  To understand how end-users conceptualize consequences of cyber security
attacks, we performed a card sorting study, a well-known technique in Cognitive
Sciences, where participants were free to group the given consequences of
chosen cyber attacks into as many categories as they wished using rationales
they see fit. The results of the open card sorting study showed a large amount
of inter-participant variation making the research team wonder how the
consequences of security attacks were comprehended by the participants. As an
exploration of whether it is possible to explain user's mental model and
behavior through Artificial Intelligence (AI) techniques, the research team
compared the card sorting data with the outputs of a number of Natural Language
Processing (NLP) techniques with the goal of understanding how participants
perceived and interpreted the consequences of cyber attacks written in natural
languages. The results of the NLP-based exploration methods revealed an
interesting observation implying that participants had mostly employed checking
individual keywords in each sentence to group cyber attack consequences
together and less considered the semantics behind the description of
consequences of cyber attacks. The results reported in this paper are seemingly
useful and important for cyber attacks comprehension from user's perspectives.
To the best of our knowledge, this paper is the first introducing the use of AI
techniques in explaining and modeling users' behavior and their perceptions
about a context. The novel idea introduced here is about explaining users using
AI.
