Understanding Cyber Attackers Through Behavioral Science: A Systematic Study of the Representativeness Heuristic

Research on decision making has identified a large number of systematic patterns in how humans process information and make choices; these are often called cognitive biases because they reflect deviations from perfectly rational choices. Cyber attackers make extensive use of vulnerabilities in decision making (e.g., in many types of social engineering attacks), but cyber defenses rarely try to exploit similar vulnerabilities in cyber attackers. We evaluate the role of Denominator Neglect (DN) and the Hot Hand Fallacy (HHF) in decision made by cyber attackers; both of these are effects of using the Representativeness Heuristic. Our experimental design combines established tasks used to measure these effects with Cyber Isomorphs (CI)-novel tasks presented in a cyber context that mirror tasks use in the literature to the extent possible. This allows us to test whether the effects observed in the literature will translate consistently into more realistic cyber attack scenarios. We conducted a survey comprising both tasks with 85 participants screened for basic cybersecurity knowledge. We observe that participants make choices consistent with denominator neglect and the hot hand fallacy in both variants of the task, with statistically significant differences from the rational baseline in most conditions. The effect size for HHF was particularly strong with biased choices in more than 75% of cases. We also observe that the effects are often stronger in the cyber tasks than the original tasks.