In this project, we set out to investigate user-centered security by concentrating at the most fundamental component governing user behavior – the human brain. The goal of our research is to enhance the current knowledge in, and address fundamental questions pertaining to, user-centered security by adopting a neuropsychological approach in conjunction with the behavioral approach.
The primary questions driving our research include:
- Whether or not users actively engage in security tasks as captured by the neural activity when subject to these tasks;
- What brain regions get activated while performing these tasks, and do these regions correspond to regions known to govern higher order cognitive processing;
- How well users perform at these tasks (behavioral performance);
- Is the neural response correlated with, and could be used to predict, behavioral performance;
- Do users ignore or bypass these tasks;
- Whether certain personality traits (e.g., impulsivity) influence, and could be used to predict, users’ security behavior, neural activity and performance;
- How effective interventional training can be when targeted at people with specific personality traits in order to improve their neural activity and performance; and
- Is users’ behavior/performance in one security task (e.g., phishing) related to, and could be used to predict, their behavior/performance in another, potentially more complex, security task (e.g., warnings).
As part of a potentially transformative and revolutionary research project, Ajaya Neupane, Michael Georgescu, and Lutfor Rahman, students majoring in Computer & Information Sciences, are researching these questions based on fMRI and EEG scans under the guidance of Nitesh Saxena.
Our studies will provide:
- The brain level markers for security decisions;
- The behavioral performance;
- The brain-behavior relationship, and the prediction of behavioral performance based on brain response;
- The prediction of brain activity and behavioral performance based on personality traits; and
- Prediction of brain activity and behavioral performance in one task based on that in the other task.
Finally, based on these findings, our work will come up with a set of user-centered principles that would effectively guide the design of defense mechanisms and secure user behavior. Specifically, we will strive to improve the user’s behavioral performance with respect to phishing detection and malware warnings tasks. We will use our experiment findings (1-5 above) to better understand personality and/or neural characteristics of individuals that are associated with poor performance in the presence of phishing and malware attacks, and we will then test the effectiveness of additional targeted training for these individuals, through a longitudinal intervention study, in order to improve their brain/behavioral performance.