org/10.1016/j.cose.2012.04.001
3.
AlrajehN. A.KhanS.ShamsB. (2013). Intrusion detection systems in wireless sensor networks: A review. International Journal of Distributed Sensor Networks, 2013, 1–7. http://doi.org/10.1109/SURV.2013.050113.00191
4.
AoidhE. M.BertolottoM.WilsonD. C. (2012). Towards dynamic behavior-based profiling for reducing spatial information overload in map browsing activity. Geoinformatica, 16, 409–434. http://doi.org/10.1007/s10707-011-0137-4
5.
AshfaqA. B.KhayamS. A. (2011). Evaluation of contemporary anomaly detection systems (ADSs). In ZubairiJ. A.MahboobA. (Eds.), Cyber security standards, practices and industrial applications: Systems and methodologies (pp. 90–112). Hershey, PA: Information Science Reference. http://doi.org/10.4018/978-1-60960-851-4.ch006
6.
BalakrishnanG.DurandF.GuttagJ. (2013). Detecting pulse from head motions in video. Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, 3430–3437. Retrieved from https://dl.acm.org/citation.cfm?id=2516035
7.
Ben-AsherN.GonzalezC. (2015). Effects of cyber security knowledge on attack detection. Computers in Human Behavior, 48, 51–61. http://doi.org/10.1016/j.chb.2015.01.039
BorstJ. P.TaatgenN. A.van RijnH. (2010). The problem state: A cognitive bottleneck in multitasking. Journal of Experimental Psychology. Learning, Memory, and Cognition, 36(2), 363–382. http://doi.org/10.1037/a0018106
10.
BrookeJ. (1996). SUS: A “quick and dirty” usability scale. Usability Evaluation in Industry, 189(194), 4–7.
11.
ByersJ. C.BittnerA. C.HillS. G. (1989). Traditional and Raw Task Load Index (TLX) correlations: Are paired comparisons necessary? In MitalA.DasB. (Eds.), Advances in industrial ergonomics and safety (vol. 1., pp. 481–488). London: Taylor & Francis.
12.
CorchadoE.HerreroÁ. (2011). Neural visualization of network traffic data for intrusion detection. Applied Soft Computing Journal, 11(2), 2042–2056. http://doi.org/10.1016/j.asoc.2010.07.002
13.
D’AmicoA.WhitleyK.TesoneD.O’BrienB.RothE. M. (2005). Achieving cyber defense situational awareness: A cognitive task analysis of information assurance analysts. Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 49, 229–233. http://doi.org/10.1177/154193120504900304
14.
DombroweI.DonkM.OliversC. N. L. (2011). The costs of switching attentional sets. Attention, Perception, and Psychophysics, 73(8), 2481–2488. http://doi.org/10.3758/s13414-011-0198-3
15.
DonmezB.BoyleL. N.LeeJ. D. (2006). The impact of distraction mitigation strategies on driving performance. Human Factors, 48(4), 785–804.
16.
DorneichM. C.MathanS.VerversP. M.WhitlowS. D. (2007). An evaluation of real-time cognitive state classification in a harsh operational environment. Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 51, 146–150. http://doi.org/10.1177/154193120705100401
17.
DorneichM. C.WhitlowS. D.VerversP. M.RogersW. H. (2003). Mitigating cognitive bottlenecks via an augmented cognition adaptive system. SMC’03 Conference Proceedings. 2003 IEEE International Conference on Systems, Man and Cybernetics. Conference Theme - System Security and Assurance (Cat. No.03CH37483), 1, 937–944. http://doi.org/10.1109/ICSMC.2003.1243935
18.
DuncanJ. (1980). The locus of interference in the perception of simultaneous stimuli. Psychological Review, 87(3), 272–300. http://doi.org/10.1037/0033-295X.87.3.272
FeighK. M.DorneichM. C.HayesC. C. (2012). Toward a characterization of adaptive systems: A framework for researchers and system designers. Human Factors: The Journal of the Human Factors and Ergonomics Society, 54(6), 1008–1024. http://doi.org/10.1177/0018720812443983
21.
