Proactive insider threat detection through social media

Kandias, Miltiadis; Stavrou, Vasilis; Bozovic, Nick; Gritzalis, Dimitris

doi:10.1145/2517840.2517865

Cited by 39 publications

(23 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Researchers have also attempted to monitor and profile unauthorised users [16], [17] or witting insiders performing unauthorised actions [18]. However, semantic social engineering attacks target authorised users and lure them into performing an authorised (albeit compromising) action.…”

Section: Predicting Susceptibility a Related Workmentioning

confidence: 99%

You Are Probably Not the Weakest Link: Towards Practical Prediction of Susceptibility to Semantic Social Engineering Attacks

2016

View full text Add to dashboard Cite

Semantic social engineering attacks are a pervasive threat to computer and communication systems. By employing deception rather than by exploiting technical vulnerabilities, spear-phishing, obfuscated URLs, drive-by downloads, spoofed websites, scareware, and other attacks are able to circumvent traditional technical security controls and target the user directly. Our aim is to explore the feasibility of predicting user susceptibility to deception-based attacks through attributes that can be measured, preferably in real-time and in an automated manner. Toward this goal, we have conducted two experiments, the first on 4333 users recruited on the Internet, allowing us to identify useful high-level features through association rule mining, and the second on a smaller group of 315 users, allowing us to study these features in more detail. In both experiments, participants were presented with attack and non-attack exhibits and were tested in terms of their ability to distinguish between the two. Using the data collected, we have determined practical predictors of users' susceptibility against semantic attacks to produce and evaluate a logistic regression and a random forest prediction model, with the accuracy rates of .68 and .71, respectively. We have observed that security training makes a noticeable difference in a user's ability to detect deception attempts, with one of the most important features being the time since last self-study, while formal security education through lectures appears to be much less useful as a predictor. Other important features were computer literacy, familiarity, and frequency of access to a specific platform. Depending on an organisation's preferences, the models learned can be configured to minimise false positives or false negatives or maximise accuracy, based on a probability threshold. For both models, a threshold choice of 0.55 would keep both false positives and false negatives below 0.2.INDEX TERMS Security, cyber crime, social engineering, semantic attacks. 6910 2169-3536

show abstract

Section: Predicting Susceptibility a Related Workmentioning

confidence: 99%

You Are Probably Not the Weakest Link: Towards Practical Prediction of Susceptibility to Semantic Social Engineering Attacks

2016

View full text Add to dashboard Cite

show abstract

“…In a study [17], authors proposed a prediction method to identify the users having the negative or positive behavior towards the law enforcement authority. The research study used machine learning and dictionarybased techniques to identify the negative attitude towards law authority.…”

Section: Related Workmentioning

confidence: 99%

Development of Aggression Detection Technique in Social Media

Zaib¹,

Asif²,

Arooj³

2019

IJITCS

View full text Add to dashboard Cite

Due to the enormous growth of social media the potential of social media mining has increased exponentially. Individual users are producing data at unprecedented rate by sharing and interacting through social media. This user generated data provides opportunities to explore what people think and express on social media. Users exhibit different behaviors on social media towards individuals, a group, a topic or an activity. In this paper, we present a social media mining approach to perform behavior analytics. In this research study, we performed a descriptive analysis of user generated data such as users' status, comments and replies to identify individual users or groups which can be a potential threat. Tokenization technique is used to estimate the polarity of the behavior of different users by considering their comments or feedbacks against different posts on Facebook. The proposed approach can help to identify possible threats reflected by the user's behavior towards a specific event. To evaluate the approach, a data set was developed containing comments on the Facebook from different users in different groups. The dataset was divided into different groups such as political, religious and sports. Most negative users' in different groups were identified successfully. In our research, we focused only on English content; however, it can be evaluated with other languages.

show abstract

“…Understanding complex human behaviors in enterprise environments supports the identification of patterns of activity in computer usage data related to behaviors associated with insider threat actions, such as quitting ( [10], [5]). Characterizing behavior demonstrated by users in online social communities such as deception ( [3]) and negative predisposition toward law enforcement ( [13]) can be relevant to the insider threat domain. Machine learning techniques, such as outlier detection [2] and unsupervised anomaly detection [7], have likewise shown utility for identifying insider threat activiites in large, complex data sets ( [9], [24]).…”

Section: Introductionmentioning

confidence: 99%

Insider Threat Detection in PRODIGAL

Goldberg

Young

Reardon

et al. 2017

Proceedings of the 50th Hawaii International Conference on System Sciences (2017)

View full text Add to dashboard Cite

Abstract-This paper reports on insider threat detection research, during which a prototype system (PRODIGAL)1 was developed and operated as a testbed for exploring a range of detection and analysis methods. The data and test environment, system components, and the core method of unsupervised detection of insider threat leads are presented to document this work and benefit others working in the insider threat domain.We also discuss a core set of experiments evaluating the prototype's ability to detect both known and unknown malicious insider behaviors. The experimental results show the ability to detect a large variety of insider threat scenario instances imbedded in real data with no prior knowledge of what scenarios are present or when they occur.We report on an ensemble-based, unsupervised technique for detecting potential insider threat instances. When run over 16 months of real monitored computer usage activity augmented with independently developed and unknown but realistic, insider threat scenarios, this technique robustly achieves results within five percent of the best individual detectors identified after the fact. We discuss factors that contribute to the success of the ensemble method, such as the number and variety of unsupervised detectors and the use of prior knowledge encoded in detectors designed for specific activity patterns.Finally, the paper describes the architecture of the prototype system, the environment in which we conducted these experiments and that is in the process of being transitioned to operational users.

show abstract

Proactive insider threat detection through social media

Cited by 39 publications

References 23 publications

You Are Probably Not the Weakest Link: Towards Practical Prediction of Susceptibility to Semantic Social Engineering Attacks

You Are Probably Not the Weakest Link: Towards Practical Prediction of Susceptibility to Semantic Social Engineering Attacks

Development of Aggression Detection Technique in Social Media

Insider Threat Detection in PRODIGAL

Contact Info

Product

Resources

About