Advertisement
Top

Security automation and psychology share risks: the recency bias

July 28, 2016

The rate of information increase nowadays is unprecedented, making big data look like a virtual triangle-shaped bundle, whose base is continually growing larger as we speak. The older information lies somewhere beneath this immediate bunch of huge data, and this structure determines the prevalence of more recent elements in automated operations to the detriment of older data. This phenomenon is denominated the recency bias.

Outside the cyber-environment recency bias defines as the type of cognitive bias where a person more easily and vividly remembers a recent event than an older one, thus modifying their importance, proportions or impact in their thought process.

In cyber-security data processing, the recency bias causes a degree of inaccuracy, which makes absolute security presumptions become erroneous. Without human reassessment, automated systems are prone to be victims of their own faults – recency bias being one of them.

The direct effect of recency bias in security automation

There is a tendency to exaggerate the anticipation capacities of automated security tools when promoting these types of software. However, the primary effect of the unavoidable recency bias lies precisely in undermining such anticipation abilities: future events will be envisaged as resembling more recent experiences, rather than determined by an algorithm based on the ensemble information.

Basically, this inherent defect in the current big data analysis turns the results into “unhelpful and misleading” information.

Machine learning improves via adding human-like features, but this time it’s about acknowledging such an already existing feature and trying to solve its uncertainty-generating effects. The previously quoted source suggests that tuning the data preservation process and making it more selective would reverse the imbalance that distorts the capacity of automated anticipation.

The recency importance in human memory

The recency effect in psychology is subsidiary to the serial position effect, where the middle occurrences from a series would be most disadvantaged in comparison with the first and last items.

Without attempting to elaborate these memory patterns (or in other words, natural algorithms), it is useful to see them in equation with the fact that human memory mechanisms are still under research, since this vast domain is yet only partly understood.

As in all storage systems, the preserved items need to be organized and have different means of being accessed, triggered by various factors. It is logical to presume that humans may irregularly order facts in view of their emotional relevance. Some events may keep an artificial recency trait because the person is regularly replaying them, while others are buried deep in the pile of older events because they are associated with negative emotions.

Therefore, in theory, an artificial replica of human thought could receive a more varied set of rules by which the information would be organized and stored. Ranking events when they enter the system and attaching special values to them while in storage could serve as a selection method that would help later in event processing.

When a cyber-security anticipative reasoning process would choose the highest-ranking events instead of the most recent (and predominant in quantity) events, the accuracy should increase.

Intelligent security software – disadvantages and advantages

Perhaps you have heard of the Watson supercomputer and its cognitive cyber-security goals – researchers are planning to feed useful data in huge quantities to this machine in order to fuel its cyber-security analysis capacities, especially aiming for its anticipation abilities.

Since this artificial intelligence system (and from what we know any other similar system) cannot reach out and perform a voluntary information input, its abilities’ enhancement depends on the way specialists select and introduce data into its memory.

This can be construed as both a major disadvantage and advantage. The AI is limited by this human-induced pre-selection, yet a refined, improved selection would be able to generate more accurate results, while keeping the system in predictable parameters.

Therefore the recency bias in artificial intelligence processes could be reduced (and further adjusted) via human actions, while keeping all the characteristics that make this type of processes better than human reasoning, (such as speed, the capacity of processing vast amounts of data, the possibility of being always on).

Machine learning can serve cyber-security to perfection, as long as human specialists tailor the right algorithms and work out the best data selection/ranking process in order for the artificial “brain” to consistently process the events. Intelligent forgetting, as the BBC puts it, is necessary in order to perfect the next generation of automated tools that would monitor, protect and anticipate future cyber-security events.

Other similar big data biases that might affect artificial intelligence

Business Insider listed in an article a few of the daily cognitive biases humans face. Reconstituting the process the authors of this article went through, we found that more than one of this biases is worth considering in the artificial intelligence context.

  • The availability heuristic bias (overestimating the value of available information while discarding the importance of unknown but existing information);
  • The information bias (placing too much emphasis on the data volume dimension and accumulating even more information when preparing to process it in view of a more accurate result, although in the machine environment recognizing patterns might relief part of the unnecessary elements);
  • Salience, (which translates into the tendency to attribute easily recognizable features and characters that are statistically incorrect; this might happen when machines include social media data and consider trending elements in a way that would overpower mathematics operations);
  • The zero-risk bias (the concept that by mathematically eliminating all risks there would be no need for further vigilance).