TWC SBE: Small: Identifying Malicious Insiders through Mouse Cursor Movements

TWC SBE：小：通过鼠标光标移动识别恶意内部人员

• 批准号: 1615696
• 负责人: Joseph Valacich
• 金额: $ 29.99万
• 依托单位: University of Arizona
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2016
• 资助国家: 美国
• 起止时间: 2016-09-01 至 2019-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1615696&HistoricalAwards=false
• 关键词: TWC; SBE; Small; Identifying; Malicious

The threat of malicious insiders is a top concern for governmental agencies and corporations. In general, malicious insiders are typically disgruntled employees who encounter a negative experience, or stressor, as a triggering event. Criminology research has long associated certain stressors with malicious behavior. Recent neuroscience and cognitive psychology research has unequivocally demonstrated that linkages exist between cognitive processing (e.g., cognitive conflict, emotion, arousal, etc.) and hand movements. In a human-computer interaction context, growing support has found that emotions influence mouse cursor movements. Importantly, this work has demonstrated that negative emotions associated with stressors influence users? mouse cursor movements. Building on this foundation, this work will answer critical questions regarding the identification of mouse curser data features that may indicate negative emotions induced by stressors. Specifically, year 1 will focus on understanding the efficacy of this approach when users know they are being monitored and trying to avoid being detected. And, for year 2, understand the efficacy of the approach for predicting the likelihood of whether a person will engage in a malicious online activity in real time.This two-year program of research will answer critical questions regarding the identification of mouse curser data features that may indicate negative emotions induced by stressors. The test environment for this work will be a multi-round, fair vs. unfair, serious game or testing scenario (e.g., intelligence test). In all studies, participants will be randomly assigned to one of the two treatments a fair (no manipulation) or unfair (negative emotion induced) experience (as well as other experimental manipulations depending on a particular study's objectives). In the treatment condition, the instructions will explain that the task will be timed, and that their score will be computed based on how many objectives they can complete correctly within the allotted time. To induce negative emotion, the task will appear to have technical problems loading the stimuli, will ask very difficult questions, and give participants a very short period of time to complete the tasks. Because of these "unfair" disadvantages, the system will attribute a low score to the participants, resulting in feelings of unfairness, frustration, and anger. Participants will also be told that because of their slow response time and incorrect answers, their score indicates a lower intelligence level than that of most people who have taken the test. As their score is outside of their control (resulting from the system being too slow and not giving them enough time to answer), the prior literature suggests that participants will have a negative emotional response from being judged unfairly. In the baseline condition, the instructions will explain to participants that they will complete a task and that their score will be computed based on how many tasks they complete correctly. The delivery of the stimuli in this condition will be similar to the negative-emotion condition, except that we will not implement the negative-emotion-inducing mechanisms (i.e., the task will not be timed; the loading signs will not be shown; the questions can easily be answered; and, at the conclusion, the system will congratulate participants for answering the questions correctly). Thus, negative emotion would likely not be induced in the task. After completing each round of the task, participants in both treatments will complete an identical goal-directed task, during which we will record and analyze mouse cursor movements. By using an identical follow-up task, we can attribute the difference in mouse cursor movements to negative emotion from the primary task. Different follow-up tasks will be used in Year 1 vs Year 2, as the goals of each year are different. After all experiments, participants will be debriefed, told the true purpose of the test, and given maximum payment regardless of their performance or behavior on the study.

恶意内部人员的威胁是政府机构和企业最关心的问题。一般来说，恶意内部人员通常是心怀不满的员工，他们遇到负面经历或压力源作为触发事件。犯罪学研究长期以来一直将某些压力源与恶意行为联系起来。最近的神经科学和认知心理学研究明确证明，认知处理（例如认知冲突、情绪、唤醒等）和手部运动之间存在联系。在人机交互环境中，越来越多的支持发现情绪会影响鼠标光标的移动。重要的是，这项工作已经证明与压力源相关的负面情绪会影响用户？鼠标光标移动。 在此基础上，这项工作将回答有关识别鼠标光标数据特征的关键问题，这些特征可能表明压力源引起的负面情绪。具体来说，第一年将重点了解当用户知道他们正在受到监视并试图避免被检测到时这种方法的功效。并且，在第二年，了解该方法在预测一个人是否会实时参与恶意在线活动的可能性方面的有效性。这个为期两年的研究计划将回答有关鼠标光标数据特征识别的关键问题这可能表明压力源引起的负面情绪。本作品的测试环境将是多轮、公平与不公平、严肃的游戏或测试场景（例如智力测试）。在所有研究中，参与者将被随机分配到两种治疗中的一种：公平（无操纵）或不公平（引发负面情绪）体验（以及取决于特定研究目标的其他实验操纵）。在治疗条件下，说明将解释任务将被计时，并且将根据他们在分配的时间内正确完成的目标数量来计算他们的分数。为了诱发负面情绪，任务在加载刺激时会出现技术问题，会提出非常困难的问题，并给参与者很短的时间来完成任务。由于这些“不公平”的劣势，系统会给参与者打低分，从而产生不公平、沮丧和愤怒的感觉。参与者还将被告知，由于他们的反应速度慢且答案不正确，他们的分数表明他们的智力水平低于大多数参加测试的人。由于他们的分数超出了他们的控制范围（由于系统太慢并且没有给他们足够的时间来回答），先前的文献表明参与者会因受到不公平的判断而产生负面情绪反应。在基线条件下，说明将向参与者解释他们将完成一项任务，并且他们的分数将根据他们正确完成的任务数量来计算。在这种情况下，刺激的传递将与负面情绪条件类似，只是我们不会实施负面情绪诱导机制（即，任务不会计时；不会显示加载标志；问题很容易得到解答；最后，系统会祝贺参与者正确回答了问题）。因此，任务中可能不会引发负面情绪。完成每轮任务后，两种治疗的参与者将完成相同的目标导向任务，在此期间我们将记录和分析鼠标光标的移动。通过使用相同的后续任务，我们可以将鼠标光标移动的差异归因于主要任务的负面情绪。由于每年的目标不同，第一年和第二年将使用不同的后续任务。所有实验结束后，参与者将接受汇报，告知测试的真实目的，并获得最高报酬，无论他们在研究中的表现或行为如何。