{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T20:56:03Z","timestamp":1777668963161,"version":"3.51.4"},"reference-count":43,"publisher":"SAGE Publications","issue":"7","license":[{"start":{"date-parts":[[2018,7,11]],"date-time":"2018-07-11T00:00:00Z","timestamp":1531267200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/journals.sagepub.com\/page\/policies\/text-and-data-mining-license"}],"funder":[{"DOI":"10.13039\/100009011","name":"Ontario Centres of Excellence","doi-asserted-by":"publisher","award":["23884"],"award-info":[{"award-number":["23884"]}],"id":[{"id":"10.13039\/100009011","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000038","name":"Natural Sciences and Engineering Research Council of Canada","doi-asserted-by":"publisher","award":["CRDPJ 500832-16"],"award-info":[{"award-number":["CRDPJ 500832-16"]}],"id":[{"id":"10.13039\/501100000038","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["journals.sagepub.com"],"crossmark-restriction":true},"short-container-title":["Hum Factors"],"published-print":{"date-parts":[[2018,11]]},"abstract":"<jats:sec>\n                    <jats:title>Objective:<\/jats:title>\n                    <jats:p>The authors seek to characterize the behavioral costs of attentional switches between points in a network map and assess the efficacy of interventions intended to reduce those costs.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Background:<\/jats:title>\n                    <jats:p>Cybersecurity network operators are tasked with determining an appropriate attentional allocation scheme given the state of the network, which requires repeated attentional switches. These attentional switches may result in temporal performance decrements, during which operators disengage from one attentional fixation point and engage with another.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Method:<\/jats:title>\n                    <jats:p>We ran two experiments where participants identified a chain of malicious emails within a network. All interactions with the system were logged and analyzed to determine if users experienced disengagement and engagement delays.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Results:<\/jats:title>\n                    <jats:p>Both experiments revealed significant costs from attentional switches before (i.e., disengagement) and after (i.e., engagement) participants navigated to a new area in the network. In our second experiment, we found that interventions aimed at contextualizing navigation actions lessened both disengagement and engagement delays.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Conclusion:<\/jats:title>\n                    <jats:p>Attentional switches are detrimental to operator performance. Their costs can be reduced by design features that contextualize navigations through an interface.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Application:<\/jats:title>\n                    <jats:p>This research can be applied to the identification and mitigation of attentional switching costs in a variety of visual search tasks. Furthermore, it demonstrates the efficacy of noninvasive behavioral monitoring for inferring cognitive events.