{"title":"Evaluating the reliability of users as human sensors of social media security threats","authors":"Ryan Heartfield, G. Loukas","doi":"10.1109/CyberSA.2016.7503282","DOIUrl":"https://doi.org/10.1109/CyberSA.2016.7503282","url":null,"abstract":"While the human as a sensor concept has been utilised extensively for the detection of threats to safety and security in physical space, especially in emergency response and crime reporting, the concept is largely unexplored in the area of cyber security. Here, we evaluate the potential of utilising users as human sensors for the detection of cyber threats, specifically on social media. For this, we have conducted an online test and accompanying questionnaire-based survey, which was taken by 4,457 users. The test included eight realistic social media scenarios (four attack and four non-attack) in the form of screenshots, which the participants were asked to categorise as “likely attack” or “likely not attack”. We present the overall performance of human sensors in our experiment for each exhibit, and also apply logistic regression to evaluate the feasibility of predicting that performance based on different characteristics of the participants. Such prediction would be useful where accuracy of human sensors in detecting and reporting social media security threats is important. We identify features that are good predictors of a human sensor's performance and evaluate them in both a theoretical ideal case and two more realistic cases, the latter corresponding to limited access to a user's characteristics.","PeriodicalId":179031,"journal":{"name":"2016 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (CyberSA)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-06-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129632133","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Cybersecurity: Effect of information availability in security games","authors":"Zahid Maqbool, V. Pammi, V. Dutt","doi":"10.1109/CyberSA.2016.7503290","DOIUrl":"https://doi.org/10.1109/CyberSA.2016.7503290","url":null,"abstract":"Cyber-attacks, i.e., disruption of normal functioning of computers and loss of information, are becoming widespread. Cyber security may be studied as a non-cooperative game as described by behavioral game theory. However, current game-theoretic approaches have based their conclusions on Nash equilibriums, while disregarding the role of information availability among hackers and analysts. In this study, we investigated how information availability affected behavior of analysts and hackers in 2×2 security games. In an experiment involving security games, interdependence information available to hackers and analysts was analyzed in two between-subjects conditions: “Info” and “No-Info”. In “Info” condition, both players had complete information about each other's actions and payoffs, while this information was missing in “No-Info” condition. Results showed that presence of information caused analysts and hackers to increase their proportion of defend and attack actions, respectively. We highlight the relevance of our results to cyber-attacks in the real world.","PeriodicalId":179031,"journal":{"name":"2016 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (CyberSA)","volume":"17 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-06-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130384453","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Radu S. Pirscoveanu, Matija Stevanovic, J. Pedersen
{"title":"Clustering analysis of malware behavior using Self Organizing Map","authors":"Radu S. Pirscoveanu, Matija Stevanovic, J. Pedersen","doi":"10.1109/CyberSA.2016.7503289","DOIUrl":"https://doi.org/10.1109/CyberSA.2016.7503289","url":null,"abstract":"For the time being, malware behavioral classification is performed by means of Anti-Virus (AV) generated labels. The paper investigates the inconsistencies associated with current practices by evaluating the identified differences between current vendors. In this paper we rely on Self Organizing Map, an unsupervised machine learning algorithm, for generating clusters that capture the similarities between malware behavior. A data set of approximately 270,000 samples was used to generate the behavioral profile of malicious types in order to compare the outcome of the proposed clustering approach with the labels collected from 57 Antivirus vendors using VirusTotal. Upon evaluating the results, the paper concludes on shortcomings of relying on AV vendors for labeling malware samples. In order to solve the problem, a cluster-based classification is proposed, which should provide more accurate results based on the clusters created by competitive and cooperative algorithms like Self Organizing Map that better describe the behavioral profile of malware.","PeriodicalId":179031,"journal":{"name":"2016 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (CyberSA)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-06-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126461862","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A multi-sensor system for enhancing situational awareness in offshore