Attackers Have Prior Beliefs: Comprehending Cognitive Aspects of Confirmation Bias on Adversarial Decisions

Cyberattacks pose significant risks, and the use of honeypot deception has proven to be effective in countering them. However, owing to the complexity of cyber situations, adversaries are prone to various cognitive biases. One such bias that affects adversarial decisions is confirmation bias. Despite its significance, little is understood about the cognitive mechanisms driving confirmation bias in cyber decision-making. To investigate this, 120 participants were recruited online and randomly assigned to different conditions in a cybersecurity simulation that used deception techniques. The results demonstrate the presence of confirmation bias in adversarial decisions. Subsequently, a cognitive Instance-Based Learning Model was developed incorporating factors such as recency, frequency, and cognitive noise to uncover the underlying reasons for reliance on confirmation bias. The findings indicate that participants leaned heavily on recent events and encountered significant cognitive noise in their decision-making processes. These findings have important implications for real-world cyber decision-making, particularly in scenarios involving deception.