Detection of hacking behaviors and communication patterns on social media

Babko-Malaya, Olga; Cathey, Rebecca; Hinton, Steve; Maimon, David; Gladkova, Taissa

doi:10.1109/bigdata.2017.8258508

Cited by 12 publications

(4 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the physical world, Patton et al (2014) show that gang members use social media platforms to sell drugs, post videos of violence and threats, display firearms and money, and taunt rival gangs’ members. Hackers who engage in website defacement also use social media platforms to brag about their successful exploits (Maimon, Fukuda, et al, 2017), discuss motivations and techniques (Aslan et al, 2020), and recruit hackers to join hacking teams (Babko-Malaya et al, 2017). Hackers’ use of social media platforms such as Facebook and Twitter are associated with increased website defacement frequency (Aslan et al, 2020; Maimon, Fukuda, et al, 2017); thus, we hypothesize that self-promotion through social media engagement will be predictive for the most prolific hackers.…”

Section: Literature Reviewmentioning

confidence: 99%

Website Defacer Classification: A Finite Mixture Model Approach

Burruss

Howell

Maimon

et al. 2021

Social Science Computer Review

Self Cite

View full text Add to dashboard Cite

Hackers often engage in website defacement early in their criminal careers to establish a reputation. Some hackers become increasingly prolific and launch a large number of attacks against their targets, whereas others only launch a few attacks before eventually desisting from a life of crime. A better understanding of why some hackers launch a large number of attacks, while others do not, will assist in the implementation of targeted intervention strategies. Therefore, the current study, using a sample of 119 active hackers, seeks to answer two research questions: (1) Are there different groups of website defacers based on attack volume? (2) Which observed hacker-level characteristics can be used to predict latent class membership? We find that two unique groups of website defacers exist: low-volume defacers (69%) and high-volume defacers (31%). Social media presence, the content of the defacement, and the type of defacement are all predictive of latent class membership. Policy implications are discussed.

show abstract

Section: Literature Reviewmentioning

confidence: 99%

Website Defacer Classification: A Finite Mixture Model Approach

Burruss

Howell

Maimon

et al. 2021

Social Science Computer Review

Self Cite

View full text Add to dashboard Cite

show abstract

“…(Ramakrishnan and et al 2014) have shown the viability of using early indicators to forecast future civil unrest incidents. Built upon these premises, several other works (Tabassum et al 2016;Sliva and et al 2017;Maimon et al 2017;Babko-Malaya et al 2017;Almukaynizi et al 2017;Sapienza et al 2017;Okutan et al 2017b;Okutan et al 2017a) have shown promising uses of unconventional signals, that is, indirect observables from open source media instead of direct observables of the actual cyberattacks, to forecast cyber incidents. Recognizing the challenges of using unconventional signals as early indicators of future cyberattacks, this paper suggests a set of novel approaches to treat incomplete, insignificant and imbalanced data in the cyber security domain.…”

Section: Collect 258 Externally Measurable Featuresmentioning

confidence: 99%

“…These are potential 'unconventional' signals that may collectively present sufficient predictive power to forecast cyberattacks. Some recent works (Okutan et al 2017b;Maimon et al 2017;Babko-Malaya et al 2017;Sapienza et al 2017;Okutan et al 2018) provide preliminary analysis for the relevance of unconventional signals to forecast cyberattacks. However, extracting these signals from continuously growing big data in a meaningful way requires special treatment (L'Heureux et al 2017;Al-Jarrah et al 2015).…”

Section: Introductionmentioning

confidence: 99%

Forecasting cyberattacks with incomplete, imbalanced, and insignificant data

et al. 2018

View full text Add to dashboard Cite

Having the ability to forecast cyberattacks before they happen will unquestionably change the landscape of cyber warfare and cyber crime. This work predicts specific types of attacks on a potential victim network before the actual malicious actions take place. The challenge to forecasting cyberattacks is to extract relevant and reliable signals to treat sporadic and seemingly random acts of adversaries. This paper builds on multi-faceted machine learning solutions and develops an integrated system to transform large volumes of public data to aggregate signals with imputation that are relevant and predictive of cyber incidents. A comprehensive analysis of the individual parts and the integrated whole demonstrates the effectiveness and trade-offs of the proposed approach. Using 16-months of reported cyber incidents by an anonymized victim organization, the integrated approach achieves up to 87%, 90%, and 96% AUC for forecasting endpoint-malware, malicious-destination, and malicious-email attacks, respectively. When assessed month-by-month, the proposed approach shows robustness to perform consistently well, achieving F-Measure between 0.6 and 1.0. The framework also enables an examination of which unconventional signals are meaningful for cyberattack forecasting.

show abstract

“…The identification of characteristics of cyber-attacks is devoted to work [4,5,6]. The denial of service (DoS) cyber-attacks [7], the study of worms and botnet activity [8], the analysis of data on the number of cyber-attacks collected in a black hole [9] and in one-way motion [10] are investigated in the scientific literature. Studies [11,12] are devoted to classifying data into classes.…”

Section: Introductionmentioning

confidence: 99%

Setting the Optimum Time for a Special Audit to Improve the Enterprise's Cyber Security

Oleg,

Yevhen

2020

IJEAT

View full text Add to dashboard Cite

The article presents a method for setting the optimal time for special audit to improve the level of cyber defense of an enterprise working in the field of market relations of IT services. Studying the issue of providing measures to reduce the risk of a cyber-incident, analyzed the time series of the intensity of cyber-attacks of the enterprise. An analytical function of the cyber-attack intensity at an enterprise that satisfies the nonlinear Bernoulli differential equation is considered. The elasticity interval of the analytic function of the cyber-attack intensity at the enterprise is found. Analysis of cyber-attack time series on the enterprise system for the same time periods falling within the time interval from the end of the planned audit to the beginning of the next one. An analytical alignment of the time series of the cyber-attack intensity function was performed using a logistic curve. A stepwise p-transformation of a small parameter into a cyber-attack intensity function for an enterprise was introduced and the dimensionlessness of the variables was performed, which made it possible to calculate the sensitivity of a dimensionless cyber-attack intensity function from a small parameter p over a set time period. The study is based on the application of the theory of elasticity of the intensity function of cyber-attacks, which determines the time interval at which to conduct a special audit at the enterprise. Due to the found elasticity interval of the cyber-attack intensity function, the optimal time for special audit was determined.

show abstract

Detection of hacking behaviors and communication patterns on social media

Cited by 12 publications

References 18 publications

Website Defacer Classification: A Finite Mixture Model Approach

Website Defacer Classification: A Finite Mixture Model Approach

Forecasting cyberattacks with incomplete, imbalanced, and insignificant data

Setting the Optimum Time for a Special Audit to Improve the Enterprise's Cyber Security

Contact Info

Product

Resources

About