ARSCA: a computer tool for tracing the cognitive processes of cyber-attack analysis

Efficiency and interference shielding are critical factors for conducting successful cognitive task analysis (CTA) of cyber-attack analysis. To achieve this goal, a tool, named ARSCA, is developed to work with an analyst during a cyber-attack analysis task and to capture the main elements in his/her cognitive process. ARSCA conducts process tracing in a way that reduces the study time and the workload needed for analysts and does not distract the analysts from executing their tasks. ARSCA has been tested in an experiment with a simulated cyber-attack analysis task. Thirteen professional analysts and seventeen doctoral students specializing in cyber security are recruited. We evaluate the captured traces and the participants' feedbacks on working with ARSCA.