<\/jats:p>\n                  <\/jats:sec>","DOI":"10.1177\/0018720818784107","type":"journal-article","created":{"date-parts":[[2018,7,11]],"date-time":"2018-07-11T15:29:42Z","timestamp":1531322982000},"page":"962-977","update-policy":"https:\/\/doi.org\/10.1177\/sage-journals-update-policy","source":"Crossref","is-referenced-by-count":8,"title":["Measuring and Mitigating the Costs of Attentional Switches in Active Network Monitoring for Cybersecurity"],"prefix":"10.1177","volume":"60","author":[{"given":"Sean W.","family":"Kortschot","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Dusan","family":"Sovilj","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Greg A.","family":"Jamieson","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Scott","family":"Sanner","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Chelsea","family":"Carrasco","sequence":"additional","affiliation":[{"name":"University of Toronto, Toronto, Ontario, Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Harold","family":"Soh","sequence":"additional","affiliation":[{"name":"National University of Singapore, Singapore"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"179","published-online":{"date-parts":[[2018,7,11]]},"reference":[{"key":"bibr1-0018720818784107","doi-asserted-by":"crossref","unstructured":"Aguinis H., Gottfredson R. K., Joo H. (2013). Best-practice recommendations for defining, identifying, and handling outliers. Organizational Research Methods, 16(2), 270\u2013301. http:\/\/doi.org\/10.1177\/1094428112470848","DOI":"10.1177\/1094428112470848"},{"key":"bibr2-0018720818784107","doi-asserted-by":"crossref","unstructured":"Ahmad A., Hadgkiss J., Ruighaver A. B. (2012). Incident response teams\u2014Challenges in supporting the organisational security function. Computers and Security, 31(5), 643\u2013652. http:\/\/doi.org\/10.1016\/j.cose.2012.04.001","DOI":"10.1016\/j.cose.2012.04.001"},{"key":"bibr3-0018720818784107","doi-asserted-by":"crossref","unstructured":"Alrajeh N. A., Khan S., Shams B. (2013). Intrusion detection systems in wireless sensor networks: A review. International Journal of Distributed Sensor Networks, 2013, 1\u20137. http:\/\/doi.org\/10.1109\/SURV.2013.050113.00191","DOI":"10.1155\/2013\/167575"},{"key":"bibr4-0018720818784107","doi-asserted-by":"crossref","unstructured":"Aoidh E. M., Bertolotto M., Wilson D. C. (2012). Towards dynamic behavior-based profiling for reducing spatial information overload in map browsing activity. Geoinformatica, 16, 409\u2013434. http:\/\/doi.org\/10.1007\/s10707-011-0137-4","DOI":"10.1007\/s10707-011-0137-4"},{"key":"bibr5-0018720818784107","doi-asserted-by":"crossref","unstructured":"Ashfaq A. B., Khayam S. A. (2011). Evaluation of contemporary anomaly detection systems (ADSs). In Zubairi J. A., Mahboob A. (Eds.), Cyber security standards, practices and industrial applications: Systems and methodologies (pp. 90\u2013112). Hershey, PA: Information Science Reference. http:\/\/doi.org\/10.4018\/978-1-60960-851-4.ch006","DOI":"10.4018\/978-1-60960-851-4.ch006"},{"key":"bibr6-0018720818784107","doi-asserted-by":"crossref","unstructured":"Balakrishnan G., Durand F., Guttag J. (2013). Detecting pulse from head motions in video. Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, 3430\u20133437. Retrieved from https:\/\/dl.acm.org\/citation.cfm?id=2516035","DOI":"10.1109\/CVPR.2013.440"},{"key":"bibr7-0018720818784107","doi-asserted-by":"crossref","unstructured":"Ben-Asher N., Gonzalez C. (2015). Effects of cyber security knowledge on attack detection. Computers in Human Behavior, 48, 51\u201361. http:\/\/doi.org\/10.1016\/j.chb.2015.01.039","DOI":"10.1016\/j.chb.2015.01.039"},{"key":"bibr8-0018720818784107","doi-asserted-by":"crossref","unstructured":"Bennett K. B., Flach J. M. (2012). Visual momentum redux. International Journal of Human Computer Studies, 70(6), 399\u2013414. http:\/\/doi.org\/10.1016\/j.ijhcs.2012.01.003","DOI":"10.1016\/j.ijhcs.2012.01.003"},{"key":"bibr9-0018720818784107","doi-asserted-by":"crossref","unstructured":"Borst J. P., Taatgen N. A., van Rijn H. (2010). The problem state: A cognitive bottleneck in multitasking. Journal of Experimental Psychology. Learning, Memory, and Cognition, 