Understanding adversarial decisions for different probing-action costs in a deception game via cognitive modeling

In the cyber world, deception through honeypots has been prominent in response to modern cyberattacks. Prior cybersecurity research has investigated the effect of probing action costs on adversarial decisions in a deception game. However, little is known about the cognitive mechanisms that affect the influence of probing action costs on adversarial decisions. The main objective of this research is to see how an instance-based learning (IBL) model incorporating recency, frequency, and cognitive noise could predict adversarial decisions with different probing action costs. The experimental study had three different probing action costs in the deception game: increasing cost probe (N = 40), no-cost probe (N = 40), and constant cost probe (N = 40). Across the three conditions, the cost for probing the honeypot webserver was varied; however, the cost for probing the regular webserver was kept the same. The results revealed that the cost of probing had no effect on probe and attack actions and that there was a significant interaction between different cost conditions and regular webserver probe actions over the trials. The human decisions obtained in the above experiment were used to calibrate an IBL model. As a baseline, an IBL model with ACT-R default parameters was built. In comparison to the IBL model with ACT-R default parameters, the results showed that the IBL model with calibrated parameters explained adversary decisions more precisely. Results from the model showed higher cognitive noise for cost-associated conditions compared to that of no-cost condition. We highlight the main implications of this research for the community.