Proactive insider threat detection through social media
Published 4 November 2013
Miltiadis Kandias, Vasilis Stavrou, Nick Bozovic, Dimitris Gritzalis
Citations55
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
A prediction method by evaluating the predisposition towards law enforcement and authorities, a personal psychosocial trait closely connected to the manifestation of malevolent insiders, is proposed and a methodology to detect users holding a negative attitude towards authorities is proposed.
Abstract
Insider threat is a major issue in cyber and corporate security. In this paper we study the psychosocial perspective of the insider via social media, Open Source Intelligence, and user generated content classification. Inductively, we propose a prediction method by evaluating the predisposition towards law enforcement and authorities, a personal psychosocial trait closely connected to the manifestation of malevolent insiders. We propose a methodology to detect users holding a negative attitude towards authorities. For doing so we facilitate the use of machine learning techniques and of a dictionary-based approach, so as to detect comments expressing negative attitude. Thus, we can draw conclusions over a user behavior and beliefs via the content the user generated within the limits a social medium. We also use an assumption free flat data representation technique in order to decide over the user's attitude. Furthermore, we compare the results of each method and highlight the common behavior manifested by the users. The demonstration is applied on a crawled community of users on YouTube.
Keywords
Computer Science
Cambridge University Press eBooksIntroduction to Information Retrieval
10,873 Citations2008Christopher D. Manning, Prabhakar Raghavan +1 more
This textbook teaches classical and web information retrieval, including web search and the related areas of text classification and text clustering from basic concepts, making it perfect for introductory courses in information retrieval for advanced undergraduates and graduate students in computer science.
ACM Computing SurveysMachine learning in automated text categorization
7,899 Citations2002Fabrizio Sebastiani
This survey discusses the main approaches to text categorization that fall within the machine learning paradigm and discusses in detail issues pertaining to three different problems, namely, document representation, classifier construction, and classifier evaluation.
Journal of Biomedical InformaticsLogistic regression and artificial neural network classification models: a methodology review
2,180 Citations2002Stephan Dreiseitl, Lucila Ohno‐Machado
This review summarizes the differences and similarities of logistic regression and artificial neural networks from a technical point of view, and compares them with other machine learning algorithms.
Social Learning and Deviant Behavior: A Specific Test of a General Theory
1,199 Citations1995Ronald L. Akers, Marvin D. Krohn +2 more
In the last decade the authors have seen a dramatic shift away from sociological explanations of deviant behavior toward developing theoretical perspectives on societal reactions to and definitions of deviance and crime, which has led to the neglect of theoretical developments in the etiology of devian behavior.
Computers in Human BehaviorSocial network use and personality
963 Citations2010Yair Amichai‐Hamburger, Gideon Vinitzky
In this study the self-reports of subjects, were replaced by more objective criteria, measurements of the user-information upload on Facebook, and a strong connection was found between personality and Facebook behavior.
Computers & SecurityThe insider threat to information systems and the effectiveness of ISO17799
242 Citations2005Marianthi Theoharidou, Spyros Kokolakis +2 more
This paper investigates the approach followed by ISO17799, the dominant standard in IS security management, and unfolds the criminology theory that has designated the measures against insider misuse suggested by the standard, i.e. the General Deterrence Theory.
Research Showcase @ Carnegie Mellon University (Carnegie Mellon University)Insider Threat Study: Illicit Cyber Activity in the Banking and Finance Sector
234 Citations2005Marisa Reddy Randazzo, Michelle Keeney +3 more
A unique study of insider incidents, the Insider Threat Study (ITS), examining actual cases identified through public reporting or as a computer fraud case investigated by the Secret Service, reports the findings and implications specific to research conducted on insider threat cases in the banking and finance sector.
Information Management & Computer SecurityA holistic model of computer abuse within organizations
184 Citations2002Jintae Lee, Younghwa Lee
A new model of computer abuse is proposed that extends the traditional model with the social criminology theories and explains the phenomenon through social lenses such as social bonds and social learning, focusing on computer abuse within organizations.
Computers & SecurityInsider Threat Prediction Tool: Evaluating the probability of IT misuse
148 Citations2001George Magklaras, Steven Furnell
The proposed solution estimates the level of threat that is likely to originate from a particular insider by introducing a threat evaluation system based on certain profiles of user behaviour and suggests a new and innovative approach of dealing with insiders that abuse IT systems.
Lecture notes in computer scienceAn Insider Threat Prediction Model
132 Citations2010Miltiadis Kandias, Alexios Mylonas +3 more
A novel, interdisciplinary insider threat prediction model is presented, which combines approaches, techniques, and tools from computer science and psychology, and identifies those that require additional monitoring, as they can potentially be dangerous for the information system and the organization.
Proactive Insider Threat Detection through Graph Learning and Psychological Context
116 Citations2012Oliver Brdiczka, Juan Liu +6 more
This paper proposes an approach that combines Structural Anomaly Detection from social and information networks and Psychological Profiling of individuals to detect structural anomalies in large-scale information network data, while PP constructs dynamic psychological profiles from behavioral patterns.
