Computer System Anomaly Detection Using Human Responses to Ambient Representations of Hidden Computing System and Process Metadata

A method comprising the steps of:

• measuring one or more hidden states internal to a computing system related only to a user's active task with the computing system;
• using one or more deterministic mapping functions to directly map, without interpretation of the hidden states as being benign or malicious, the measurements to a representational output;
• presenting the representational output in real-time and peripheral to the user's active task with the computing system, wherein the presented representational output does not label information pertaining to the hidden states;
• determining the user's behavioral responses and physiological responses to the presented representational output;
• and
• altering one or more display characteristics of the presented representational output based upon one or more behavioral responses and physiological responses.

A method comprising the steps of:

• for more than one computing systems each having a separate user, measuring one or more hidden states internal to each computing system related only to a particular user's active task with the particular computing system;
• using one or more deterministic mapping functions to directly map, without interpretation of the hidden states as being benign or malicious, the measurements to a representational output;
• presenting the representational output in real-time and peripheral to the particular user's active task with the particular computing system, wherein the presented representational output does not label information pertaining to the hidden states;
• determining the particular user's response to the presented representational output;
• and
• for each computing system, inputting the particular user's response into a machine learning algorithm configured to detect an anomaly within the more than one computing systems using the all of the particular users' responses.