Neuro-Fuzzy Modeling of Decision-Making in Cyber Defense Exercises Using ANFIS and Synthetic Data Augmentation
Source abstract
Abstract
Decision-making in cyber defense exercises (CDX) is shaped by technical, emotional, motivational, and collaborative human factors under uncertainty and time pressure. This study proposes a human-centered Adaptive Neuro-Fuzzy Inference System (ANFIS) framework to model and predict Counterfactual Decision Reflection (CDR) outcomes in CDX environments. Two complementary datasets representing technical, emotional, motivational, and teamwork-related dimensions were collected from the international Lithuanian Armed Forces cyber defense exercise Amber Mist 2024 and analyzed using Spearman correlation, 3D regression surface modeling, fuzzy rule extraction, and ANFIS prediction to investigate the relationship between human factors and CDR. The results demonstrated that teamwork, communication, and collaboration have a stronger influence on decision stability than isolated technical competencies. Baseline ANFIS evaluation indicated that triangular membership functions provided the best generalization, while generalized bell functions achieved the lowest training errors. To improve model robustness, multiple synthetic data augmentation methods were evaluated. The augmented ANFIS models substantially improved predictive performance, reducing testing error values significantly. The findings confirm that synthetic-data-enhanced neuro-fuzzy modeling provides an effective and interpretable framework for analyzing human-centered cybersecurity decision-making processes in cyber defense exercises.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Information and Cyber Security · Bullying, Victimization, and Aggression · Human-Automation Interaction and Safety
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Information Systems, Vilnius Gediminas Technical University, Saulėtekio al. 11, LT-10223 Vilnius, Lithuania
References (66)
Show source-provided references
1. Seker, E., and Ozbenli, H.H. (2018). The Concept of Cyber Defence Exercises (CDX): Planning, Execution, Evaluation. Proceedings of the 2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security), Glasgow, UK, 11–12 June 2018, IEEE.10.1109/CyberSecPODS.2018.8560673 ↗
2. Corradini, I., and Nardelli, E. (2020). Advances in Human Factors in Cybersecurity. Proceedings of the AHFE 2020 Virtual Conference on Human Factors in Cybersecurity, Virtual, 16–20 July 2020, Springer. Advances in Intelligent Systems and Computing, USA.10.1007/978-3-030-52581-1 ↗
3. Ayyad, W.R., Al-Haija, Q.A., and Al-Masri, H.M.K. (2024). Chapter 11 of the title. Human factors in cybersecurity. Smart and Agile Cybersecurity for IoT and IIoT Environments, IGI Global.10.4018/979-8-3693-3451-5 ↗
4. Ask, T.F., Lugo, R.G., Knox, B.J., and Sütterlin, S. (2021, January 24–29). Human-Human Communication in Cyber Threat Situations: A Systematic Review. Proceedings of the HCI International 2021—Late Breaking Papers: Cognition, Inclusion, Learning, and Culture: 23rd HCI International Conference, HCII, Virtual Event.10.1007/978-3-030-90328-2_2 ↗
5. From Military Training to Cognitive Readiness: The Role of Military Leader
6. Čiurlienė, K. (2025). Holistic view on decision-making in Cyber Defense Exercises: A case study based in Amber Mist. Proceedings of the 2025 IEEE Open Conference of Electrical, Electronic and Information Sciences (eStream), Vilnius, Lithuania, 24 April 2025, IEEE.10.1109/eStream66938.2025.11016868 ↗
7. Deline, S., Guillet, L., Rauffet, P., ClémentNobles, C., and Robinson, N. (2024). The Missing Engineering Discipline in Cybersecurity: Human Factors Engineering. Proceedings of the Human Factors and Ergonomics Society, Lübeck, Germany, SAGE Publications.
8. Deline, S., Guillet, L., Rauffet, P., and Guerin, C. (2021). Team Cognition in a Cyber Defence Context: Focus on Social Support Behaviours, Springer.
9. Takehara, I., Kami, Y., Kamei, H., Kida, K., and Saisho, K. (2024). Development of Score Measurement and Attack Functions in a Security Exercise System Enable Trial-and-Error. Proceedings of the 16th IIAI International Congress on Advanced Applied Informatics (IIAI-AAI), Takamatsu, Japan, 6–12 July 2024, IEEE.10.1109/IIAI-AAI63651.2024.00048 ↗
10. Babayeva, G., Maennel, K., and Maennel, O.M. (2022, January 6–10). Building an Ontology for Cyber Defence Exercises. Proceedings of the 2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Genoa, Italy.10.1109/EuroSPW55150.2022.00050 ↗
11. Noureddine, M., Keefe, K., Sanders, W.H., and Bashir, M. (2015, January 21–22). Quantitative security metrics with human in the loop. Proceedings of the HotSoS ’15: Symposium and Bootcamp on the Science of Security, Urbana, IL, USA.
