{'fraction_non_alphanumeric': 0.02405898331393093, 'fraction_numerical': 0.007372914241365929, 'mean_word_length': 5.1810551558753, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
An Abductive Approach to Covert Interventions

An Abductive Approach to Covert Interventions Hongbin Wang (Hongbin.Wang@uth.tmc.edu) School of Biomedical Informatics, University of Texas Health Science Center at Houston 7000 Fannin Suite 600, Houston, TX 77030, USA Yanlong Sun (Yanlong.Sun@uth.tmc.edu) School of Biomedical Informatics, University of Texas Health Science Center at Houston 7000 Fannin Suite 600, Houston, TX 77030, USA Abstract We explore ways of covertly delivering interventions into the adversary decision cycles so as to effectively shape adversary decision-making and performance without inducing much suspicion. Recognizing that completely covert interventions, while most effective, are difficult to implement, we focus on a more general mode of covertness. Based on insights from human abductive reasoning, we propose a delivery scheme that contains interventions that may be noticeable but whose true meanings are hidden or distorted (e.g., the human operators do not easily attribute the interventions to malicious attacks). We evaluate, both theoretically and empirically, the effectiveness and robustness of this scheme in escaping detection and disrupting performance. Keywords: Abduction, decision making, cybersecurity, intervention. General Formatting Instructions A cyber attack is more damaging and harmful if it is stealthy and escaping detection. One critical challenge in cyberspace security is therefore to find ways to effectively detect hidden or covert attacks. One approach to meeting the challenge is to look at the other side of the coin and study how and why some attacks can be delivered covertly that induce no or minimal suspicion from the human operator. The results from this approach can then be used to design better countermeasures and improve security. Here we focus on the concept of “covertness” in cyber attacks and intend to discover the theoretical essence and practical guidelines of implementing “covertness”. Presumably, a covert attack would be one that is completely hidden and not noticed by the targeted operator at all. In this sense, covertness can be implemented as slip of attention. Examples include attention blink, change blindness, and inhibition of return, to name a few. While a large body of evidence has confirmed that attention is a fragile cognitive function that can be manipulated and exploited for the purpose of implementing covertness, it has also been suggested that the attention-based approach is quite limited and difficult to apply in the real world situations. There is at least another mode of covertness. In this mode, signs of the intervention are noticed by the human operator (therefore, the intervention is not completely hidden and escaping attention), however, the true meaning/significance of the intervention is disguised or distorted or hidden in such a way that they do not easily result in suspicion of outside influence. This mode of covertness suggests new ways of implementing covertness. Consider the following scenario: It is 12am and that John, an analyst, is working on a sensitive document on his computer and you have delivered a virus to his computer in order to take a peek. Ideally, you would like your operation is completely invisible to John, but unfortunately, one inevitable side effect of your virus is that John’s computer becomes slow, which John eventually notices and starts to become suspicious. Then John receives an alerting pop-out message informing him that the antivirus software on his computer has started scanning as scheduled and that so far no virus has been found. John now understands why his computer becomes slow, is relieved, and continues to work on his document, without realizing your peeking eyes. Though hypothetical, this example highlights an important aspect of covertness, which has to do with an understanding of how a human operator reasons and explains unexpected observations and if and when the operator becomes suspicious given data. In the example, John becomes suspicious when he notices that his computer slows down, an often-inevitable indicator of attacks. But his suspicion fades away after the pop-out message, which is also delivered by the attacker with the goal to provide a better explanation for the slow-down so as to reduce John’s suspicion. Instead of directly exploiting the low-level attentional function, this mode of covertness depends upon exploiting a higher-level human inference system called abduction. We argue that this mode of covertness is more general, more realistic and potentially more powerful. Abduction-based Covertness Abduction was introduced by American philosopher Charles S. Peirce (1839-1914) as a form of human inference that is different from deduction and induction. According to Peirce, in abduction one infers causes from effects or explanations from observations (See Fann, 1970 for a general introduction to Peirce's theory of abduction). The general form of abduction is shown below, A fact C is observed, H can explain C; Hence, H may be true. Here is a specific example of abductive inference, in the context of the hypothetical scenario above,