论文标题
哭泣的狼：在网络安全分析中，迈向实验平台和数据集，以实现人为因素
Cry Wolf: Toward an Experimentation Platform and Dataset for Human Factors in Cyber Security Analysis
论文作者
论文摘要
计算机网络防御是自动化系统与人类网络安全分析师之间的合作伙伴关系。系统行为，例如提高大量的错误警报，可能会影响网络分析师的绩效。由于缺乏获得安全专家的访问，攻击数据集的可用性以及使用安全分析工具所需的培训，分析系统域中的实验是具有挑战性的。本文介绍了Cry Wolf，这是一种用于网络安全分析任务的用户研究的开源Web应用程序。本文还提供了73个True和False Intrusion检测系统（IDS）警报的开放访问数据集，该警报来自“不可能旅行”场景的现实示例。哭泣的狼和不可能的旅行数据集用于实验中，介绍了IDS错误警报率对分析师能力的影响，以正确或错误的警报将IDS警报分类为真或错误。该实验的结果用于使用难度和歧视指数衡量标准来评估数据集的质量。数据集中的许多警报为参与者的整体任务绩效提供了良好的歧视。
Computer network defense is a partnership between automated systems and human cyber security analysts. The system behaviors, for example raising a high proportion of false alarms, likely impact cyber analyst performance. Experimentation in the analyst-system domain is challenging due to lack of access to security experts, the usability of attack datasets, and the training required to use security analysis tools. This paper describes Cry Wolf, an open source web application for user studies of cyber security analysis tasks. This paper also provides an open-access dataset of 73 true and false Intrusion Detection System (IDS) alarms derived from real-world examples of "impossible travel" scenarios. Cry Wolf and the impossible travel dataset were used in an experiment on the impact of IDS false alarm rate on analysts' abilities to correctly classify IDS alerts as true or false alarms. Results from that experiment are used to evaluate the quality of the dataset using difficulty and discrimination index measures drawn from classical test theory. Many alerts in the dataset provide good discrimination for participants' overall task performance.
