Psychological Intrusion Detection System: Securing Cyber-Physical Systems Through Urgency Factors

Due to the growing reliance on technology in society, cyber-physical systems have gained popularity in various fields: industrial control systems, communications networks, and more. Nevertheless, cyber-attacks have increased, especially on the data transmission layer used for routing and communication. Previous literature has demonstrated the promise of using machine learning in network intrusion detection. However, the effectiveness of urgency cues has not been investigated for this task. Urgency is defined by the psychological tendency to complete tasks within a certain time frame based on emotional motives. Thus, the researcher proposes a novel, machine learning algorithm to detect network intrusion based on added urgency metrics. Specifically, positive urgency cues, created by positive emotions and success, and negative urgency cues, formed from negative emotions and failures, are used to represent attacker behavior, which are then incorporated into a machine learning model for intrusion detection. The concept of successes and failures is associated with an attacker’s achievement of elevated permissions, commands executed, and more. These tasks are considered within a time frame to compute an attacker’s positive and negative urgency. These urgency levels are represented in various manners (binary coding, categorical representation, numerical level) to determine the best representation of urgency in intrusion detection. Through various machine learning models, the researcher observed the highest accuracy of 98.91% with a random forest classifier and improvements of up to 11.18% in accuracy for all models using the additional urgency metrics. Thus, the researcher constructed a reliable intrusion detection model that applies the psychological theory of urgency.