Modeling Information Pooling Bias in Incident Response Teams: An Agent Based Modeling Approach

Abstract

Security analysts regularly correlate disparate incidents to detect cyber-attacks. However, past research shows that team-based incident correlation analysis may be affected by information pooling bias. This article presents findings from an agent-based model used to explore the cognitive processes hypothesized to be causing this bias during information exchange within a team. The model simulated information exchange between three analysts conducting incident correlation analysis by searching for information available with them about the different incidents. Three models of memory search process were compared: Random, Local, and Memory-aided search. Results from the simulation show that agents in a local search model, compared to memory-aided search model, shared more often the information known to majority in the team. Comparing model results with data from lab experiments suggest that teams, by default, may be employing a heuristic search process during information exchange leading to sub-optimal team processes and performance.