Cognitive Bias Detection in Cybersecurity Attack Sequences
An Interactive Framework for Real-Time Bias Assessment
Interactive Supplement to: "PsychSim-Based Framework for Modeling Cognitive Biases in Cybersecurity"
Abstract: This interactive framework demonstrates a computational approach to detecting cognitive biases in cybersecurity attack sequences. Using belief updating mechanisms based on the MITRE ATT&CK framework and network behavior, the system provides real-time assessment of cognitive vulnerabilities: availability heuristic, base rate neglect, confirmation bias, sunk cost fallacy, loss aversion, and rational (no bias) baseline. Users can manipulate model parameters and observe their effects on bias detection sensitivity and accuracy.
1. Methodology
Framework Overview: The model implements Bayesian belief updating with heuristic adjustment mechanisms. Each cognitive bias bi ∈ [0,1] represents the probability that the observed behavior is driven by bias i rather than rational decision-making. The "No Bias" probability represents the baseline likelihood of rational, unbiased behavior. Toggling off a bias will force its likelihood to stay near zero.
Model Parameters
No Bias (Rational Baseline)
Represents rational, unbiased decision-making. This is the baseline probability that observed behavior is driven by optimal strategy rather than cognitive biases.
bnone = 1 - Σ(bi) for all cognitive biases i
0.005
0.003
Sunk Cost Fallacy
Models continued investment in failing strategies due to prior resource commitment.
bt+1 = min(1.0, ratio × α + bt) if EFV ≤ 0
1.0
2
Base Rate Neglect
Ignoring historical success rates when updating beliefs about action effectiveness.
bt+1 = bt + (1 - bt) × β if SR < θ
0.4
0.02
Confirmation Bias
Tendency to stick with actions believed to be successful, even when they repeatedly fail.
bt+1 = bt + (1 - bt) × δ if observed rate < pprior
0.6
3
Loss Aversion
Disproportionate preference for low-risk actions to avoid potential discovery.
bt+1 = bt + (1 - bt) × γ if Pdisc < Pmax
0.1
Availability Heuristic
Overweighting easily recalled or salient target characteristics.
bt+1 = bt + (1 - bt) × δ if salient(target)
0.1
Experiment Controls
Participant Data Scenarios
Experimental Interface
0
Total Actions
0
Current Streak
0%
Success Rate
MITRE ATT&CK Actions
2. Results
Real-Time Bias Assessment
Calculation Log:
Execute actions to observe step-by-step bias calculations...
Execute actions to observe step-by-step bias calculations...
| Cognitive State | Current Probability | Change from Previous | Significance |
|---|---|---|---|
| No Bias (Rational) | 0.500 | — | — |
| Sunk Cost Fallacy | 0.125 | — | — |
| Base Rate Neglect | 0.125 | — | — |
| Confirmation Bias | 0.125 | — | — |
| Loss Aversion | 0.125 | — | — |
| Availability Heuristic | 0.125 | — | — |
3. Discussion
Interpretation Guidelines: Bias probabilities above 0.3 indicate moderate evidence of bias-driven behavior. Values above 0.5 suggest strong evidence. The "No Bias" probability represents the likelihood of rational, optimal decision-making. When this value is high (>0.4), the observed behavior is consistent with unbiased strategic thinking.