Mindtrap: a theoretical framework for detecting cognitive biases in cyber attackers and supporting bias-driven scenario construction

Abstract

As network attacks are becoming increasingly sophisticated, there is a need to develop new defense techniques. Recent research has demonstrated the successful use of cognitive biases to obstruct progress in network attacks by constructing scenarios that exploit biases in attackers. Cognitive biases in cyber attackers can influence decisions and attack paths. Although psychology is a determining factor to cyber attackers decisions, existing cyber defenses don't currently use psychology to guide defense. While informal definitions of many cognitive biases are well-established, the lack of definitions in a formal language limits the ability to construct scenarios in an automated fashion and, to make use of cognitive biases in cyber defenses. To investigate this direction, the thesis proposes MindTrap (Modeling Inference aNd Decision-making through Theoretical Representation of Attacker Psychology), a theoretical framework that models attacker cognitive biases and uses first-order-logic-based rules to describe how cognitive biases may manifest during an intrusion. The framework outlines procedures for identifying bias-relevant cues, representing attacker activities within structured templates, and mapping these activities to hypothetical adaptive honeypot scenarios. Rather than implementing a full operational system, the work develops a conceptual methodology demonstrating how cognitive-bias indicators could be incorporated into scenario generation and attacker-state modeling. The analysis shows that cognitive-bias patterns can be systematically encoded and used to characterize plausible attacker decision pathways, offering two potential outcomes: (1) richer attack-path representations that include both behavioral and cognitive signals, and (2) theoretically grounded mechanisms for guiding adaptive deceptive responses in honeypot environments. These results illustrate how psychological insights might enhance threat analysis and expand the strategic capabilities of existing defensive infrastructures. The thesis concludes that integrating cognitive psychology into cyber defense holds significant promise for shaping attacker behavior and strengthening deception strategies. While MindTrap is conceptual rather than implemented, it establishes a foundational blueprint for future empirical work and lays the groundwork for building adaptive, cognitively informed defensive systems.