面向威胁猎人的认知支持工具
Towards a Cognitive-Support Tool for Threat Hunters
AI总结：
本文提出威胁猎人板，通过外部化推理和整理线索支持威胁猎人的认知工作，提供评估认知支持的六个设计启发法。
摘要：
网络安全日益依赖威胁猎人主动识别对抗活动，但威胁猎人背后的工作认知仍然缺乏研究或现有工具支持不足。基于先前研究，探讨威胁猎人在调查中如何构建和分享心理模型，我们推导出一组设计提案以支持其认知和协作工作。本文提出了威胁猎人板，一个原型工具，通过使威胁猎人能够外部化推理、整理调查线索并维持会话间的连续性来实现这些设计提案。采用设计科学范式，我们描述了解决方案的设计理由和产品开发。此外，我们提出了六个设计启发法，形成评估威胁猎人工具中认知支持的解决方案评估框架。通过认知走查的初步评估提供了早期可行性证据，而未来的工作将专注于专业威胁猎人基于用户的验证。
英文摘要：
Cybersecurity increasingly relies on threat hunters to proactively identify adversarial activity, yet the cognitive work underlying threat hunting remains underexplored or insufficiently supported by existing tools. Building on prior studies that examined how threat hunters construct and share mental models during investigations, we derived a set of design propositions to support their cognitive and collaborative work. In this paper, we present the Threat Hunter Board, a prototype tool that operationalizes these design propositions by enabling threat hunters to externalize reasoning, organize investigative leads, and maintain continuity across sessions. Using a design science paradigm, we describe the solution design rationale and artifact development. In addition, we propose six design heuristics that form a solution-evaluation framework for assessing cognitive support in threat hunting tools. An initial evaluation using a cognitive walkthrough provides early evidence of feasibility, while future work will focus on user-based validation with professional threat hunters.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
