Forcepoint™, formerly Raytheon|Websense, together with the Government Technology Research Alliance (GTRA)
Dr. Alenka Brown
President & Chief Scientist,
Dr. Joe McClure VanHoozer
Chief Subject Matter Expert,
Mr. Jason Christman, MS, CISSP, PMP
Subject Matter Expert
Neurocognitive Patterns in Cyberspace
Humans process somatosensory information – defined by Kandel, et al as “different forms of energy…transformed by the nervous system into different sensations or sensory modalities: vision, hearing, touch/emotion, taste, and smell”1 – at several levels simultaneously. This information, composed of neuro psychometric indicators (NPI) – the verbal and non-verbal cues of sensory modalities – is manifested in derivative forms of analog (non-verbal) and digital (verbal) forensic evidence.
This forensic evidence provides us with unique cognitive fingerprints, or Cogni-prints®, derived from sub-elements within sensory information. These sub-elements are as unique to each individual’s Cogni-print® as the distinct ridges, whorls, and loops of a physical fingerprint. Neuro analytics extracts NPI information in order to determine cognitive preferences and priorities (ordering and sequencing of neurosensory indicators), which carry forward to reflect user-driven network and system behaviors within any computing environment.
Cyber-threat actors, like everyone else, display contextspecific cognitive fingerprints when targeting and exploiting networks or users, and can thus be recognized by their Cogni-print®. Cyber analysts can then use neuro cyber analytics to obtain signatures for tracking and ascribing threat actors by an adversary’s Cogni-print®. These prints contain the process(es) adversaries use to make their move(s), e.g., internal timelines of the perpetrators’ experiences; how they delete, distort, and generalize information as they strategize next moves; recognition of their cognitive biases in decision-making, or which building blocks of the adversaries’ beliefs are vulnerable.
Neuro cyber analytics supplies another means to confront the onslaught of current and future cyber threats by incorporating human-dimensional insight.
Neuro Cyber Analytics
The use of neuro analytics in a cyber context serves to identify and extract neuro (or sensory) psychometric indicators using a variety of available data forms traceable to the subject, such as text from emails and documents, photos, voice recordings, video streams, desktop layout and preferences, web browsing activity, social media interaction, user-driven system and network behaviors, and more. From this information, neuro cyber analytics permits us to:
1. Establish metrics of the neurosensory indicators.
2. Determine the cognitive pattern (preferred sequencing of sensory modalities from available indicators).
3. Extract the deep structural meaning of the pattern.
4. Identify and extract meta-strategies (drivers of larger programming) from the meaning.
5. Expand the cognitive pattern into a Cogni-print®. We can compare neuro analytics to an assembly language, translating internal thought patterns into a cognitive pattern that can be further assessed by other human analysts, as well as reverse-engineered into cognitive fingerprints. The results of such an analysis are shown below in two examples.
Example One: Insider Threat
In this first example, a cognitive profile was generated from photos and videos of Edward Snowden. Using neuro
analytics, we evaluated his neurosensory indicators to ascertain how he prefers to receive and process information. Snowden appeared to capture information first by seeing the larger picture, which he then immediately reduced into more specific and detailed eidetics. As he assimilated the specifics, he associated primarily non-sensory, or non-descriptive, words with the picture to make sense of what he told himself he saw.
For Snowden, his baseline cognitive pattern for making
decisions, learning, strategizing, and so forth is to:
1. See the big picture.
2. Reduce the big picture to specific details on which to focus.
3. Search for, find, and assign words to match details of the bigger picture (which has now become a soundpicture).
4. Check feelings about match between the details/specifics of internal pictures he created for himself. If he determines a match, he grasps what has been heard-seen (tones of what is being said about the mental image he has created) to be correct.
5. If yes, he performs an internal check of what he senses to be accurate to ensure that he has a grasp of the information to make a final decision.