training","authors":"F. Sanfilippo","doi":"10.1109/CyberSA.2016.7503280","DOIUrl":"https://doi.org/10.1109/CyberSA.2016.7503280","url":null,"abstract":"Real offshore operational scenarios are particularly risky. Training programmes involving specifically designed simulators constitute a promising approach for improving human reliability and safety in real applications. One of the world's most advanced providers of simulators for such demanding offshore operations is the Offshore Simulator Centre AS (OSC). However, even though the OSC provides powerful simulation tools, techniques for visualising operational procedures that can be used to further improve situational awareness (SA), are still lacking. In this work, an integrated multi-sensor fusion system is integrated with the OSC. The proposed system is designed to improve planning, execution and assessment of demanding maritime operations by adopting newly-designed risk-evaluation tools. Different information from the simulator scene and from the real world can be collected, such as audio, video, bio-metric data from eye-trackers, other sensor data and annotations. This integration is the base for research on novel SA assessment methodologies. A training methodology based on the concept of briefing/debriefing is adopted. By using this methodology, the efficiency of the proposed system is validated in a conceptual case study that considers the training procedure performed by Statoil and partners for the world's first sub-sea gas compression plant, in Aasgard, Norway.","PeriodicalId":179031,"journal":{"name":"2016 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (CyberSA)","volume":"242 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-06-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116876366","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
X. Bellekens, Andrew W. Hamilton, Preetila Seeam, Kamila Nieradzinska, Quentin Franssen, A. Seeam
{"title":"Pervasive eHealth services a security and privacy risk awareness survey","authors":"X. Bellekens, Andrew W. Hamilton, Preetila Seeam, Kamila Nieradzinska, Quentin Franssen, A. Seeam","doi":"10.1109/CyberSA.2016.7503293","DOIUrl":"https://doi.org/10.1109/CyberSA.2016.7503293","url":null,"abstract":"The human factor is often recognised as a major aspect of cyber-security research. Risk and situational perception are identified as key factors in the decision making process, often playing a lead role in the adoption of security mechanisms. However, risk awareness and perception have been poorly investigated in the field of eHealth wearables. Whilst end-users often have limited understanding of privacy and security of wearables, assessing the perceived risks and consequences will help shape the usability of future security mechanisms. This paper present a survey of the the risks and situational awareness in eHealth services. An analysis of the lack of security and privacy measures in connected health devices is described with recommendations to circumvent critical situations.","PeriodicalId":179031,"journal":{"name":"2016 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (CyberSA)","volume":"63 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-06-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116227987","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Cyber crisis management, survival or extinction?","authors":"Yoram Golandsky","doi":"10.1109/CyberSA.2016.7503291","DOIUrl":"https://doi.org/10.1109/CyberSA.2016.7503291","url":null,"abstract":"`Cyber Incidents' are common in every domain where technology is prevalent. Recurring or sequential incidents are not unusual and are often manageable. Whilst more rare, the incidents that reach crisis levels have been shown to cause an unexpected amount of damage. Companies need to remain prepared for such cyber crises. This entails not only building an Incident Response Team (IRT) and creating and testing an incident response plan, but mainly establishing the capability to properly manage business crisis triggered by cyber-attacks. A well-planned and efficiently executed cyber crisis management plan can be the differentiator between cyber breach survival and extinction.","PeriodicalId":179031,"journal":{"name":"2016 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (CyberSA)","volume":"42 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-06-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126303686","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
S. Puuska, M. Kortelainen, Viljami Venekoski, J. Vankka
