Mission Command in the Age of Network-Enabled Operations: Social Network Analysis of Information Sharing and Situation Awareness

A 3D mixed reality visualization of network topology and activity results in better dyadic cyber team communication and cyber situational awareness

Background

Cyber defense decision-making during cyber threat situations is based on human-to-human communication aiming to establish a shared cyber situational awareness. Previous studies suggested that communication inefficiencies were among the biggest problems facing security operation center teams. There is a need for tools that allow for more efficient communication of cyber threat information between individuals both in education and during cyber threat situations.

Methods

In the present study, we compared how the visual representation of network topology and traffic in 3D mixed reality vs. 2D affected team performance in a sample of cyber cadets (N = 22) cooperating in dyads. Performance outcomes included network topology recognition, cyber situational awareness, confidence in judgements, experienced communication demands, observed verbal communication, and forced choice decision-making. The study utilized network data from the NATO CCDCOE 2022 Locked Shields cyber defense exercise.

Results

We found that participants using the 3D mixed reality visualization had better cyber situational awareness than participants in the 2D group. The 3D mixed reality group was generally more confident in their judgments except when performing worse than the 2D group on the topology recognition task (which favored the 2D condition). Participants in the 3D mixed reality group experienced less communication demands, and performed more verbal communication aimed at establishing a shared mental model and less communications discussing task resolution. Better communication was associated with better cyber situational awareness. There were no differences in decision-making between the groups. This could be due to cohort effects such as formal training or the modest sample size.

Conclusion

This is the first study comparing the effect of 3D mixed reality and 2D visualizations of network topology on dyadic cyber team communication and cyber situational awareness. Using 3D mixed reality visualizations resulted in better cyber situational awareness and team communication. The experiment should be repeated in a larger and more diverse sample to determine its potential effect on decision-making.

Neurophysiological and emotional influences on team communication and metacognitive cyber situational awareness during a cyber engineering exercise

Background: Cyber operations unfold at superhuman speeds where cyber defense decisions are based on human-to-human communication aiming to achieve a shared cyber situational awareness. The recently proposed Orient, Locate, Bridge (OLB) model suggests a three-phase metacognitive approach for successful communication of cyber situational awareness for good cyber defense decision-making. Successful OLB execution implies applying cognitive control to coordinate self-referential and externally directed cognitive processes. In the brain, this is dependent on the frontoparietal control network and its connectivity to the default mode network. Emotional reactions may increase default mode network activity and reduce attention allocation to analytical processes resulting in sub-optimal decision-making. Vagal tone is an indicator of activity in the dorsolateral prefrontal node of the frontoparietal control network and is associated with functional connectivity between the frontoparietal control network and the default mode network. Aim: The aim of the present study was to assess whether indicators of neural activity relevant to the processes outlined by the OLB model were related to outcomes hypothesized by the model. Methods: Cyber cadets (N = 36) enrolled in a 3-day cyber engineering exercise organized by the Norwegian Defense Cyber Academy participated in the study. Differences in prospective metacognitive judgments of cyber situational awareness, communication demands, and mood were compared between cyber cadets with high and low vagal tone. Vagal tone was measured at rest prior to the exercise. Affective states, communication demands, cyber situational awareness, and metacognitive accuracy were measured on each day of the exercise. Results: We found that cyber cadets with higher vagal tone had better metacognitive judgments of cyber situational awareness, imposed fewer communication demands on their teams, and had more neutral moods compared to cyber cadets with lower vagal tone. Conclusion: These findings provide neuroergonomic support for the OLB model and suggest that it may be useful in education and training. Future studies should assess the effect of OLB-ing as an intervention on communication and performance.

Which Tools in Multimedia Are Best for Learning Outcomes? A Study Grounded in Cognitive Load Structures

The main objective of this study is to investigate the importance of three compositions in multimedia for learning outcomes (LOs) in relation to individual differences in short-term memory (STM) capacity. The study is based on a survey of 378 individuals at the bachelor level (military officers, teachers, and psychology students). The LOs of three different multimedia compositions (means) were tested. This applied to individuals with low, medium, and high STM capacity. The results show that the successive presentation (Type II) of learning materials through multiple representation forms/channels (speech, pictures, and screen text/labels) provides a better LO than just speech (Type I) and simultaneous presentation (Type III). Overall, visual and verbal channel capacities did not contribute to the LO in any of the three tools tested, but some specific STM capacity types or substructures (visual and verbal progressive capacities) and non-verbal (RAPM) types have significance, particularly in exploiting successive presentation (Type II) for learning. Although the tools used in the multimedia educational material had a low cognitive load, the individuals with low capacity learned relatively less than the individuals with higher capacity. A symbolic form of expression was introduced concerning the relationship between cognitive load structure (CLS) and LOs through various tools in multimedia as an aid in the theoretical and empirical analyses. This is referred to as the CLS-LO formula. The main assumption of this study, based on previous empirical and theoretical ones, is that the relationship between CLS and LO is expressed with the following CLS-LO formula: CLSTypeIII>CLSTypeII>CLSTypeI→LOTypeIII>LOTypeI>LOTypeII. Based on this study, the relationship became: CLSTypeIII>CLSTypeI>CLSTypeII→LOTypeII>LOTypeI=LOTypeIII. This basic research study is primarily a contribution to understanding underlying cognitive processes in STM and their importance for learning in multimodal forms compared with analogue text. The findings will also be relevant as a basis for performance analysis and decision-making under high information pressure, risk, and unpredictable conditions.