6. If no, recycle to #3 above and repeat until the information feels right to him (beliefs and values align);then he takes action
This assessment is the translation of the neuro indicators from his still photos and videos before and after his criminal actions. The extracted non-verbal indicators are aligned to the sensory modalities (visual, auditory, or kinesthetic) that form our thought patterns and drivers of human behaviors, decisions, and learning preferences.
In Snowden’s pattern, an internal articulation between his “grasp of understanding, and the details of the image,” which we will refer to as
Sense of – See details (mental details of the image),
is conducted when he updates his decisions based on new information acquired. He checks his sense of perception by performing a second internal toggle between words and details of the larger picture. Even though a match may exist between what he senses he hears/sees to be right, he will continue to search for information, weighing outcomes and options at each decision point. He will question himself at each point in his decision process, drilling down until he is satisfied with his answers, then moving onto the next step in his process. This feedback
loop continues until he feels that he is right about what he tells himself he has found. This attests to the amount of information he must acquire to satisfy himself that he is making the correct decision.
His baseline pattern permits him to move forward with
his convictions; control his movements methodically during his searches; and minimize external distractions by working within a well-formed outcome of options and self-defined procedures. He assesses and leverages the vulnerabilities of his colleagues, his leaders, policies, and system protocols, as well as his own actions, to determine human and system weaknesses.
When indecisive or in a state of stress, e.g. violating protocols, Snowden’s pattern is oriented more towards ‘feelings’ versus his ‘sense of’ (as in his normal baseline pattern). In his stress state he would concentrate on ‘internal tones’ that he has matched to words in an internal dialogue with himself while working through the stress or indecisiveness. During this time, he is highly attuned
to external sounds and movement fueled by internal emotions.
[Hearingtones matched to words in his head – Emotionsconnected to tone-words].
Since people prefer to be in a comfort zone, Snowden, like all of us, toggles between his baseline and stress pattern.
His strengths are:
1. He does not require the opinions of others in making final decisions.
2. He knows the weaknesses of others.
3. He plans well-formed outcomes with contingencies.
A person following his process would potentially be able to accomplish the same outcome today regardless of new controls, protocols, and procedures in place to prevent a similar breach.
Example Two: Child Exploitation
In this second example, we generated cognitive patterns from an exploratory analysis of textual meta-data composed of chat logs related to pedophiles operating within a dark web forum. The linguistic neurosensory indicators
(nouns, pronouns, verbs, predicates, etc.) were translated
into Cogni-prints® and displayed three distinct cognitive processing patterns.
The first pattern in this exploratory analysis had pedophiles operating primarily in the present from an emotional state. Specific visual details were then generated of the external image of the child, fueling the emotional experience further:
1. See (big picture).
2. Associate emotions with the picture.
3. Reduce big picture to specifics/details on which to focus.
4. Search for, find, and assign visual details, e.g. size, shape, texture, movement, to match to the bigger picture (#2 which has now become a picture with emotions).
5. Fuel emotions. If emotions match details/specifics of internal pictures created, the emotional experience was sustained.
6. If no, recycle to #4 above and repeat. This cycle is repeated for full emotional effect.
An additional pattern showed individuals who toggled between the present moment and the past. During this toggle, visual details were generated to acquire specific emotions from the internal image created from the external image being shown. Descriptive words and sounds were then connected to the visual details, which increased the emotional experience for continuous repetitive stimuli.1. See (big picture).
A third pattern showed a person who created visual details of the presentation while assigning non-sensory words to an internal image paired with descriptive details. These nonsensory words require others to assign their understanding to what is being shown or said. This pattern incorporated a feedback loop that permitted others to see a wider view of the visual details this person was showing and describing. There are no emotions associated with this process; it’s driven by the tone of others’ responses to the material.
These three patterns led to a speculation that these individuals have a different cognitive pattern in their normal daily routines and social life. For example, at the place of employment, these individuals would tend to demonstrate a normal pattern in which the sensory indicators are sorted, ordered, and sequenced as Feeling-Hearing-Visual or Hearing-Feeling-Visual orientation.
