Simulating Trust Dynamics Model for Interaction between Human and Intrusion Detection System under Hybrid Denial-of-Service and Spearphishing Campaigns

Machine learning-based intrusion detection systems are compared by classification metrics, which do not capture how sequences of detector outputs shape operator trust and organizational damage. This study develops an agent-based model of the interaction between a human and an intrusion detection system (IDS) in the Organization Simulation In Response to Intrusion Strategies (OSIRIS) framework. The model separates true positives, false positives, false negatives, true negatives, and attack-type misclassifications, and updates the security officer’s trust on the four outcomes the officer actually experiences, scaling each change by the distance between current trust and the level that outcome supports. Trust gates whether an alert is investigated, while fatigue and job performance govern response success. Six detectors trained on NSL-KDD and UNSW-NB15 face an APT 28-inspired campaign that combines denial-of-service with spearphishing for data exfiltration, and damage is measured as server downtime and exfiltrated data volume. Across a full-factorial design, trust converges to a fixed point set by the balance of confirming against disconfirming outcomes, and the dominant determinant of damage shifts with the detector regime: detector identifies when false alarms saturate the operator, and operator fatigue otherwise. Accuracy predicts protection only within limits, as the most accurate classifier allows more exfiltration than three less accurate ones because it never monitors the techniques lying on the exfiltration path.