Lecture notes in computer scienceThe Insider Threat in Cloud Computing
109 Citations2013Miltiadis Kandias, Nikos Virvilis +1 more
This paper identifies the potential problems for each scenario of the insider threat in cloud computing, and proposes the appropriate countermeasures, in an effort to mitigate the problem.
Deviant BehaviorSelf-reported Deviant Computer Behavior: A Big-5, Moral Choice, and Manipulative Exploitive Behavior Analysis
108 Citations2006Marc Rogers, Natalie D. Smoak +1 more
As predicted, computer deviants scored lower on social moral choice and were more exploitive and manipulative than individuals not reporting deviant computer-related behavior.
Advances in information securityInsider Threats in Cyber Security
85 Citations2010Christian W. Probst, Jeffrey Hunker +2 more
Insider Threats in Cyber Security is a cutting edge text presenting IT and non-IT facets of insider threats together, and provides a unique multidisciplinary overview.
Identifying At-Risk Employees: Modeling Psychosocial Precursors of Potential Insider Threats
73 Citations2012Frank L. Greitzer, Lars J. Kangas +3 more
A psychosocial model developed to assess an employee's behavior associated with an increased risk of insider abuse would be part of a set of management tools for employee assessment to identify employees who pose a greater insider threat.
Computers & SecuritySmartphone sensor data as digital evidence
59 Citations2013Alexios Mylonas, Vasilis Meletiadis +2 more
The feasibility of ad-hoc data acquisition from smartphone sensors by implementing a device agent for their collection in Android, as well as a protocol for their transfer is examined.
International Journal of Risk Assessment and ManagementRisk assessment methodology for interdependent critical infrastructures
44 Citations2011Marianthi Theoharidou, Panayiotis Kotzanikolaou +1 more
A methodology for assessing the risk of an infrastructure or a sector, taking into account the presence of interdependencies between infrastructures and sectors is described.
Advances in information securityInsider Threat and Information Security Management
43 Citations2010Lizzie Coles-Kemp, Marianthi Theoharidou
The chapter examines the applicability of several crime theories and concludes that they can contribute in providing additional controls and redesign of information security management processes better suited to responding to the insider threat.
IFIP International Federation for Information Processing/IFIPSmartphone Forensics: A Proactive Investigation Scheme for Evidence Acquisition
40 Citations2012Alexios Mylonas, Vasilis Meletiadis +3 more
This paper examines potential evidence that may be collected from smartphones and the available connection channels for evidence transfer during a forensic investigation and proposes a Proactive Smartphone Investigation Scheme that focuses on ad hoc acquisition of smartphone evidence.
Lecture notes in computer scienceInsiders Trapped in the Mirror Reveal Themselves in Social Media
39 Citations2013Miltiadis Kandias, Konstantina Galbogini +2 more
This paper develops an insider threat prediction method by valuating a users’ personality trait of narcissism, which is deemed to be closely connected to the manifestation of malevolent insiders, and categorizes the users according to a proposed taxonomy.
Computers & SecurityA baseline security policy for distributed healthcare information systems
36 Citations1997Dimitris Gritzalis
The need for identifying and analyzing the generic security characteristics of a healthcare information system is demonstrated and the analysis of these characteristics is based upon a decision-support roadmap, leading to the development of a baseline security policy for healthcare institutions.
Information Management & Computer SecurityTowards an insider threat prediction specification language
32 Citations2006George Magklaras, Steven Furnell +1 more
The process of constructing a language tailored to describing insider threat incidents, for the purposes of mitigating threats originating from legitimate users in an IT infrastructure is presented.
Which Side Are You On? - A New Panopticon vs. Privacy
32 Citations2013Miltiadis Kandias, Lilian Mitrou +2 more
An extensive graph theoretical and content analysis of the collected dataset is performed and it is shown how and what kind of personal data can be derived via data mining on publicly available YouTube data and how to effectively be prevented from such a threat.
Medical InformaticsEnhancing security and improving interoperability in healthcare information systems
28 Citations1998Dimitris Gritzalis
The identification of gaps and inconsistencies in current standardization, the description of the conflicts of standards with legislation, and the analysis of implications of these standards to user organizations, are the main results of this paper.
Information Management & Computer SecurityEmbedding privacy in IT applications development
27 Citations2004Dimitris Gritzalis
Privacy Protector comprises of a set of software services that have been built upon generic, privacy‐focused user requirements and an API that can be used for incorporating Privacy Protector in the development framework of an IT application.
Computers & SecurityA SIP-oriented SPIT Management Framework
23 Citations2008Dimitris Gritzalis, Yannis Mallios
A generic SPIT management framework is proposed, which combines the strengths of existing solutions, while alleviating their insufficiencies, and proposes the use of an attack-oriented methodology for thwarting the SPIT threat.
Exploitation of auctions for outsourcing security-critical projects
12 Citations2011Miltiadis Kandias, Alexios Mylonas +2 more
This model provokes competition and motivates providers to place superior bids, in terms of security, while providing flexibility to the organization, through an auctioning scheme similar to the FCC spectrum ones.