Therefore, if this person is using their work computer inappropriately, their behavior will toggle between their normal cognitive pattern and the inappropriate cognitive pattern. This change in pattern will be evident in the way the person is speaking (tones, tempo), sitting, breathing, interacting with others physically and virtually, running search routines (time, movement, selection of links), linguistic usage, mouse movements, keyboard typing, eye movements, and so forth. The patterns would be distinct enough to draw attention from system administrators.
Neuro cyber analytics supplies another means to confront the onslaught of current and future cyber threats by incorporating human-dimensional insight. The ability to form Cogni-prints® from analog and digital neuro psychometric indicators within a cyber environment is essential for remaining a step ahead of threat actors in the game of cyber-chess.
Cogni-prints® offer a new area of e-discovery study for different types of evidence, in a way that augments traditional digital forensics. This provides a powerful new analytic capability for establishing maneuvers to challenge cyber incursions.2 It permits one to identify an intruder’s strategic cognitive patterns as they navigate through systems and networks more stealthily to mitigate risks
Consequently, cyber analysts, operators, planners, and leaders must become extremely proficient when pitting their thinking processes against these intruders or criminals. Understanding how to exploit the intruders’ or criminal violators’ cognitive processing with neuro
cyber analytics can lead to an ultimate checkmate by identifying how these individuals form their patterns, giving insight into their expected behaviors prior to and during criminal actions.
1. Kandel, Eric R., James H. Schwartz, and Thomas M. Jessell. Principles of Neural Science. New York: McGraw-Hill, Health Professions Division, 2000. 329.
2. Brown, Dr. Alenka, and Jason Christman. “How to Win at Cyber-Chess: Leveraging
Neuro Analytics in Your Cyberspace.” United States Cybersecurity Magazine, April
Dr. Alenka Brown is a leading expert in Neuro Psychometric Analytics® and Cogni-print®. Her background encompasses applied research and development, strategic processing, communications and human factors engineering, instrumentation and controls,
cyber security for policy, intelligence, and operations, and next generation cognitive-behavior autonomous systems. She is a
member of working groups for NIST, OSSI, NCOIC, SIOAC; INSA’s Cyber R&D Subcouncil, and the GTRA Council.
Dr. Joe McClure VanHoozeris a leading expert in neuro analytics, neuro-linguistics, human decision analytics, and Cogni-print®. He has specialized knowledge engineering experience, evaluating strategic and tactical influence, crowd behavior analysis, and development of special behavior programs. He is a decorated two-tour Vietnam veteran and long-time Mensa member.
Jason Christmanis a leading expert in cyber operations strategy, planning and execution, cyber threat intelligence, and human decision analytics. His strategic planning, mission management, and technology development background spans homeland
defense, intelligence, special operations, and commercial telecommunication business areas. Jason is an ardent supporter ofhuman-centered computing and a proponent for the convergence of neurocognitive technology and cyber ecosystems.
Forcepoint™, formerly Raytheon|Websense, together with the Government Technology Research Alliance (GTRA)
GTRA Live @ AFCEA Defensive Cyber Symposium Hosted by RSA
Dr. Mansur Hasib CISSP, PMP CPHIMSCybersecurity Healthcare Leader
Federal IT Budget
by: Dr. Alenka Brown Senior Managing Member McClure, Brown, & Associates LLC Jason Christman MS, CISSP, PMP McClure, Brown, &…
June 29, 2015 – Gettysburg PA – The Government Technology Research Alliance (GTRA) announced the public and private sector…
Chuck McGann Former CISO USPS Joins GTRA Technology Advisory Board CRGT’s Chief Cyber Strategist, Chuck McGann, has been selected…
Top Government IT CIO’s Convene to Collaborate on Security, Big Data/Analytics, Mobile and EA/Infrastructure GTRA.org – March 23,…
CIO USDA Speaking on FITARA/Cyber Security February 17, 2016- The Government Technology Research Alliance Council executives will convene…