对抗信息拒绝服务（IDoS）攻击：注意力人类脆弱性的建模与缓解
Combating Informational Denial-of-Service (IDoS) Attacks: Modeling and Mitigation of Attentional Human Vulnerability
摘要：
这项工作提出了一类新的主动攻击称为信息拒绝服务（IDoS）攻击，利用注意力的人的脆弱性。IDoS攻击通过产生大量的假动作，耗尽了人类操作者的认知资源，使人类无法识别隐藏在假动作中的真正攻击。这项工作旨在正式定义IDoS攻击，量化其后果，并开发人工辅助安全技术，以减轻IDoS攻击的严重程度和风险。为此，我们使用半马尔可夫过程来模拟假动作和真实攻击的顺序到达，并在相关的警报中附加类别标签。辅助技术通过定期突出显示选择性警报来战略性地管理人类注意力，以防止其他警报分散注意力。一个数据驱动的方法被应用到不同的注意力管理（AM）策略下的人类绩效评估。在一个典型的特殊情况下，我们建立了两个动态规划表示之间的计算等价性，以降低计算复杂度，并使在线学习的样本减少的大小和零延迟。案例研究证实了学习框架的有效性。数值结果说明了AM策略如何减轻IDoS攻击的严重程度和风险。此外，研究结果表明，最小的风险是实现了一个适当的水平，我们称之为理性的风险减少注意疏忽的法律。
英文摘要：
This work proposes a new class of proactive attacks called the Informational Denial-of-Service (IDoS) attacks that exploit the attentional human vulnerability. By generating a large volume of feints, IDoS attacks deplete the cognitive resources of human operators to prevent humans from identifying the real attacks hidden among feints. This work aims to formally define IDoS attacks, quantify their consequences, and develop human-assistive security technologies to mitigate the severity level and risks of IDoS attacks. To this end, we use the semi-Markov process to model the sequential arrivals of feints and real attacks with category labels attached in the associated alerts. The assistive technology strategically manages human attention by highlighting selective alerts periodically to prevent the distraction of other alerts. A data-driven approach is applied to evaluate human performance under different Attention Management (AM) strategies. Under a representative special case, we establish the computational equivalency between two dynamic programming representations to reduce the computation complexity and enable online learning with samples of reduced size and zero delays. A case study corroborates the effectiveness of the learning framework. The numerical results illustrate how AM strategies can alleviate the severity level and the risk of IDoS attacks. Furthermore, the results show that the minimum risk is achieved with a proper level of intentional inattention to alerts, which we refer to as the law of rational risk-reduction inattention.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
