TWC SBE: Small: Identifying Malicious Insiders through Mouse Cursor Movements

TWC SBE：小：通过鼠标光标移动识别恶意内部人员

• 批准号: 1615696
• 负责人: Joseph Valacich
• 金额: $ 29.99万
• 依托单位: University of Arizona
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2016
• 资助国家: 美国
• 起止时间: 2016-09-01 至 2019-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1615696&HistoricalAwards=false
• 关键词: TWC; SBE; Small; Identifying; Malicious

The threat of malicious insiders is a top concern for governmental agencies and corporations. In general, malicious insiders are typically disgruntled employees who encounter a negative experience, or stressor, as a triggering event. Criminology research has long associated certain stressors with malicious behavior. Recent neuroscience and cognitive psychology research has unequivocally demonstrated that linkages exist between cognitive processing (e.g., cognitive conflict, emotion, arousal, etc.) and hand movements. In a human-computer interaction context, growing support has found that emotions influence mouse cursor movements. Importantly, this work has demonstrated that negative emotions associated with stressors influence users? mouse cursor movements. Building on this foundation, this work will answer critical questions regarding the identification of mouse curser data features that may indicate negative emotions induced by stressors. Specifically, year 1 will focus on understanding the efficacy of this approach when users know they are being monitored and trying to avoid being detected. And, for year 2, understand the efficacy of the approach for predicting the likelihood of whether a person will engage in a malicious online activity in real time.This two-year program of research will answer critical questions regarding the identification of mouse curser data features that may indicate negative emotions induced by stressors. The test environment for this work will be a multi-round, fair vs. unfair, serious game or testing scenario (e.g., intelligence test). In all studies, participants will be randomly assigned to one of the two treatments a fair (no manipulation) or unfair (negative emotion induced) experience (as well as other experimental manipulations depending on a particular study's objectives). In the treatment condition, the instructions will explain that the task will be timed, and that their score will be computed based on how many objectives they can complete correctly within the allotted time. To induce negative emotion, the task will appear to have technical problems loading the stimuli, will ask very difficult questions, and give participants a very short period of time to complete the tasks. Because of these "unfair" disadvantages, the system will attribute a low score to the participants, resulting in feelings of unfairness, frustration, and anger. Participants will also be told that because of their slow response time and incorrect answers, their score indicates a lower intelligence level than that of most people who have taken the test. As their score is outside of their control (resulting from the system being too slow and not giving them enough time to answer), the prior literature suggests that participants will have a negative emotional response from being judged unfairly. In the baseline condition, the instructions will explain to participants that they will complete a task and that their score will be computed based on how many tasks they complete correctly. The delivery of the stimuli in this condition will be similar to the negative-emotion condition, except that we will not implement the negative-emotion-inducing mechanisms (i.e., the task will not be timed; the loading signs will not be shown; the questions can easily be answered; and, at the conclusion, the system will congratulate participants for answering the questions correctly). Thus, negative emotion would likely not be induced in the task. After completing each round of the task, participants in both treatments will complete an identical goal-directed task, during which we will record and analyze mouse cursor movements. By using an identical follow-up task, we can attribute the difference in mouse cursor movements to negative emotion from the primary task. Different follow-up tasks will be used in Year 1 vs Year 2, as the goals of each year are different. After all experiments, participants will be debriefed, told the true purpose of the test, and given maximum payment regardless of their performance or behavior on the study.

恶意内部人士的威胁是政府机构和公司的最大关注点。一般而言，恶意内部人员通常是不满的员工，他们遇到负面经历或压力源是触发事件。犯罪学研究长期以来将某些压力与恶意行为相关联。最近的神经科学和认知心理学研究无疑证明了认知处理（例如认知冲突，情感，唤醒等）之间存在联系。在人类计算机的互动环境中，不断增长的支持发现情绪会影响小鼠光标运动。重要的是，这项工作表明，与压力源相关的负面情绪会影响用户？鼠标光标运动。 在该基础的基础上，这项工作将回答有关识别鼠标光标数据特征的关键问题，这些问题可能表明压力源引起的负面情绪。具体来说，当用户知道他们正在受到监视并试图避免被发现时，第一年将专注于理解这种方法的功效。而且，对于第二年，了解该方法的疗效，以预测一个人是否会实时进行恶意在线活动的可能性。这两年的研究计划将回答有关识别鼠标Curser数据特征的关键问题，这些问题可能表明压力源引起的负面情绪。这项工作的测试环境将是多轮，公平与不公平，严肃的游戏或测试方案（例如智力测试）。在所有研究中，参与者将被随机分配给两种治疗方法之一（无操纵）或不公平（负面情绪引起的）经验（以及其他实验性操作，具体取决于特定研究的目标）。在治疗条件下，指令将解释任务将定时，并且他们的分数将根据他们在分配的时间内正确完成的目标进行计算。为了引起负面情绪，任务似乎在加载刺激的技术问题上会提出非常困难的问题，并为参与者提供很短的时间来完成任务。由于这些“不公平”的缺点，该系统将将低分归因于参与者，从而导致不公平，沮丧和愤怒的感觉。还将被告知，由于他们的响应时间缓慢且答案不正确，他们的分数表明智力水平低于大多数参加测试的人的智力水平。由于他们的分数超出了他们的控制范围（由于系统太慢而没有给他们足够的时间回答），因此先前的文献表明，参与者将对不公平的判断会产生负面的情绪反应。在基准条件下，指令将向参与者解释他们将完成一项任务，并根据正确完成的任务计算得分。在这种情况下刺激的传递将类似于负面情绪状况，除了我们不会实施负面情绪诱导的机制（即，任务不会定时；将不会显示载荷符号；可以轻松地回答这些问题；并且，结论是，该系统将为参与者正确回答问题）。因此，任务可能不会引起负面情绪。完成任务的每一轮后，两种治疗的参与者都将完成一个相同的目标指导任务，在此期间，我们将记录和分析鼠标光标运动。通过使用相同的后续任务，我们可以将鼠标光标运动的差异归因于主要任务的负面情绪。由于每年的目标是不同的，因此将在1年级VS第2年中使用不同的后续任务。在所有实验之后，参与者将被汇报，告诉测试的真实目的，并且无论研究表现或行为如何，都将获得最高付款。