Abstract

Human error arguably accounts for more than half of all security vulnerabilities, yet few frameworks for testing secure systems take human actions into account. We describe the design of an experimentation platform that models human behaviors through intelligent agents. Our agents share some desired features with believable agent systems, but believable interaction with a human is less important than accurate reproduction of security-related behaviors. We identify three main components of human behavior that are important in such a system:(1) models of emotion and other cognitive state that may increase the probability of errors,(2) flexible reasoning in the face of a compromised system and (3) realistic task-based patterns of communication among groups. We describe an agent framework that can support these behaviors and illustrate its principles with a scenario of an insider attack. We are beginning the implementation of the framework, and finish with a discussion of future work.

Date

July 12, 2010

Authors

Jerry Lin, Jim Blythe, Skyler Clark, Nima Davarpanah, Roger Hughston, Mike Zyda

Journal

Association for the Advancement of Artificial Intelligence