If walls could talk

Devineni, Pravallika; Koutra, Danai; Faloutsos, Michalis; Faloutsos, Christos

doi:10.1145/2808797.2808880

Cited by 24 publications

(2 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…[11] used moving windows of size 7 days to detect deviations in user behavior in a large mobile phone network. Admittedly, some of our own previous works have used intervals of fixed lengths to analyze temporal data [2]. The amount of structure one requires in a network depends on what one intends to do with that network.…”

Section: The Temporal Asymmetry Hypothesismentioning

confidence: 99%

See 1 more Smart Citation

One Size Does Not Fit All

Devineni

Papalexakis

Koutra

et al. 2017

Proceedings of the 2017 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining 2017

Self Cite

View full text Add to dashboard Cite

Given the set of social interactions of a user, how can we detect changes in interaction patterns over time? While most previous work has focused on studying network-wide properties and spotting outlier users, the dynamics of individual user interactions remain largely unexplored. This work sets out to explore those dynamics in a way that is minimally invasive to privacy, thus, avoids to rely on the textual content of user posts-except for validation. Our contributions are two-fold. First, in contrast to previous studies, we challenge the use of a fixed interval of observation. We introduce and empirically validate the "Temporal Asymmetry Hypothesis", which states that appropriate observation intervals should vary both among users and over time for the same user. We validate this hypothesis using eight different datasets, including email, messaging, and social networks data. Second, we propose iNET, a comprehensive analytic and visualization framework which provides personalized insights into user behavior and operates in a streaming fashion. iNET learns personalized baseline behaviors of users and uses them to identify events that signify changes in user behavior. We evaluate the effectiveness of iNET by analyzing more than half a million interactions from Facebook users. Labeling of the identified changes in user behavior showed that iNET is able to capture a wide spectrum of exogenous and endogenous events, while the baselines are less diverse in nature and capture only 66% of that spectrum. Furthermore, iNET exhibited the highest precision (95%) compared to all competing approaches.

show abstract

Section: The Temporal Asymmetry Hypothesismentioning

confidence: 99%

“…User behavior modeling in social networks mostly focuses on the network-wide properties of the group behavior within a fixed time interval and aims at spotting users who are outliers [1], [2]. Some studies have focused on identifying networkwide or other static properties of users, such as graph patterns in the friendship graph [3], [4].…”

Section: Introductionmentioning

confidence: 99%

One Size Does Not Fit All

Devineni

Papalexakis

Koutra

et al. 2017

Proceedings of the 2017 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining 2017

Self Cite

View full text Add to dashboard Cite

show abstract

Mining Actionable Information from Security Forums: The Case of Malicious IP Addresses

Gharibshah

Castro

et al. 2019

Lecture Notes in Social Networks

Self Cite

View full text Add to dashboard Cite

The goal of this work is to systematically extract information from hacker forums, whose information would be in general described as unstructured: the text of a post is not necessarily following any writing rules. By contrast, many security initiatives and commercial entities are harnessing the readily public information, but they seem to focus on structured sources of information. Here, we focus on the problem of identifying malicious IP addresses, among the IP addresses which are reported in the forums. We develop a method to automate the identification of malicious IP addresses with the design goal of being independent of external sources. A key novelty is that we use a matrix decomposition method to extract latent features of the behavioral information of the users, which we combine with textual information from the related posts. A key design feature of our technique is that it can be readily applied to different language forums, since it does not require a sophisticated Natural Language Processing approach. In particular, our solution only needs a small number of keywords in the new language plus the user's behavior captured by specific features. We also develop a tool to automate the data collection from security forums. Using our tool, we collect approximately 600K posts from 3 different forums. Our method exhibits high classification accuracy, while the precision of identifying malicious IP in post is greater than 88% in all three forums. We argue that our method can provide singificantly more information: we find up to 3 times more potentially malicious IP address compared to the reference blacklist VirusTotal. As the cyber-wars are becoming more intense, having early accesses to useful information becomes more imperative to remove the hackers first-move advantage, and our work is a solid step towards this direction.

show abstract