Visualizing the Process of Disaster Mental Health Services in the Joso Flood by Network Analyses of Emails

Joso City, Ibaraki Prefecture, Japan was severely affected by flooding of the River Kinugawa in September 2015. Local psychiatric organizations immediately began providing disaster mental health services (DMHS). In post-disaster settings, DMHS involving organizational interventions by multiple regional institutions are required to support disaster victims. However, little is known about the process of coordinating multiple institutions or determining whether appropriate support has been provided. To elucidate the characteristics of communications that enable effective disaster medical team formation, we conducted network analyses of sender-recipient pairs of emails during the period of DMHS activity. The network analysis is a research method that represents various objects as a network of nodes and edges and explores their structural characteristics. We obtained 2,450 time-series emails from five core members of DMHS, including 32,865 pairs of senders and recipients. The network generated by the emails was scale-free, and its structure changed according to the phases of disaster recovery. In the ultra-acute phase, which lasted about 1 week, spreading information and recruiting people to provide disaster support was given the highest priority. In the acute phase, which lasted about 1 month, support and swift decision-making were essential for directing large numbers of staff. In the mid- to long-term phase, support for staff to share information and experience in small groups was observed. Network analyses have revealed that disaster medical teams must change their communication styles during the mission to adapt to different health needs corresponding to each post-disaster phase.

Self-Regulation and Cognitive Agility in Cyber Operations

Reliance upon data networks to conduct military operations presents new challenges to the competence profiles of military personnel. Specifically the increased demand for the new category of military cyber personnel is a direct consequence of the utility of the cyber domain in contemporary military operations, both to support leadership processes and as a domain of operations on its own. The conflation of the cyber and physical domains empowers cyber operators to influence events beyond their immediate physical environment. Proper education and training of such personnel requires new insight into the competencies that are beyond cyber specific technical skills, to govern the complexity of operating in a cyber-physical hybrid environment. This pilot research contributes to the debate on military cyber personnel competencies by investigating how cyber defense operator’s level of self-regulation can contribute to their performance in operations. We hypothesize that higher levels of self-regulation predicts higher levels of cognitive agility as measured by cognitive movement in The Hybrid Space conceptual framework. Displays of cognitive agility within The Hybrid Space have previously been linked to performance in defensive cyber operations. A positive association was therefore expected between levels of self-regulation and displays of cognitive agility. N = 23 cyber cadets from the Norwegian Defence Cyber Academy (NDCA) completed self-regulation questionnaires (SRQs) and self-reported their cognitive location in The Hybrid Space during a 4-day cyber defense exercise. Data showed that higher levels of self-regulation were associated with displays of cognitive agility. According to the regression models in use, self-regulation could explain 43.1% of the total cognitive movements in The Hybrid Space. Understanding factors that contribute to cyber operator performance are needed to improve education and training programs for military cyber personnel. Validating self-regulation as a contributing factor to cognitive agility is important as this can be a pathway to empirically underpin individual cyber operator performance.

Cyber Teaming and Role Specialization in a Cyber Security Defense Competition

A critical requirement for developing a cyber capable workforce is to understand how to challenge, assess, and rapidly develop human cyber skill-sets in realistic cyber operational environments. Fortunately, cyber team competitions make use of simulated operational environments with scoring criteria of task performance that objectively define overall team effectiveness, thus providing the means and context for observation and analysis of cyber teaming. Such competitions allow researchers to address the key determinants that make a cyber defense team more or less effective in responding to and mitigating cyber attacks. For this purpose, we analyzed data collected at the 12th annual Mid-Atlantic Collegiate Cyber Defense Competition (MACCDC, http://www.maccdc.org), where eight teams were evaluated along four independent scoring dimensions: maintaining services, incident response, scenario injects, and thwarting adversarial activities. Data collected from the 13-point OAT (Observational Assessment of Teamwork) instrument by embedded observers and a cyber teamwork survey completed by all participants were used to assess teamwork and leadership behaviors and team composition and work processes, respectively. The scores from the competition were used as an outcome measure in our analysis to extract key features of team process, structure, leadership, and skill-sets in relation to effective cyber defense. We used Bayesian regression to relate scored performance during the competition to team skill composition, team experience level, and an observational construct of team collaboration. Our results indicate that effective collaboration, experience, and functional role-specialization within the teams are important factors that determine the success of these teams in the competition and are important observational predictors of the timely detection and effective mitigation of ongoing cyber attacks. These results support theories of team maturation and the development of functional team cognition applied to mastering cybersecurity.