36(2), 363\u2013382. http:\/\/doi.org\/10.1037\/a0018106","DOI":"10.1037\/a0018106"},{"issue":"194","key":"bibr10-0018720818784107","first-page":"4","volume":"189","author":"Brooke J.","year":"1996","journal-title":"Usability Evaluation in Industry"},{"key":"bibr11-0018720818784107","first-page":"481","volume-title":"Advances in industrial ergonomics and safety","volume":"1","author":"Byers J. C.","year":"1989"},{"key":"bibr12-0018720818784107","doi-asserted-by":"crossref","unstructured":"Corchado E., Herrero \u00c1. (2011). Neural visualization of network traffic data for intrusion detection. Applied Soft Computing Journal, 11(2), 2042\u20132056. http:\/\/doi.org\/10.1016\/j.asoc.2010.07.002","DOI":"10.1016\/j.asoc.2010.07.002"},{"key":"bibr13-0018720818784107","doi-asserted-by":"crossref","unstructured":"D\u2019Amico A., Whitley K., Tesone D., O\u2019Brien B., Roth E. M. (2005). Achieving cyber defense situational awareness: A cognitive task analysis of information assurance analysts. Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 49, 229\u2013233. http:\/\/doi.org\/10.1177\/154193120504900304","DOI":"10.1177\/154193120504900304"},{"key":"bibr14-0018720818784107","doi-asserted-by":"crossref","unstructured":"Dombrowe I., Donk M., Olivers C. N. L. (2011). The costs of switching attentional sets. Attention, Perception, and Psychophysics, 73(8), 2481\u20132488. http:\/\/doi.org\/10.3758\/s13414-011-0198-3","DOI":"10.3758\/s13414-011-0198-3"},{"key":"bibr15-0018720818784107","doi-asserted-by":"publisher","DOI":"10.1518\/001872006779166415"},{"key":"bibr16-0018720818784107","doi-asserted-by":"crossref","unstructured":"Dorneich M. C., Mathan S., Ververs P. M., Whitlow S. D. (2007). An evaluation of real-time cognitive state classification in a harsh operational environment. Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 51, 146\u2013150. http:\/\/doi.org\/10.1177\/154193120705100401","DOI":"10.1177\/154193120705100401"},{"key":"bibr17-0018720818784107","doi-asserted-by":"crossref","unstructured":"Dorneich M. C., Whitlow S. D., Ververs P. M., Rogers W. H. (2003). Mitigating cognitive bottlenecks via an augmented cognition adaptive system. SMC\u201903 Conference Proceedings. 2003 IEEE International Conference on Systems, Man and Cybernetics. Conference Theme - System Security and Assurance (Cat. No.03CH37483), 1, 937\u2013944. http:\/\/doi.org\/10.1109\/ICSMC.2003.1243935","DOI":"10.1109\/ICSMC.2003.1243935"},{"key":"bibr18-0018720818784107","doi-asserted-by":"crossref","unstructured":"Duncan J. (1980). The locus of interference in the perception of simultaneous stimuli. Psychological Review, 87(3), 272\u2013300. http:\/\/doi.org\/10.1037\/0033-295X.87.3.272","DOI":"10.1037\/\/0033-295X.87.3.272"},{"key":"bibr19-0018720818784107","doi-asserted-by":"crossref","unstructured":"Ettwig J. F., Bronkhorst A. W. (2015). Attentional switches and dual-task interference. PLoS ONE, 10(3), e0118216. http:\/\/doi.org\/10.1371\/journal.pone.0118216","DOI":"10.1371\/journal.pone.0118216"},{"key":"bibr20-0018720818784107","doi-asserted-by":"crossref","unstructured":"Feigh K. M., Dorneich M. C., Hayes C. C. (2012). Toward a characterization of adaptive systems: A framework for researchers and system designers. Human Factors: The Journal of the Human Factors and Ergonomics Society, 54(6), 1008\u20131024. http:\/\/doi.org\/10.1177\/0018720812443983","DOI":"10.1177\/0018720812443983"},{"key":"bibr21-0018720818784107","doi-asserted-by":"crossref","unstructured":"Franke U., Brynielsson J. (2014). Cyber situational awareness\u2014A systematic review of the literature. Computers & Security, 46, 41. http:\/\/doi.org\/10.1016\/j.cose.2014.06.008","DOI":"10.1016\/j.cose.2014.06.008"},{"key":"bibr22-0018720818784107","doi-asserted-by":"crossref","unstructured":"Goodall