FrankeU.BrynielssonJ. (2014). Cyber situational awareness—A systematic review of the literature. Computers & Security, 46, 41. http://doi.org/10.1016/j.cose.2014.06.008
22.
GoodallJ. R.LuttersW. G.KomlodiA. (2009). Developing expertise for network intrusion detection. Information Technology & People, 22(2), 92–108. http://doi.org/10.1108/09593840910962186
23.
GoutamR. K. (2015). Importance of cyber security. International Journal of Computer Applications, 111(7), 14–18.
24.
HartS. G.StavelandL. E. (1988). Developent of a multi-dimensional workload rating scale: Results of empirical and theoretical research. In HancockP. A.MeshkatiN. (Eds.), Human mental workload (pp. 139–183). Amsterdam, The Netherlands: Elsevier.
25.
HopfJ.- M.BoehlerC. N.SchoenfeldM. A.HeinzeH.- J.TsotsosJ. K. (2010). The spatial profile of the focus of attention in visual search: Insights from MEG recordings. Vision Research, 50(14), 1312–1320. http://doi.org/10.1016/j.visres.2010.01.015
26.
JanczykM.KundeW. (2010). Does dorsal processing require central capacity? More evidence from the PRP paradigm. Experimental Brain Research, 203(1), 89–100. http://doi.org/10.1007/s00221-010-2211-9
27.
KhanS.GaniA.Abdul WahabA. W.ShirazM.KhanI. A. (2016). Network forensics: Review, taxonomy, and open challenges. Journal of Network and Computer Applications, 66, 214–235. http://doi.org/10.1016/j.jnca.2016.03.005
28.
KortschotS. W.SoviljD.SohH.JamiesonG. A.SannerS.CarrascoC.. . . RalphS. (2017). An open source adaptive user interface for network monitoring. Paper presented at the IEEE International Conference on Systems, Man and Cybernetics, Banff, Canada.
29.
LiP.SalourM.SuX. (2008). A survey of internet worm detection and containment. IEEE Communications Surveys and Tutorials, 10(1), 20–35. http://doi.org/10.1109/COMST.2008.4483668
30.
LongmanC. S.LavricA.MonsellS. (2017). Self-paced preparation for a task switch eliminates attentional inertia but not the performance switch cost. Journal of Experimental Psychology: Learning Memory and Cognition, 43(6), 862–873. http://doi.org/10.1037/xlm0000347
31.
MitropoulosS.PatsosD.DouligerisC. (2006). On incident handling and response: A state-of-the-art approach. Computers and Security, 25(5), 351–370. http://doi.org/10.1016/j.cose.2005.09.006
SalvucciD. D.TaatgenN. A. (2008). Threaded cognition: An integrated theory of concurrent multitasking. Psychological Review, 115(1), 101–130. http://doi.org/10.1037/0033-295X.115.1.101
39.
SohnM.- H.AndersonJ. R. (2001). Task preparation and task repetition: Two-component model of task switching. Journal of Experimental Psychology: General, 130(4), 764–778. http://doi.org/10.1037/0096-3445.130.4.764
VerweyW. B.SheaC. H.WrightD. L. (2015). A cognitive framework for explaining serial processing and sequence execution strategies. Psychonomic Bulletin & Review, 22, 54–77. http://doi.org/10.3758/s13423-014-0773-4
42.
WerlingerR.MuldnerK.HawkeyK.BeznosovK. (2010). Preparation, detection, and analysis: The diagnostic work of IT security incident response. Information Management & Computer Security, 18(1), 26–42. http://doi.org/10.1108/09685221011035241
Please find the following supplemental material available below.
For Open Access articles published under a Creative Commons License, all supplemental material carries the same license as the article it is associated with.
For non-Open Access articles published, all supplemental material carries a non-exclusive license, and permission requests for re-use of supplemental material or any part of supplemental material shall be sent directly to the copyright owner as specified in the copyright notice associated with the article.
