Improving Cyber Situation Awareness by Building Trust in Analytics

Abstract

Analysts depend on technology to access and understand information, information that ultimately impacts their level of Cyber Situation Awareness (CyberSA). Adoption of advanced analytics, particularly those that generate risk scores or that depend on machine learning, can be impacted by a lack of trust in what the scores represent. Lack of trust in analytics can negatively impact CyberSA and efficient decision making, as analysts who do not trust outcomes from analytic models continue to search for information that confirms the analytic outcome, or continue to seek supplementary environmental information prior to making critical decisions. While human-driven investigative work is, and will remain, critical for security operations, delays in decision making, and increased efforts in information gathering, can negatively impact the efficiency of threat detection. Semi-structured interviews with analysts revealed five avenues for improving trust in analytics, including Context-Based, Case-Based, Model-Based, Ethics-Based, and Human-Centric AI Improvements.