J. R., Lutters W. G., Komlodi A. (2009). Developing expertise for network intrusion detection. Information Technology & People, 22(2), 92\u2013108. http:\/\/doi.org\/10.1108\/09593840910962186","DOI":"10.1108\/09593840910962186"},{"key":"bibr23-0018720818784107","doi-asserted-by":"publisher","DOI":"10.5120\/19550-1250"},{"key":"bibr24-0018720818784107","doi-asserted-by":"publisher","DOI":"10.1016\/S0166-4115(08)62386-9"},{"key":"bibr25-0018720818784107","doi-asserted-by":"crossref","unstructured":"Hopf J. M., Boehler C. N., Schoenfeld M. A., Heinze H. J., Tsotsos J. K. (2010). The spatial profile of the focus of attention in visual search: Insights from MEG recordings. Vision Research, 50(14), 1312\u20131320. http:\/\/doi.org\/10.1016\/j.visres.2010.01.015","DOI":"10.1016\/j.visres.2010.01.015"},{"key":"bibr26-0018720818784107","doi-asserted-by":"crossref","unstructured":"Janczyk M., Kunde W. (2010). Does dorsal processing require central capacity? More evidence from the PRP paradigm. Experimental Brain Research, 203(1), 89\u2013100. http:\/\/doi.org\/10.1007\/s00221-010-2211-9","DOI":"10.1007\/s00221-010-2211-9"},{"key":"bibr27-0018720818784107","doi-asserted-by":"crossref","unstructured":"Khan S., Gani A., Abdul Wahab A. W., Shiraz M., Khan I. A. (2016). Network forensics: Review, taxonomy, and open challenges. Journal of Network and Computer Applications, 66, 214\u2013235. http:\/\/doi.org\/10.1016\/j.jnca.2016.03.005","DOI":"10.1016\/j.jnca.2016.03.005"},{"key":"bibr28-0018720818784107","doi-asserted-by":"publisher","DOI":"10.1109\/SMC.2017.8122832"},{"key":"bibr29-0018720818784107","doi-asserted-by":"crossref","unstructured":"Li P., Salour M., Su X. (2008). A survey of internet worm detection and containment. IEEE Communications Surveys and Tutorials, 10(1), 20\u201335. http:\/\/doi.org\/10.1109\/COMST.2008.4483668","DOI":"10.1109\/COMST.2008.4483668"},{"key":"bibr30-0018720818784107","doi-asserted-by":"crossref","unstructured":"Longman C. S., Lavric A., Monsell S. (2017). Self-paced preparation for a task switch eliminates attentional inertia but not the performance switch cost. Journal of Experimental Psychology: Learning Memory and Cognition, 43(6), 862\u2013873. http:\/\/doi.org\/10.1037\/xlm0000347","DOI":"10.1037\/xlm0000347"},{"key":"bibr31-0018720818784107","doi-asserted-by":"crossref","unstructured":"Mitropoulos S., Patsos D., Douligeris C. (2006). On incident handling and response: A state-of-the-art approach. Computers and Security, 25(5), 351\u2013370. http:\/\/doi.org\/10.1016\/j.cose.2005.09.006","DOI":"10.1016\/j.cose.2005.09.006"},{"key":"bibr32-0018720818784107","doi-asserted-by":"crossref","unstructured":"Moar J. (2015). The future of cybercrime & security: Financial and corporate threats & mitigation. Retrieved from https:\/\/www.juniperresearch.com\/press\/press-releases\/cybercrime-cost-businesses-over-2trillion","DOI":"10.1016\/S1353-4858(15)30085-4"},{"key":"bibr33-0018720818784107","doi-asserted-by":"publisher","DOI":"10.1093\/oxfordhb\/9780199675111.001.0001"},{"key":"bibr34-0018720818784107","doi-asserted-by":"crossref","unstructured":"Olszewski D. (2014). Fraud detection using self-organizing map visualizing the user profiles. Knowledge-Based Systems, 70, 324\u2013334. http:\/\/doi.org\/10.1016\/j.knosys.2014.07.008","DOI":"10.1016\/j.knosys.2014.07.008"},{"key":"bibr35-0018720818784107","doi-asserted-by":"crossref","unstructured":"Palmius N., Tsanas A., Saunders K. E. A., Bilderbeck A. C., Geddes J. R., Goodwin G. M., De Vos M. (2016). Detecting bipolar depression from geographic location data. IEEE Transactions on Biomedical Engineering, 64(8), 