从模糊到清晰：阐明威胁猎手的认知过程与认知支持需求
Fuzzy to Clear: Elucidating the Threat Hunter Cognitive Process and Cognitive Support Needs
AI总结：
本研究针对当前网络安全工具多聚焦自动化、忽略人的因素的问题，通过观察威胁猎手工作，提出其认知过程模型、23项需求主题及5项设计主张，为以人为中心的威胁狩猎工具设计提供理论与实践参考。
摘要：
随着安全威胁的发生频率与严重程度不断上升，重视威胁猎手的重要作用至关重要。这些受过高度训练的安全专业人员学习如何发现、识别并拦截安全威胁。近年来网络安全领域的诸多研究及现有工具多聚焦于威胁狩猎流程的自动化，却常常忽略了关键的人的因素。本研究转变了这一研究范式，强调采用以人为中心的方法来理解威胁猎手的实际工作经验。我们通过观察威胁猎手的狩猎过程、分析他们提供的丰富洞见，力求深化对其认知过程及所需工具支持的理解。通过对威胁猎手开展的深入观察性研究，我们提出了一个模型，用于阐释他们在威胁狩猎过程中如何构建并完善自身的心智模型。我们还提出了23个主题，为更好地理解威胁猎手的需求奠定了基础，并给出了五项可落地的设计主张，以优化为他们提供支持的工具。通过这些贡献，本研究丰富了威胁狩猎领域的理论认知，也为设计更高效、更具人文关怀的网络安全工具提供了实践洞见。
英文摘要：
With security threats increasing in frequency and severity, it is critical that we consider the important role of threat hunters. These highly-trained security professionals learn to see, identify, and intercept security threats. Many recent works and existing tools in cybersecurity are focused on automating the threat hunting process, often overlooking the critical human element. Our study shifts this paradigm by emphasizing a human-centered approach to understanding the lived experiences of threat hunters. By observing threat hunters during hunting sessions and analyzing the rich insights they provide, we seek to advance the understanding of their cognitive processes and the tool support they need. Through an in-depth observational study of threat hunters, we introduce a model of how they build and refine their mental models during threat hunting sessions. We also present 23 themes that provide a foundation to better understand threat hunter needs and suggest five actionable design propositions to enhance the tools that support them. Through these contributions, our work enriches the theoretical understanding of threat hunting and provides practical insights for designing more effective, human-centered cybersecurity tools.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
