Suchergebnisse

Objective: Incident correlation is a vital step in the cybersecurity threat detection process. This article presents research on the effect of group-level information-pooling bias on collaborative incident correlation analysis in a synthetic task environment. Background: Past research has shown that uneven information distribution biases people to share information that is known to most team members and prevents them from sharing any unique information available with them. The effect of such biases on security team collaborations are largely unknown. Method: Thirty 3-person teams performed two threat detection missions involving information sharing and correlating security incidents. Incidents were predistributed to each person in the team based on the hidden profile paradigm. Participant teams, randomly assigned to three experimental groups, used different collaboration aids during Mission 2. Results: Communication analysis revealed that participant teams were 3 times more likely to discuss security incidents commonly known to the majority. Unaided team collaboration was inefficient in finding associations between security incidents uniquely available to each member of the team. Visualizations that augment perceptual processing and recognition memory were found to mitigate the bias. Conclusion: The data suggest that (a) security analyst teams, when conducting collaborative correlation analysis, could be inefficient in pooling unique information from their peers; (b) employing off-the-shelf collaboration tools in cybersecurity defense environments is inadequate; and (c) collaborative security visualization tools developed considering the human cognitive limitations of security analysts is necessary. Application: Potential applications of this research include development of team training procedures and collaboration tool development for security analysts.

Objective: We highlight some of the key discoveries and developments in the area of team performance over the past 50 years, especially as reflected in the pages of Human Factors.Background: Teams increasingly have become a way of life in many organizations, and research has kept up with the pace. Method: We have characterized progress in the field in terms of eight discoveries and five challenges. Results: Discoveries pertain to the importance of shared cognition, the measurement of shared cognition, advances in team training, the use of synthetic task environments for research, factors influencing team effectiveness, models of team effectiveness, a multidisciplinary perspective, and training and technological interventions designed to improve team effectiveness. Challenges that are faced in the coming decades include an increased emphasis on team cognition; reconfigurable, adaptive teams; multicultural influences; and the need for naturalistic study and better measurement. Conclusion: Work in human factors has contributed significantly to the science and practice of teams, teamwork, and team performance. Future work must keep pace with the increasing use of teams in organizations. Application: The science of teams contributes to team effectiveness in the same way that the science of individual performance contributes to individual effectiveness.

Objective: We report an experiment in which three training approaches are compared with the goal of training adaptive teams. Background: Cross-training is an established method in which team members are trained with the goal of building shared knowledge. Perturbation training is a new method in which team interactions are constrained to provide new coordination experiences during task acquisition. These two approaches, and a more traditional procedural approach, are compared. Method: Assigned to three training conditions were 26 teams. Teams flew nine simulated uninhabited air vehicle missions; three were critical tests of the team's ability to adapt to novel situations. Team performance, response time to novel events, and shared knowledge were measured. Results: Perturbation-trained teams significantly outperformed teams in the other conditions in two out of three critical test missions. Cross-training resulted in significant increases in shared teamwork knowledge and highest mean performance in one critical test. Procedural training led to the least adaptive teams. Conclusion: Perturbation training allows teams to match coordination variability during training to demands for coordination variability during posttraining performance. Although cross-training has adaptive benefits, it is suggested that process-oriented approaches, such as perturbation training, can lead to more adaptive teams. Application: Perturbation training is amenable to simulation-based training, where perturbations provide interaction experiences that teams can transfer to novel, real-world situations.

Retention of skilled search after a nine-year period of nonuse was investigated in letter and digit tasks. The letter task involved search for one of six consistently mapped letter targets in a set of two, three, or four letters. The digit task required subjects to indicate the largest digit in a display of two, three, or four digits (one through nine). In the digit task the digits 4, 5, 6, 7, and 8 could serve as targets or distractors, depending on the other items in the display. Results indicated only minimal loss of speed and no loss in visual search rates after the nine-year interval. In addition, the savings were equivalent for the two tasks in spite of the difference in stimulus-response consistency.

Objective Three different team configurations are compared with the goal of better understanding human-autonomy teaming (HAT). Background Although an extensive literature on human-automation interaction exists, much less is known about HAT in which humans and autonomous agents interact as coordinated units. Further research must be conducted to better understand how all-human teams compare to HAT. Methods In an unmanned aerial system (UAS) context, a comparison was made among three types of three-member teams: (1) synthetic teams in which the pilot role is assigned to a synthetic teammate, (2) control teams in which the pilot was an inexperienced human, and (3) experimenter teams in which an experimenter served as an experienced pilot. Ten of each type of team participated. Measures of team performance, target processing efficiency, team situation awareness, and team verbal behaviors were analyzed. Results Synthetic teams performed as well at the mission level as control (all human) teams but processed targets less efficiently. Experimenter teams performed better across all other measures compared to control and synthetic teams. Conclusion Though there is potential for a synthetic agent to function as a full-fledged teammate, further advances in autonomy are needed to improve team-level dynamics in HAT teams. Application This research contributes to our understanding of how to make autonomy a good team player.

Objective: Recurrence-based measures of communication determinism and pattern information are described and validated using previously collected team interaction data. Background: Team coordination dynamics has revealed that "mixing" team membership can lead to flexible interaction processes, but keeping a team "intact" can lead to rigid interaction processes. We hypothesized that communication of intact teams would have greater determinism and higher pattern information compared to that of mixed teams. Method: Determinism and pattern information were measured from three-person Uninhabited Air Vehicle team communication sequences over a series of 40-minute missions. Because team members communicated using push-to-talk buttons, communication sequences were automatically generated during each mission. Results: The Composition × Mission determinism effect was significant. Intact teams' determinism increased over missions, whereas mixed teams' determinism did not change. Intact teams had significantly higher maximum pattern information than mixed teams. Conclusion: Results from these new communication analysis methods converge with content-based methods and support our hypotheses. Application: Because they are not content based, and because they are automatic and fast, these new methods may be amenable to real-time communication pattern analysis.

Multioperator tasks often require complex cognitive processing at the team level. Many team cognitive processes, such as situation assessment and coordination, are thought to rely on team knowledge. Team knowledge is multifaceted and comprises relatively generic knowledge in the form of team mental models and more specific team situation models. In this methodological review paper, we review recent efforts to measure team knowledge in the context of mapping specific methods onto features of targeted team knowledge. Team knowledge features include type, homogeneity versus heterogeneity, and rate of knowledge change. Measurement features include knowledge elicitation method, team metric, and aggregation method. When available, we highlight analytical conclusions or empirical data that support a connection between team knowledge and measurement method. In addition, we present empirical results concerning the relation between team knowledge and performance for each measurement method and identify research and methodological needs. Addressing issues surrounding the measurement of team knowledge is a prerequisite to understanding team cognition and its relation to team performance and to designing training programs or devices to facilitate team cognition.