1\u201312. http:\/\/doi.org\/10.1109\/TBME.2016.2611862","DOI":"10.1109\/TBME.2016.2611862"},{"key":"bibr36-0018720818784107","doi-asserted-by":"crossref","unstructured":"Pfleeger S. L., Caputo D. D. (2012). Leveraging behavioral science to mitigate cyber security risk. Computers & Security, 31, 597\u2013611. http:\/\/doi.org\/10.1016\/j.cose.2011.12.010","DOI":"10.1016\/j.cose.2011.12.010"},{"key":"bibr37-0018720818784107","doi-asserted-by":"crossref","unstructured":"Posner M. I., Presti D. E. (1987). Selective attention and cognitive control. Trends in Neurosciences, 10(1), 13\u201317. http:\/\/doi.org\/10.1016\/0166-2236(87)90116-0","DOI":"10.1016\/0166-2236(87)90116-0"},{"key":"bibr38-0018720818784107","doi-asserted-by":"crossref","unstructured":"Salvucci D. D., Taatgen N. A. (2008). Threaded cognition: An integrated theory of concurrent multitasking. Psychological Review, 115(1), 101\u2013130. http:\/\/doi.org\/10.1037\/0033-295X.115.1.101","DOI":"10.1037\/0033-295X.115.1.101"},{"key":"bibr39-0018720818784107","doi-asserted-by":"crossref","unstructured":"Sohn M. H., Anderson J. R. (2001). Task preparation and task repetition: Two-component model of task switching. Journal of Experimental Psychology: General, 130(4), 764\u2013778. http:\/\/doi.org\/10.1037\/0096-3445.130.4.764","DOI":"10.1037\/\/0096-3445.130.4.764"},{"key":"bibr40-0018720818784107","doi-asserted-by":"crossref","unstructured":"Tyworth M., Giacobe N. A., Mancuso V. (2012). Cyber situation awareness as distributed socio-cognitive work. Cyber Sensing 2012, 8408(Level 2), 1\u20139. http:\/\/doi.org\/10.1117\/12.919338","DOI":"10.1117\/12.919338"},{"key":"bibr41-0018720818784107","doi-asserted-by":"crossref","unstructured":"Verwey W. B., Shea C. H., Wright D. L. (2015). A cognitive framework for explaining serial processing and sequence execution strategies. Psychonomic Bulletin & Review, 22, 54\u201377. http:\/\/doi.org\/10.3758\/s13423-014-0773-4","DOI":"10.3758\/s13423-014-0773-4"},{"key":"bibr42-0018720818784107","doi-asserted-by":"crossref","unstructured":"Werlinger R., Muldner K., Hawkey K., Beznosov K. (2010). Preparation, detection, and analysis: The diagnostic work of IT security incident response. Information Management & Computer Security, 18(1), 26\u201342. http:\/\/doi.org\/10.1108\/09685221011035241","DOI":"10.1108\/09685221011035241"},{"key":"bibr43-0018720818784107","unstructured":"Woods D. D. (1984). Visual momentum: A concept to improve the cognitive coupling of person and computer. International Journal of Man-Machine Studies, 21, 229\u2013244. Retrieved from http:\/\/ac.els-cdn.com\/S0020737384800437\/1-s2.0-S0020737384800437-main.pdf?_tid=a6312d00-238a-11e7-9c20-00000aacb360&acdnat=1492446585_63d6b2c8437eedd810baaa400937658b"}],"container-title":["Human Factors: The Journal of the Human Factors and Ergonomics Society"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/0018720818784107","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/full-xml\/10.1177\/0018720818784107","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/0018720818784107","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T07:51:41Z","timestamp":1777449101000},"score":1,"resource":{"primary":{"URL":"https:\/\/journals.sagepub.com\/doi\/10.1177\/0018720818784107"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,7,11]]},"references-count":43,"journal-issue":{"issue":"7","published-print":{"date-parts":[[2018,11]]}},"alternative-id":["10.1177\/0018720818784107"],"URL":"https:\/\/doi.org\/10.1177\/0018720818784107","relation":{},"ISSN":["0018-7208","1547-8181"],"issn-type":[{"value":"0018-7208","type":"print"},{"value":"1547-8181","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,7,11]]}}}