A Cyber-War Between Bots: Cognitive Attackers are More Challenging for Defenders than Strategic Attackers

Adversary emulation is commonly used to test cyber-defense performance against known threats to organizations. However, many adversary emulation methods often rely on automated planning and underplay the role of human cognition. Consequently, defenders are often underprepared for human attackers who can think creatively and adapt their strategies. In this article, we propose the design of adversarial cognitive agents that are dynamic, adaptable, and able to learn from experience. These cognitive agents are built based on the theoretical principles of Instance-Based Learning Theory (IBLT) of experiential choice in dynamic tasks, making them more challenging than strategically optimal adversaries for human defenders. Our research offers three main contributions. First, in a simulation experiment, we demonstrate how IBL attacker agents can learn from experience and become as efficient as optimal strategic algorithms against a strategic defender. In a second simulation experiment, the IBL attackers are pitted against an IBL defender, showing that the IBL attacker can be a more challenging adversary for the IBL defender, while the IBL defender can learn to counter carefully crafted optimal attack strategies. To test these observations, we conducted a third experiment, where humans played the role of defenders against both strategic and IBL attackers in an interactive task. The results confirm the predictions of the second simulation experiment: Cognitive attackers are more challenging for human defenders than strategic attackers. These insights contribute to informing future adversary emulation efforts and training of cyber defenders.