Cyber attacks are designed to affect human behavior by creating confusion and information overload. Although cyber attacks mainly aim to stimulate irrational behavior, there is limited work in the literature on modeling their human behavior effects. Instead most of the studies are focused on the simulation of attacks and technical solutions or counter measures to prevent, detect and recover from an attack. Taxonomies for attacks, attackers and human behavior effects of cyber attacks are provided, and the relation between cyber attacks and decision making process are modeled. Live simulation techniques for stimulating the expected behavior, specifically effects of cyber attacks on decision making are presented. Contemporary decision making process for most individuals and organizations depend on online information. Furthermore, the professional, individual and social life of many ordinary people is tied to networks and the information available in them. The infrastructure for these networks is typically the Internet. This much dependency to an open information source creates new opportunities for adversaries. Cyber incidents, where adversaries influence or control the communications and information systems for creating human behavior effect in their favor, have become common. Typically malwares, such as viruses, worms, trojan horses and botnets are used for attacking on:  Availability: To reduce communications/computation capacity or to prevent the availability of information and communication systems  Confidentiality: To compromise confidential information  Privacy: To obtain detailed information about individuals and organizations  Integrity: To create uncertainty about information Cyber attacks and counter measures have been studied in the literature extensively for decades (Kotenko 2005, Stytz and Banks 2010) . Numerous modeling and simulation tools are also available (OMNeT++ Community 2010, Cayirci and Marincic 2009) for simulating cyber attacks and counter measures. However, neither modeling and simulation nor training researchers have addressed human behavior effect of cyber attacks and their consequences enough. Cyber attacks may create a situation worse than the time before the information age because decision makers under cyber attacks do not only tackle with the challenge of lack of information but also lose their trust of the available information under cyber attack. The implications and consequences of this phenomenon are serious. Therefore, practical solutions and procedures against it should be developed, tested and trained, which requires effective simulation tools and techniques.  In this paper we aim to relate cyber attacks and their human behavior effects systematically. Moreover, we present examples for practical techniques that can be used in training events to stimulate human behavior effect of cyber attacks. In Section 2, a taxonomy about cyber attacks and attackers is provided. The decision making process and its relations with cyber attacks are modeled in Section 3. Examples for simulating the effects of cyber attacks on decision making during operational and higher level exercises are introduced in Section 4. We conclude our paper in Section 5. Security attacks can be categorized into two broad classes: passive and active attacks. Passive attacks, where adversaries do not make any emission, are mainly against data confidentiality. In active attacks malicious acts are carried out not only against data confidentiality but also integrity. Active attacks can also aim at unauthorized access and usage of the resources or the disturbance of the opponent's communications. An active attacker makes emission or an action that can be detected. In passive attacks attackers are typically camouflaged, i.e., hidden, and tap the communication lines to collect data. Passive attacks can be grouped as eavesdropping and traffic analysis. Classified data can be eavesdropped by tapping the communication lines. Especially when the known protocols are used, and plain data (i.e., not encrypted) are transferred, an adversary can easily eavesdrop. Not only the content of data packets but also the traffic patterns may be very valuable for adversaries. For example, important information about the networking topology can be derived by analyzing the traffic patterns. Traffic analysis can also be used to organize attacks against anonymity. Adversaries can aim to detect the source of certain data packets, which may help localizing events and determining the weaknesses, capabilities, functions and owners of transferred data. Moreover, traffic patterns can pertain to the other confidential information such as the actions and the intentions. In an active attack an adversary actually affects the operations in the attacked network/information system. This effect may be the objective of the attack, and can be detected. For example, the networking services can be degraded or terminated as the result of the attack. Sometimes the adversary tries to stay undetected, and aims gaining unauthorized access to system resources or threatening confidentiality and/or integrity of the content in a network. We group active attacks into four classes as shown in Figure 2 . Adversary can physically damage hardware to terminate the nodes. This is a security attack that can be considered also in the domain of fault tolerance, which is the ability to sustain networking functionalities without any interruption due to node failures. When nodes are unattended and can be reached physically by the adversary, they can be attacked by tampering techniques, such as, microprobing, laser cutting, focused ion-beam manipulation, glitch attacks and power