Mining user interaction patterns in the darkweb to predict enterprise cyber incidents
| Autor: | Mohammad Almukaynizi, Soumajyoti Sarkar, Jana Shakarian, Paulo Shakarian |
|---|---|
| Rok vydání: | 2019 |
| Předmět: |
FOS: Computer and information sciences
Computer Science - Cryptography and Security Computer science 02 engineering and technology Controlled studies Computer security computer.software_genre Task (project management) 020204 information systems 0202 electrical engineering electronic engineering information engineering Media Technology Social media Social and Information Networks (cs.SI) Structure (mathematical logic) Communication Supervised learning Computer Science - Social and Information Networks Computer Science Applications Human-Computer Interaction Metadata Binary classification 020201 artificial intelligence & image processing Cryptography and Security (cs.CR) computer Information Systems PATH (variable) |
| Zdroj: | Social Network Analysis and Mining. 9 |
| ISSN: | 1869-5469 1869-5450 |
| Popis: | With rise in security breaches over the past few years, there has been an increasing need to mine insights from social media platforms to raise alerts of possible attacks in an attempt to defend conflict during competition. In this study, we attempt to build a framework that utilizes unconventional signals from the darkweb forums by leveraging the reply network structure of user interactions with the goal of predicting enterprise related external cyber attacks. We use both unsupervised and supervised learning models that address the challenges that come with the lack of enterprise attack metadata for ground truth validation as well as insufficient data for training the models. We validate our models on a binary classification problem that attempts to predict cyber attacks on a daily basis for an organization. Using several controlled studies on features leveraging the network structure, we measure the extent to which the indicators from the darkweb forums can be successfully used to predict attacks. We use information from 53 forums in the darkweb over a span of 17 months for the task. Our framework to predict real world organization cyber attacks of 3 different security events, suggest that focusing on the reply path structure between groups of users based on random walk transitions and community structures has an advantage in terms of better performance solely relying on forum or user posting statistics prior to attacks. arXiv admin note: text overlap with arXiv:1811.06537 |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|
Full text from SpringerLink