Improving Cyber Situation Awareness by Building Trust in Analytics

  • Margaret CunninghamEmail author
  • Dalwinderjeet Kular
Conference paper
Part of the Advances in Intelligent Systems and Computing book series (AISC, volume 903)


Analysts depend on technology to access and understand information, information that ultimately impacts their level of Cyber Situation Awareness (CyberSA). Adoption of advanced analytics, particularly those that generate risk scores or that depend on machine learning, can be impacted by a lack of trust in what the scores represent. Lack of trust in analytics can negatively impact CyberSA and efficient decision making, as analysts who do not trust outcomes from analytic models continue to search for information that confirms the analytic outcome, or continue to seek supplementary environmental information prior to making critical decisions. While human-driven investigative work is, and will remain, critical for security operations, delays in decision making, and increased efforts in information gathering, can negatively impact the efficiency of threat detection. Semi-structured interviews with analysts revealed five avenues for improving trust in analytics, including Context-Based, Case-Based, Model-Based, Ethics-Based, and Human-Centric AI Improvements.


UEBA CyberSA Analytics Risk scores HCI 


  1. 1.
    Cisco Systems, Inc.: Annual cybersecurity report. Technical report (2018)Google Scholar
  2. 2.
    Forcepoint: The 2017 state of cybersecurity. Technical report (2017)Google Scholar
  3. 3.
    Endsley, M.R.: Toward a theory of situation awareness in dynamic systems. Hum. Fact. 37, 32–64 (1995)CrossRefGoogle Scholar
  4. 4.
    Barford, P., et al.: Cyber SA: situational awareness for cyber defense. In: Jajodia, S., Liu, P., Swarup, V., Wang, C. (eds.) Advances in Information Security, vol. 46. Springer, Boston (2010)Google Scholar
  5. 5.
    Fylan, F.: Semi-structured interviewing. In: Miles, J., Gilbert, P. (eds.) A Handbook of Research Methods for Clinical & Health Psychology, pp. 65–77. Oxford University, Oxford (2005)Google Scholar
  6. 6.
    Kallio, H., Pietila, A., Johnson, M., Kangasniemi, M.: Systematic methodological review: developing a framework for a qualitative semi-structured interview guide. J. Adv. Nurse. 72, 2954–2965 (2016)CrossRefGoogle Scholar

Copyright information

© Springer Nature Switzerland AG 2019

Authors and Affiliations

  1. 1.ForcepointAustinUSA

Personalised recommendations