AI in Cyberpsychology: A systematic literature review of Cybersecurity enhancement by using AI for analyzing psychology of Victims, Attackers, and Defenders
Source: arXiv:2607.13123 · Published 2026-07-14 · By Georg Thamer Francis, Malek Malkawi, Sevim Eyüpoğlu, Reda Alhajj, Selim Akyokuş
TL;DR
This systematic literature review (SLR) addresses the emerging interdisciplinary field combining Artificial Intelligence (AI) and Cyberpsychology (CPSY) to enhance cybersecurity. By analyzing 34 peer-reviewed research studies published between 2010 and 2025, the authors present a comprehensive taxonomy that categorizes applications into four main cybersecurity areas: Anomaly Detection (AD), Vulnerability Risk Prediction (VRP), Security Awareness Training (SAT), and Authentication/Identity Verification (AIV). Within these, various AI techniques including Machine Learning (ML), Deep Learning (DL), Natural Language Processing (NLP), and Reinforcement Learning (RL) are explored in conjunction with psychological frameworks and theories such as Big Five (OCEAN) and Cialdini’s six principles of persuasion (C6PoP). The review quantifies dataset usage, implementation status, and identifies research gaps and challenges in AI-driven psychological analysis of victims, attackers, and defenders in cybersecurity contexts.
The study reveals that the majority of research focuses on Anomaly Detection and employs ML and NLP techniques, while integration of psychological constructs remains varied. The review highlights shortcomings such as limited real-world deployment (only 3 of 29 implemented systems), sparse use of deep learning and reinforcement learning, and often incomplete incorporation of analytical psychology. Despite methodological heterogeneity, the work surfaces dominant psychological concepts and AI approaches, proposing future research directions to bridge gaps including better dataset availability, explainability, and intersectional models capturing human cognitive and emotional factors.
Key findings
- Out of 34 reviewed studies, 15 focused solely on Anomaly Detection, with ML used in 15 studies, NLP in 8, hybrid AI in 6, DL in 2, and RL in 3 studies.
- The Big Five personality traits (OCEAN) framework was the most frequently applied psychological concept, used in 10 instances (7 hybrid, 3 independent) across studies.
- Only 9 out of 34 studies fully implemented their AI-psychology cybersecurity systems, and just 3 systems were deployed in real-world operational environments.
- Datasets: 23 of the 34 datasets were custom-made, 10 benchmark datasets were reused, and 1 dataset was novel, showing a fragmented data landscape.
- Random Forest (RF) classifiers achieved anomaly detection accuracies as high as 98.67% on some datasets integrating psychological features.
- Some studies, such as via K-means clustering on 1 million+ records, classified attacker types by personality profiles achieving 88% accuracy.
- Few studies incorporated reinforcement learning or deep learning, indicating under-explored AI methodologies in AI-CPSY.
- Major research gaps identified include lack of standardized psychological taxonomies, limited explainability in deep models, absence of real-time adaptive systems, and few works addressing insider threats with psychological modeling.
Threat model
The adversarial model varies by cybersecurity application but generally considers attackers aiming to exploit human cognitive vulnerabilities (e.g., social engineering), insiders with malicious intent, or automated cyberattacks. Adversaries can manipulate, deceive, or imitate victim behavior to bypass defenses but lack full knowledge of defenders’ internal psychological models. Defenders use AI-augmented psychological profiling and behavior analytics to detect anomalies and risk. The model assumes adversaries cannot perfectly mimic genuine human traits or bypass all AI detection systems, but evolving tactics and unknown behaviors remain challenges.
Methodology — deep read
The review followed the PRISMA framework to ensure rigorous study selection and transparent reporting. Initially, 981 documents were identified from multiple academic databases through a comprehensive search string combining cybersecurity, AI, and cyberpsychology keywords. After removing duplicates (92) and applying inclusion/exclusion criteria focusing on peer-reviewed papers published from 2010-2025 that analytically incorporated both AI methods and psychological theories, 34 research studies were retained for detailed analysis.
The inclusion required clear analytical use of psychology (e.g., frameworks like OCEAN, C6PoP) along with AI-driven cybersecurity solutions. Exclusions removed papers lacking AI or psychological rigor, theoretical pieces without implementations, or works outside cybersecurity domains.
Data extraction focused on categorizing each study by cybersecurity application (AD, VRP, SAT, AIV), AI methodology (ML, DL, NLP, RL), psychological concepts employed, dataset provenance and size, implementation status (theoretical, partial, full, deployed), and reported results.
Methodologically, the surveyed studies employed a broad range of AI algorithms: 9 distinct ML algorithms (e.g., Random Forest, SVM, K-means clustering), 13 NLP models (e.g., BERT, word2vec), 5 deep learning architectures (CNNs, LSTMs), and 2 reinforcement learning algorithms (e.g., Q-learning). Psychological approaches included established frameworks (Big Five/OCEAN, Theory of Planned Behavior), cyberpsychology-specific models (Scam Fall Prediction, Insider Threat Recognition), and persuasion theories (C6PoP).
Dataset origins were categorized into cybersecurity datasets, cybersecurity-psychology hybrid datasets, and psychology-only datasets. Most datasets (23/34) were bespoke to individual studies, limiting cross-comparisons. Benchmark datasets included behavioral biometric datasets like Balabit for mouse dynamics and social media message corpora.
Evaluation protocols varied by study but generally included performance metrics like classification accuracy, F1-score, precision, recall, equal error rate (EER), and in anomaly detection tasks, true positive and false positive rates. Several studies reported cross-validation results; ablation tests were less common. Some works assessed model explainability or deployed human-in-the-loop evaluation but this was sparse.
