RADAMS: Resilient and Adaptive Alert and Attention Management Strategy
  against Informational Denial-of-Service (IDoS) Attacks
  Attacks exploiting human attentional vulnerability have posed severe threats
to cybersecurity. In this work, we identify and formally define a new type of
proactive attentional attacks called Informational Denial-of-Service (IDoS)
attacks that generate a large volume of feint attacks to overload human
operators and hide real attacks among feints. We incorporate human factors
(e.g., levels of expertise, stress, and efficiency) and empirical results
(e.g., the Yerkes-Dodson law and the sunk cost fallacy) to model the operators'
attention dynamics and their decision-making processes along with the real-time
alert monitoring and inspection.
  To assist human operators in timely and accurately dismissing the feints and
escalating the real attacks, we develop a Resilient and Adaptive Data-driven
alert and Attention Management Strategy (RADAMS) that de-emphasizes alerts
selectively based on the alerts' observable features. RADAMS uses reinforcement
learning to achieve a customized and transferable design for various human
operators and evolving IDoS attacks.
  The integrated modeling and theoretical analysis lead to the Product
Principle of Attention (PPoA), fundamental limits, and the tradeoff among
crucial human and economic factors. Experimental results corroborate that the
proposed strategy outperforms the default strategy and can reduce the IDoS risk
by as much as 20%. Besides, the strategy is resilient to large variations of
costs, attack frequencies, and human attention capacities. We have recognized
interesting phenomena such as attentional risk equivalency, attacker's dilemma,
and the half-truth optimal attack strategy.
