Agent-Based Model of a Cyber Security Defense Analyst Team

Abstract

Cyber security defense is often performed by a group of people called cyber defense analysts and yet team work and collaboration in cyber defense is almost non-existent. This study, using an agent-based model of the cyber defense analyst’s task and interactions, explored the effects of different collaboration strategies and team sizes on performance measures such as number of intrusion alerts accurately processed by the analysts and rewards they accrue from accurately processing the alerts. This study also explored the feasibility of using agent-based modeling methodologies for studying team processes in the cyber defense context. The model revealed that specific collaboration strategies lead to better performance and that large teams are detrimental to performance.