{"title":"Instant message classification in Finnish cyber security themed free-form discussion","authors":"S. Puuska, M. Kortelainen, Viljami Venekoski, J. Vankka","doi":"10.1109/CyberSA.2016.7503294","DOIUrl":"https://doi.org/10.1109/CyberSA.2016.7503294","url":null,"abstract":"Instant messaging enables rapid collaboration between professionals during cyber security incidents. However, monitoring discussion manually becomes challenging as the number of communication channels increases. Failure to identify relevant information from the free-form instant messages may lead to reduced situational awareness. In this paper, the problem was approached by developing a framework for classification of instant message topics of cyber security-themed discussion in Finnish. The program utilizes open source software components in morphological analysis, and subsequently converts the messages into Bag-of-Words representations before classifying them into predetermined incident categories. We compared support vector machines (SVM), multinomial naïve Bayes, and complement naïve Bayes (CNB) classification methods with five-fold cross-validation. A combination of SVM and CNB achieved classification accuracy of over 85 %, while multiclass SVM achieved 87 % accuracy. The implemented program recognizes cyber security-related messages in IRC chat rooms and categorizes them accordingly.","PeriodicalId":179031,"journal":{"name":"2016 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (CyberSA)","volume":"38 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-06-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127140995","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Developing Cyber Security Asset Management framework for UK rail","authors":"Shruti Kohli","doi":"10.1109/CyberSA.2016.7503296","DOIUrl":"https://doi.org/10.1109/CyberSA.2016.7503296","url":null,"abstract":"The sophistication and pervasiveness of cyber-attacks are constantly growing, driven partly by technological progress, profitable applications in organized crime and state-sponsored innovation. The modernization of rail control systems has resulted in an increasing reliance on digital technology and increased the potential for security breaches and cyber-attacks. This research paper showcases the need for developing the secure reusable scalable framework for enhancing cyber security of rail assets. A Cybersecurity framework has been proposed that is being developed to detect the tell-tale signs of cyber-attacks against industrial assets. This framework will be based on the concepts of developing protection profiles for railway assets such as point machine and evaluation assurance level in order to certify that chosen railway asset meet required security and safety properties. Endeavor is to make cyber health assessment of railway assets to prevent cyber-attacks.","PeriodicalId":179031,"journal":{"name":"2016 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (CyberSA)","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-06-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124008670","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Looking from the hacker's perspective: Role of deceptive strategies in cyber security","authors":"Palvi Aggarwal, Cleotilde González, V. Dutt","doi":"10.1109/CyberSA.2016.7503288","DOIUrl":"https://doi.org/10.1109/CyberSA.2016.7503288","url":null,"abstract":"Cyber-attacks are increasing in the real-world and they cause widespread damage to cyber-infrastructure and loss of information. Deception, i.e., the act of making someone believe something that is not true, could be a way of countering cyber-attacks. In this paper, we propose a deception game, which we used to evaluate the decision-making of a hacker in the presence of deception. In an experiment, using the deception game, we analyzed the effect of two between-subjects factors (N = 100 participants): Amount of deception (high and low) and the timing of deception (early and late). Results revealed that use of early deception made hackers trust the system's response and get deceived. However, the amount of deception did not influence hacker's trust on the system's response. In addition, use of a deceptive strategy, i.e., when hackers moved from deception rounds to non-deception rounds, caused hackers to get deceived and not attack the system.","PeriodicalId":179031,"journal":{"name":"2016 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (CyberSA)","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-06-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115744575","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Generating insight from data tailoring analytic algorithms and visualization to address user requirements","authors":"Paul D. Baxter, T. Wood","doi":"10.1109/CyberSA.2016.7503284","DOIUrl":"https://doi.org/10.1109/CyberSA.2016.7503284","url":null,"abstract":"There are many different tools available for web analytics for business intelligence and empowerment. To be useful for a user community, data analytics requires ascertaining the users' needs to drive a combination of appropriate analytical algorithms and effective visualization. Should any of these three be missing or tackled without regard for the others, data analysis will be carried out without enabling the users to move from data to action. Using the example of the Transport for London (TfL) open data set on tube journeys we provide two examples of the combination of algorithms, visualization and user requirements, one of which is described in detail here, while the other is described at a summary level.","PeriodicalId":179031,"journal":{"name":"2016 International Conference On Cyber Situational Awareness, Data Analytics And Assessment (CyberSA)","volume":"28 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-06-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125792403","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}