12. Mäses, S., Maennel, K., and Brilingaitė, A. (2022). Trends and challenges for balanced scoring in cybersecurity exercises: A case study on the example of Locked Shields. Front. Educ., 7.10.3389/feduc.2022.958405 ↗
13. Measuring team effectiveness in cyber-defense exercises: A cross-disciplinary case study10.1007/s10111-015-0350-2 ↗
14. Kunz, T., Fisher, C., Novara-Gsell, J.L., Nguyen, C., and Li, L. (2022). A Multiagent Cyber Battle Sim for RL Cyber Operation Agents. Proceedings of the 2022 International Conference on Computational Science and Computational Intelligence (CSCI), Las Vegas, NV, USA, 14–16 December 2022, IEEE.10.1109/CSCI58124.2022.00161 ↗
15. Smeets, M. (2022). The Role of Military Cyber Exercises: A Case Study of Locked Shields. Proceedings of the 14th International Conference on Cyber Conflict: Keep Moving! CyCon, Tallinn, Estonia, 31 May–3 June 2022, IEEE.10.23919/CyCon55549.2022.9811018 ↗
16. Human-Centric Approach to Cyber Threat Identification: The Role of Cognition, Experience, and Education in Decision-Making10.4018/JCIT.368220 ↗
17. Realistic and balanced automated threat emulation10.1016/j.cose.2025.104351 ↗
18. A review of individual operational cognitive readiness: Theory development and future directions10.1177/0018720819868409 ↗
19. Recovery of Cognitive Performance Following Multi-Stressor Military Training10.1177/00187208221086686 ↗
20. Physiological Factors Which Influence Cognitive Performance in Military Personnel10.1177/0018720819841757 ↗
21. Human factors in cybersecurity: Training and awareness for analysts10.51594/csitrj.v6i4.1913 ↗
22. Naturalistic decision making10.1518/001872008X288385 ↗
23. Pfaller, T., Skopik, F., Smith, P., and Leitner, M. (2024, January 5–6). Towards Customized Cyber Exercises using a Process-based Lifecycle Model. Proceedings of the EICC ’24 2024 European Interdisciplinary Cybersecurity Conference, Xanthi, Greece.10.1145/3655693.3655713 ↗
24. Human Factors in AI-Driven Cybersecurity: Cognitive Biases and Trust Issues
25. Deciding about fast and slow decisions10.1097/ACM.0000000000000121 ↗
26. Tobey, D.H. (2015). A Vignette-based Method for Improving Cybersecurity Talent Management through Cyber Defense Competition Design. Proceedings of the 2015 ACM SIGMIS Conference on Computers and People Research (SIGMIS-CPR ’15), Newport Beach, CA, USA, 4–6 June 2015, Association for Computing Machinery.10.1145/2751957.2751963 ↗
27. Furtună, A., Patriciu, V.-V., and Bica, I. (2010). A structured approach for implementing cyber security exercises. Proceedings of the 2010 8th International Conference on Communications, Bucharest, Romania, 10–12 June 2010, IEEE.10.1109/ICCOMM.2010.5509123 ↗
28. Perception of Cognitive Biases in Decision-Making Scale (PCBDM-S): Development and initial validation of a self-report measure for assessing cognitive bias perception10.1007/s12144-025-08053-x ↗
29. Klein, G.A. (1993). Decision Making in Action: Models and Methods (Cognition and Literacy), Ablex Publishing. [1st ed.].
30. Emotion and decision making10.1146/annurev-psych-010213-115043 ↗
31. Fuzzy sets10.1016/S0019-9958(65)90241-X ↗
32. People as Intuitive Scientists: Reconsidering Statistical Explanations of Decision Making10.1016/j.tics.2020.09.005 ↗
33. Intuition and analysis in decision making and choice
34. Taking stock of naturalistic decision making10.1002/bdm.381 ↗
35. Hussain, A., Kuhn, K., and Shaikh, S.A. (2020, January 19–24). Games for Cybersecurity Decision-Making. In HCI in Games: Second International Conference, HCI-Games 2020. Proceedings of the 22nd HCI International Conference, HCII 2020, Copenhagen, Denmark.10.1007/978-3-030-50164-8_30 ↗
36. Mäses, S., Maennel, K., Toussaint, M., and Rosa, V. (2021). Success Factors for Designing a Cybersecurity Exercise on the Example of Incident Response. Proceedings of the 2021 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Vienna, Austria, IEEE.10.1109/EuroSPW54576.2021.00033 ↗
37. Piplai, A., Anoruo, M., Fasaye, K., Joshi, A., Finin, T., and Ridley, A. (2022). Knowledge Guided Two-player Reinforcement Learning for Cyber Attacks and Defenses. Proceedings of the 21st IEEE International Conference on Machine Learning and Applications, ICMLA 2022, Nassau, Bahamas, 12–14 December 2022, IEEE.10.1109/ICMLA55696.2022.00213 ↗
38. Takehara, I., Ishizuka, M., Kamei, H., Kida, K., and Saisho, K. (2023). Evaluation of Processing Time in Trial-and-Error Function of Security Exercise System for Security Beginners. Proceedings of the Congress in Computer Science, Computer Engineering, & Applied Computing (CSCE), Las Vegas, NV, USA, 24–27 July 2023, IEEE.10.1109/CSCE60160.2023.00147 ↗
