評論
打印
Science and Technology
科技
Computer security
計算機安全
Blame game
推脫責任
How to mimic human laxness with computers
如何用計算機模擬人類錯誤
TO ERR is human, but to foul things up completely takes a computer, or so the old saw goes.
犯錯是人類的天性，不過某些錯誤要完全歸咎于電腦，也種說法也說不過去。
Although this may seem a little unfair to computers, a group of cybersecurity experts led by Jim Blythe of the University of Southern California are counting on there being at least some truth in the saying.
由南加州大學的Jim Blythe領導的一個網絡安全專家團隊正在研究這種說法的背后是否真的存在著一些事實——雖然說這對于電腦有點不公平。
They have created a system for testing computer-security networks by making computers themselves simulate the sorts of human error that leave networks vulnerable.
他們設計了一個系統用來測試計算機的安全網絡，在這個系統中 ，計算機將會模擬人類的各種錯誤行動，正是這些導致了網絡的脆弱。
Mistakes by users are estimated to be responsible for as many as 60% of breaches of computer security.
與破壞計算機安全有關的事件中，由用戶自己制造的錯誤估計占到60%。
Repeated warnings about being vigilant, for example, often go unheeded as people fail to recognise the dangers of seemingly innocuous actions such as downloading files.
例如，對于危險頻繁的警告經常被人們忽略——當人們下載文件時這種看似無害的行為讓人很難意識到其中的危險。
On top of that, some "mistakes" are actually the result of deliberation.
除此之外，一些"錯誤"甚至是深思熟慮的結果。
Users—both regular staff and members of the information-technology (IT) department, who should know better—often disable security features on their computers, because those features slow things down or make the computer more complicated to use.
正規的工作人員和信息技術部門的職員他們應該對此有更好的了解——他們通常會關閉電腦上的安全功能，因為這些功能會讓系統變慢或者許讓電腦使用起來更加復雜。
Yet according to Dr Blythe, such human factors are often overlooked when security systems are tested.
不過按照Blythe博士的說法，當安全系統進行測試時，這樣的人為的因素往往忽略掉。
This is partly because it would be impractical to manipulate the behaviour of users in ways that would give meaningful results.
因為這種行為會產生的是有意義的結果，在某種程度上來講，模擬這種用戶的行為是不切實際的。
He and his colleagues have therefore created a way of testing security systems with computer programs called cognitive agents.
他和他的同事因此就設計了一種測試安全系統的方法，這種方法包含一種被稱之這"認知行為者"的計算機程序。
These agents' motives and behaviours can be fine-tuned to mess things up with the same aplomb as a real employee.
這些行為者的動機和行為與真實的雇員一樣有著相應的沉著，它們可以進行精確地調節來搞砸某些事情。
The difference is that what happened can be analysed precisely afterwards.
有所不同的就是事后可以精確地分析這些行為者所發生的行為。
Each agent represents a run-of-the-mill user, a manager or a member of the IT staff.
每個行為者都代表一個普通的用戶，一個經理或者說是一個信息部門的員工。
It is given its own set of beliefs, desires and intentions, along with a job to do and a deadline by which that job must be done.
每個行為者有自己的一套信仰，要求和意圖，他們有工作并且必須在限定的時間內完成該工作。
All operations connected with the job are mediated through a standard Microsoft Windows interface that is hooked up to the security system.
所有與工作有關的操作都將通過一個標準的微軟"視窗"界面進行協調，并且該界面與安全系統相連。
Agents can also be given group tasks, which in turn may be influenced by their own group dynamics.
同時，可以給行為者們分配集體任務，這些行為者的整體動態反過來又可以影響它們自己。
Put simply, the agents can have friends, shared interests and power relations, and can trust some agents more than others, all of which will affect how quickly they perform the job at hand.
簡而言之，這些行為者可以擁有朋友，共享利益與權力關系，還可以更加信任其他的一些行為者，所有的這些行為都將會影響他們完成手頭工作的進度。
Another factor that can influence an agent's behaviour is its physiology.
另外一個可以影響到行為者行為的因素就是它們的生理狀態了。
Agents can get tired and become hungry, just like people. According to Dr Blythe, "we have focused mainly on fatigue, the physical need to take breaks at regular intervals, or the need to go to the bathroom."
行為者們就像人一樣，會疲倦，會饑餓。據Blythe說，"我們已經集中于研究它們的疲勞了，行為者的身體需要定期的休息，或者需要去洗手間。"
And agents may also skive off, choosing to switch to a spot of web browsing on a synthetic internet that the researchers have created for the purpose.
另外，行為者們也可能會偷懶，會切換到網頁去瀏覽一些網上的同步內容——這些內容研究人員故意設計出來的。
The team plans a full-scale test later this year, but preliminary results, which Dr Blythe will present to the Association for the Advancement of Artificial Intelligence's 25th annual conference in San Francisco on August 9th, look promising.
該小組計劃于今年晚些時候進行全面的測試，不過初步的結果看起來很有希望，該結果將由Blythe博士在人工智能發展學會[1]第25次年會上發布——會議將于8月9日在舊金山舉行。
For example, as users fall foul of so-called phishing attacks—giving away sensitive details such as passwords while browsing the internet, or allowing code that corrupts work files to be downloaded—the ability of IT staff to cope with the consequences diminishes as they become increasingly overwhelmed and tired.
例如，用戶們遇到的所謂的釣魚式攻擊——在瀏覽網頁的時候會泄露密碼等敏感信息，或者那些導致毀壞文件的代碼被下載下來——信息技術的工作人們處理這些問題的能力會隨著他們增加的重擔和持續的疲倦而下降。
The next stage after applying emotional and physiological pressure to the agents is to apply financial pressure—by constraining, for example, an agent's income compared with the amount of money it needs to earn in order to meet its outgoings.
在考察了情緒和生理的壓力后，下個階段將會對行為者引入財務的壓力因素的考察——例如，與滿足一個行為者開支所需的收入相比，通過限制它的收入來實現關于這種因素的考察。
Doing this may tempt some agents to double deal.
這樣做的話，會使得一些行為者變得口是心非。
In time, then, Dr Blythe's agents may serve to vindicate another familiar saying about computers: that behind every error blamed on computers there are at least two human errors, including the error of blaming it on the computer.
不久以后，Blythe博士的行為者或許就會證明另外一種關于電腦熟悉的說法：每個人該指責的電腦背后至少有兩個人為的錯誤，其中包括指責計算機錯誤的這個錯誤。
