G. Durrieu et al.
504
effective layer in the cyber security system, beside innovative technologies. How-
ever, these levels of abstraction hierarchy as well as the mental picture levels can
be only deduced from the observable data. The observable outcomes that imply
the mental state of the agent is discussed in the sequel.
2.2.2. The Reaction Time to an Arrival Cyber Attack
The interaction of a person to a computer is more likely different according to
the current mental state of that one. Usually, the attackers never want their at-
tacks detected. Therefore, if the agents lack awareness, intrusion can be per-
ceived as a normal access, or the detection could be too late. From this argument,
we propose the following assumption:
• When a person is in high awareness, which means the actions will be based
on the fundamental knowledge of the cyber threats. Then the situation will
be perceived at its high abstraction hierarchy level. Roughly speaking, the
brain is always on high alert, which helps it detect the abnormal access soon.
Even if the detection is a false alarm, the system is still secure.
• In contrast, if one is in a low level of mental state, that person lacks aware-
ness of the potential dangers from an access. The attack will be perceived at
its low abstraction hierarchy level (e.g. physical form), since the brain is ‘tired’
to process the information to detect the abnormal activities. In the cognitive
terms, the reaction is low level behaviors. The agent focuses only on the
technical issues rather, the concrete form than the main purpose of the attack.
Therefore, the attack can pass and continue until it reaches the goal(s) or be-
ing detected.
With this observation, we propose
R
is a random variable representing the
time since the cyber threat arrives until the agent is aware of its activity. Very
likely, the high hierarchy levels agents spend less time to detect abnormal access
than the ones are in lower hierarchy levels. Let
denote the mean value of
R
,
this value
is constructed by three components
where
represents the basic reaction time of the agent with respect to the
current mental state, or the time needed for the agent to perceive the appearance
of an event’s arrival [9],
z
denotes the complexity of the attack,
is the av-
erage time needed in order to comprehend the content of the event; the value
depends on the complexity of the message and
represents the average
time required to reach the decision after comprehending the content.
3. Hidden Markov Based Model
Since the mental state at a certain time of the agent is unable to observe, and
could be only inferred from the observable data, this unobserved information
can be considered as a hidden sequence. In this section, we construct a model
using the hidden Markov chain to adjust the data. Particularly, the hidden Mar-
kov chain can be applied for modeling the abstraction hierarchy level of the at-
tack that the agent perceived as well as the corresponding mental picture level of