Implementation status varied widely—only a minority fully realized working systems; few had real-world deployment. Critically, few studies showed end-to-end pipelines integrating psychological measurement, AI modeling, and cybersecurity action. This shows the field remains in an exploratory phase.
One representative example detailed a study applying Random Forest on combined keystroke dynamics, emotional text scoring, and risk profiling data (from synthetic datasets generated by ChatGPT) to detect insider threats achieving 98.67% accuracy, demonstrating the potential but also limitations in realistic data provenance.
Reproducibility was limited due to datasets mostly custom and code availability not consistently provided; no standardized benchmarks or frozen models exist in the domain at present.
Technical innovations
- Comprehensive taxonomy categorizing AI-CPSY research by cybersecurity application, AI method, and psychological framework, filling a literature gap compared to prior fragmented surveys.
- Integration of classical psychological theories (e.g., Big Five, C6PoP) with AI techniques (ML, NLP, DL, RL) to classify attacker/victim behavior patterns in cybersecurity contexts.
- Application of hybrid AI models combining multiple AI techniques with psychological features for enhanced anomaly detection and vulnerability risk prediction.
- Use of large-scale self-reported personality data combined with clustering algorithms to differentiate hacker types (white, black, grey hats) based on psychological profiles at scale.
Datasets
- Custom datasets — 23 unique datasets created for individual studies, size varies.
- Balabit dataset — size unspecified, public behavioral biometrics dataset used for mouse dynamics authentication.
- BankSim dataset — standard banking transactions dataset used in security anomaly detection studies.
- German Credit dataset — financial dataset used for user behavior anomaly detection classification.
- Bot-IoT dataset — IoT traffic and botnet attack simulation data used in intention recognition studies.
- CSE-Persistence corpus — 16,900 sentence pairs for chat-based social engineering persistence detection.
Baselines vs proposed
- Naive Bayes for malicious URL detection: accuracy 76.87%, compared to proposed AI-blockchain hybrid framework with better detection (exact number not specified).
- Random Forest classifier for insider threat anomaly detection: accuracy up to 98.67% on synthetic keystroke/emotion dataset.
- K-means clustering for hacker personality classification: 88% accuracy mapping clusters to white/black/grey hats.
- SVM for intention recognition: 92.87% accuracy; DL methods like BERT variants reach precision of 94.8% in detecting attack intents.
- Hybrid Feature Selection (TF-IDF + ML) for social media scam fall prediction: no direct accuracy comparison reported.
- CSE-PersistenceBERT fine-tuned model: validation accuracy of 78.03% outperforming base BERT (76.79%) and word2vec baseline (73.83%).
Figures from the paper
Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.13123.
Fig 1 (page 1).
Fig 2 (page 1).
Fig 1: Pie charts of the CPSY application distribution and AI techniques distribution
Fig 2: Percentages of implementation status and distribution of different research in our included research studies
Fig 3: Distribution of the datasets types used in our included research studies
Fig 4: PRISMA flow diagram of our systematic literature review
Fig 5: The taxonomy of cyberpsychology application with AI
Limitations
- Majority of datasets used are custom and small-scale, limiting generalizability and reproducibility across AI-CPSY research.
- Few studies achieve real-world deployment; only 3 of 29 implemented systems were deployed, indicating practical maturity is low.
- Psychological constructs incorporated vary widely; many studies use surface-level psychological features rather than deep analytical models.
- Sparse use of deep learning and reinforcement learning techniques despite their promise in complex behavioral modeling.
- Limited explainability and interpretability evaluation of AI models hampers forensic and judicial acceptance, especially in legal contexts.
- Most studies do not address adversarial or distribution-shift robustness, e.g., evolving attacker behaviors or unseen user traits.
- Social desirability bias and self-reporting in personality data introduces noise and potential inaccuracies.
- Insufficient integration of dynamic human factors like mood, stress, or temporal behavior changes over long periods.
Open questions / follow-ons
- How to establish standardized psychological taxonomies and protocols for integrating psychology with AI in cybersecurity to enable benchmarking and comparison across studies?
- What methods can improve explainability and interpretability of AI models integrating complex psychological features for legal and operational transparency?
- How to develop scalable, real-time AI-CPSY systems deployed in operational environments to dynamically adapt to evolving attack vectors and user behaviors?
- What role can emerging AI techniques such as reinforcement learning and multimodal deep learning play for next-generation cyberpsychology-enhanced cybersecurity?
Why it matters for bot defense
This review is highly relevant for bot-defense and CAPTCHA engineers seeking to understand how AI can leverage psychological insights to enhance detection and mitigation of automated and human-assisted attacks. Integrating behavioral biometrics, user intent recognition, and psychological trait modeling can inform more adaptive and robust challenge-response systems. For example, understanding attacker persistence patterns or victim susceptibility profiles can improve anti-bot interaction design. However, the findings also caution that psychological data and AI models need to be rigorously validated and explainable to avoid false positives impacting user experience. Deploying hybrid AI-CPSY approaches provides opportunities for proactive detection beyond traditional static CAPTCHAs, potentially integrating anomaly detection and risk prediction to tailor challenge difficulty dynamically. Practitioners should note the current fragmentation around datasets, the limited real-world system implementations, and the need for further research on adversarial resistance and model transparency. Overall, the paper guides CAPTCHA designers to consider multi-disciplinary approaches involving psychology and AI rather than purely technical measures.
Cite
@article{arxiv2607_13123,
title={ AI in Cyberpsychology: A systematic literature review of Cybersecurity enhancement by using AI for analyzing psychology of Victims, Attackers, and Defenders },
author={ Georg Thamer Francis and Malek Malkawi and Sevim Eyüpoğlu and Reda Alhajj and Selim Akyokuş },
journal={arXiv preprint arXiv:2607.13123},
year={ 2026 },
url={https://arxiv.org/abs/2607.13123}
}