@inproceedings{e769f5f9fd14400b99a7c5e13bef63d6,
title = "Morshed: Guiding Behavioral Decision-Makers towards Better Security Investment in Interdependent Systems",
abstract = "We model the behavioral biases of human decision-making in securing interdependent systems and show that such behavioral decision-making leads to a suboptimal pattern of resource allocation compared to non-behavioral (rational) decision-making. We provide empirical evidence for the existence of such behavioral bias model through a controlled subject study with 145 participants. We then propose three learning techniques for enhancing decision-making in multi-round setups. We illustrate the benefits of our decision-making model through multiple interdependent real-world systems and quantify the level of gain compared to the case in which the defenders are behavioral. We also show the benefit of our learning techniques against different attack models. We identify the effects of different system parameters (e.g., the defenders' security budget availability and distribution, the degree of interdependency among defenders, and collaborative defense strategies) on the degree of suboptimality of security outcomes due to behavioral decision-making.",
keywords = "attack graphs, behavioral decision-making, guiding security decision-makers, learning attacks, reinforcement learning, security games",
author = "Mustafa Abdallah and Daniel Woods and Parinaz Naghizadeh and Issa Khalil and Timothy Cason and Shreyas Sundaram and Saurabh Bagchi",
note = "Publisher Copyright: {\textcopyright} 2021 ACM.; 16th ACM Asia Conference on Computer and Communications Security, ASIA CCS 2021 ; Conference date: 07-06-2021 Through 11-06-2021",
year = "2021",
month = may,
day = "24",
doi = "10.1145/3433210.3437534",
language = "English",
series = "ASIA CCS 2021 - Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security",
publisher = "Association for Computing Machinery, Inc",
pages = "378--392",
booktitle = "ASIA CCS 2021 - Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security",
}