Designing cyber defense systems to account for cognitive biases in human decision making has demonstrated significant success in improving performance against human attackers. However, much of the attention in this area has focused on relatively simple accounts of biases in human attackers, and little is known about adversarial behavior or how defenses could be improved by disrupting attacker's behavior. In this work, we present a novel model of human decision-making inspired by the cognitive faculties of Instance-Based Learning Theory, Theory of Mind, and Transfer of Learning. This model functions by learning from both roles in a security scenario: defender and attacker, and by making predictions of the opponent's beliefs, intentions, and actions. The proposed model can better defend against attacks from a wide range of opponents compared to alternatives that attempt to perform optimally without accounting for human biases. Additionally, the proposed model performs better against a range of human-like behavior by explicitly modeling human transfer of learning, which has not yet been applied to cyber defense scenarios. Results from simulation experiments demonstrate the potential usefulness of cognitively inspired models of agents trained in attack and defense roles and how these insights could potentially be used in real-world cybersecurity.

针对人类决策中的认知偏差设计网络防御系统已经取得了显著的成功，但该领域的研究主要集中在相对简单的攻击者认知偏差上，关于对抗行为或通过破坏攻击者行为来提高防御效果的研究较少。本文提出了一种受 Instance-Based Learning Theory，Theory of Mind 和 Transfer of Learning 认知能力启发的新型人类决策模型，通过在安全场景中从防御者和攻击者角色中学习，并对对手的信念，意图和行动做出预测，以更好地抵御各种攻击，这个模型明确建模了人类学习的转移，对网络安全具有实际应用的潜在价值。

攻防学习：网络安全游戏中的学习迁移