analysis (Cayirci and Rong 2009). Node tampering can help much in masquerading and denial of service attacks. Electromagnetic pulse (EMP) attacks are also among the threats that can be listed within physical security attacks. EMP is a short duration burst Passive Attacks Traffic Analysis (r) Cayirci and Ghergherehchi of high intensity electromagnetic energy that can produce voltage surges, which can damage electronic devices within its range. A masquerading node impersonates another node. Messages can be captured and replayed by the masquerading node. Finally, the content of the captured messages can be modified before being replayed. Various scenarios and threats can be developed based on these approaches. An adversary can masquerade for phishing, which means deceiving someone to make him/her give confidential information voluntarily. A malicious node that masquerades an authorized node can ask another node to give information about the passwords, keys, etc. A Denial of Service (DoS) attack is mainly against the availability of network services. A DoS is defined as any event that diminishes network capacity to perform its expected function correctly or in a timely manner. A DoS attack is characterized by the following properties: malicious, disruptive and asymmetric. A DoS attack can be organized at any networking protocol layer (i.e., physical, MAC, network, transport and application layers). Finally, misbehaving can also count as a cyber threat. A user of a system may misbehave to have unfair shares of the limited networking resources, i.e., selfishness. Another reason for misbehaving may be against the charging scheme not to pay for the services received. Similar to attacks, attackers can also be categorized according to many criteria (Cayirci and Rong 2009). Our classification of attackers is based on the characteristics shown in Figure 3 : emission, location, quantity, motivation, rationality and mobility. First an attacker can be passive or active. Active attacks are carried out by active attackers, and passive attacks by passive attackers. An attacker can be an insider or an outsider. The attacker may learn all the cryptographic information owned by a compromised node when it is an insider. Therefore stealthy active attacks can be organized by the insider attackers. In other words an insider can be perceived as a legal entity inside the network. An outsider is typically not welcome to the network. There may be a single attacker or multiple of them. When there are multiple attackers, they can collaborate with each other which can be considered as a more difficult case to defend against. An adversary carries out attacks with a motivation such as breaking confidentiality, integrity and privacy. This can be done also to gain an access to unauthorized resources. Attackers can attack also to hinder the operations of the other side. Selfishness, avoiding from payment or getting unearned rewards may be the other motivations. Needlessness, malfunctioning nodes or naïve users may also become a threat for an information system. However, needlessness is not the only reason for irrational attacks.  Cayirci and Ghergherehchi attack and break a security system, and perceive this as a challenge to prove himself/herself. Therefore, some attacks are irrational where the results of these attacks may not be worth their cost. Rational attackers carry out their attacks to obtain something which is worth more than the cost of their attacks. Finally, attackers can be fixed or mobile. Detecting mobile attackers and defending against them are generally more difficult than defending against the fixed adversary.  The tools for attacks are typically malwares. Four important classes of malware are listed below: 1. Virus: Viruses are embedded into the executable files (computer programs), and invoked when the executable is run. A virus can copy itself to other executables, and move as the executables are copied from one computer to the other. They can harm hardware and software or reduce the available capacities (i.e., fixed drive, memory, process) in the infected machines. 2. Worm: Worms are similar to viruses. The main difference between them is that worms are self propagating and self infecting, which means that they do not need to be embedded into another executable file. 3. Trojan Horse: Trojan horses are also similar to viruses. They are hidden in legitimate software, which are attractive and developed as a Trojan horse. When a Trojan horse is activated by a user, the adversary gains a point inside to organize its attacks. 4. Botnet: Botnets or bot armies are a set of more sophisticated malwares. They infect multiple machines, and coordinate their attacks started in many machines and collaborate with each other. Since in this paper the human behavior effects of the cyber attacks are studied, we focus on the results of the attacks and counter measures rather than the techniques for attacking and counter measures. With this perspective, the results of the attacks can be modeled by using the following cyber attack parameters, which are assigned values from the unit interval of real numbers (i.e., R[0, 1]):  Ii, k : The average integrity/accuracy of available information in information system (IS) i in time interval k  Ci, k : The average integrity/accuracy of information transferred via communications channel (CC)
The cyber effects on human decision making, originating from passive and active cyber attacks, is studied by Cayirci et al. REF .
Modeling cyber attacks and their effects on decision process
Proceedings of the 2011 Winter Simulation Conference (WSC)
Proceedings of the 2011 Winter Simulation Conference (WSC)
Computer Science