39. A framework for competence development and assessment in hybrid cybersecurity exercises10.1016/j.cose.2019.101607 ↗
40. The nature of feelings: Evolutionary and neurobiological origins10.1038/nrn3403 ↗
41. Kahneman, D. (2011). Thinking, Fast and Slow, PFarrar, Staus and Giroux. [1st ed.].
42. Design thinking, fast and slow: A framework for Kahneman’s dual-system theory in design10.1017/dsj.2019.9 ↗
43. Fuzzy Logic in Decision Support: Methods, Applications and Future Trends10.15837/ijccc.2021.1.4044 ↗
44. Comparison between the effects of different types of membership functions on fuzzy logic controller performance
45. ANFIS: Adaptive-network-based fuzzy inference system10.1109/21.256541 ↗
46. Fuzzy identification of systems and its applications to modeling and control10.1109/TSMC.1985.6313399 ↗
47. Slavyanov, K., and Dimov, R. (2024, January 27–28). Application of fuzzy logic in cybersecurity decision making and analysis after a cyber incident detection. Environment. Technologies. Resources. Proceedings of the International Scientific and Practical Conference 2024, Veliko Tarnovo, Bulgaria.10.17770/etr2024vol2.8022 ↗
48. The Impact of Human Factors on Software Development Processes Applying the Agile and Waterfall Methodologies: A Case Study Using Real Data
49. Rahman, S., Ahmed, M.R., and Kaiser, M.S. (2016). ANFIS based cyber physical attack detection system. 2016 5th International Conference on Informatics, Electronics and Vision (ICIEV), Dhaka, Bangladesh, 13–14 May 2016, IEEE.10.1109/ICIEV.2016.7760139 ↗
50. SMOTE: Synthetic Minority Over-sampling Technique10.1613/jair.953 ↗
51. Chawla, N., Lazarevic, A., Hall, L.O., and Bowyer, K. (2003). SMOTEBoost: Improving Prediction of the Minority Class in Boosting. Proceedings of the European Conference on Principles of Data Mining and Knowledge Discovery, Cavtat-Dubronik, Croatia, 22–26 September 2003, IEEE.10.1007/978-3-540-39804-2_12 ↗
52. Moniz, N., Ribeiro, R.P., Cerqueira, V., and Chawla, N. (2018). SMOTEBoost for Regression: Improving the Prediction of Extreme Values. Proceedings of the 2018 IEEE 5th International Conference on Data Science and Advanced Analytics (DSAA), Turin, Italy, 1–4 October 2018, Springer.10.1109/DSAA.2018.00025 ↗
53. He, H., Bai, Y., Garcia, E.A., and Li, S. (2008). ADASYN: Adaptive synthetic sampling approach for imbalanced learning. Proceedings of the 2008 IEEE International Joint Conference on Neural Networks (IEEE World Congress on Computational Intelligence), Hong Kong, China, 1–8 June 2008, IEEE.
54. Chen, Z., Zhou, L., and Yu, W. (2021, January 18–20). ADASYN−Random Forest Based Intrusion Detection Model. Proceedings of the 2021 4th International Conference on Signal Processing and Machine Learning, Beijing, China.10.1145/3483207.3483232 ↗
55. A novel approach for estimating multi-attribute Gaussian copula graphical models10.1016/j.spl.2025.110413 ↗
56. Modeling Tabular data using Conditional GAN
57. Generating Synthetic Dataset for ML-Based IDS Using CTGAN and Feature Selection to Protect Smart IoT Environments10.3390/app131910951 ↗
58. Ung, T.T., Nguyen, C.T., Le, T.D.D., Pham, T., and Bui, T.L. (2025). A Hybrid Balancing Method for IDS Datasets Using CTGAN + K-Means. Proceedinigs of the 2nd International Conference on Cryptography and Information Security (VCRIS), Hanoi, Vietnam, 30–31 October 2025, IEEE.10.1109/VCRIS68011.2025.11250555 ↗
59. Fuzzy Model Identification Based on Cluster Estimation
60. Ryoke, M., Nakamori, Y., and Suzuki, K. (1995). Adaptive fuzzy clustering and fuzzy prediction models. Proceedings of the IEEE International Conference on Fuzzy Systems, Yokohama, Japan, 20–24 March 1995, IEEE.10.1109/FUZZY.1995.409987 ↗
61. Evaluating protection motivation based cybersecurity awareness training on Kirkpatrick’s model10.1016/j.cose.2022.103049 ↗
62. A Team-Level Perspective of Human Factors in Cyber Security: Security Operations Centers10.1007/978-3-319-60585-2_21 ↗
63. Upadhyay, H., Sunori, S.K., Mittal, A., and Juneja, P. (2025). Cybersecurity risk prediction using fuzzy logic based models. Proceedings of the 8th International Conference on Trends in Electronics and Informatics (ICOEI), Tirunelveli, India, IEEE.10.1109/ICOEI65986.2025.11013181 ↗
64. An adaptive neuro-fuzzy inference system for multinomial malware classification10.46481/jnsps.2025.2172 ↗
65. Counterfactual thinking10.1037/0033-2909.121.1.133 ↗
66. The Functional Theory of Counterfactual Thinking10.1177/1088868308316091 ↗