{"title":"Verbal Deception Cue Training for the Detection of Phishing Emails","authors":"Jaewan Lim, Lina Zhou, Dongsong Zhang","doi":"10.1109/ISI53945.2021.9624738","DOIUrl":"https://doi.org/10.1109/ISI53945.2021.9624738","url":null,"abstract":"Training on cues to deception is one of the promising ways of addressing humans’ poor performance in deception detection. However, the effect of training may be subject to the context of deception and the design of training. This study aims to investigate the effect of verbal cue training on the performance of phishing email detection by comparing different designs of training and examining the effect of topic familiarity. Based on the results of a lab experiment, we not only confirm the effect of training but also provide suggestions on how to design training to better facilitate the detection of phishing emails. In addition, our results also discover the effect of topic familiarity on phishing detection. The findings of this study have significant implications for the mitigation and intervention of online deception.","PeriodicalId":347770,"journal":{"name":"2021 IEEE International Conference on Intelligence and Security Informatics (ISI)","volume":"51 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121447098","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Maria Valero, Lei Li, H. Shahriar, Shahriar Sobhan, M. Handlin, Jinghua Zhang
{"title":"Emotional Analysis of Learning Cybersecurity with Games","authors":"Maria Valero, Lei Li, H. Shahriar, Shahriar Sobhan, M. Handlin, Jinghua Zhang","doi":"10.1109/ISI53945.2021.9624680","DOIUrl":"https://doi.org/10.1109/ISI53945.2021.9624680","url":null,"abstract":"The constant rise of cyber-attacks poses an increasing demand for more qualified people with cybersecurity knowledge. Games have emerged as a well-fitted technology to engage users in learning processes. In this paper, we analyze the emotional parameters of people while learning cybersecurity through computer games. The data are gathered using a noninvasive Brain-Computer Interface (BCI) to study the signals directly from the users’ brains. We analyze six performance metrics (engagement, focus, excitement, stress, relaxation, and interest) of 12 users while playing computer games to measure the effectiveness of the games to attract the attention of the participants. Results show participants were more engaged with parts of the games that are more interactive instead of those that present text to read and type.","PeriodicalId":347770,"journal":{"name":"2021 IEEE International Conference on Intelligence and Security Informatics (ISI)","volume":"60 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114780066","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Cyber Security Threat Intelligence Monitoring and Classification","authors":"Bo Wang, Jiann-Liang Chen, Chiao-Lin Yu","doi":"10.1109/ISI53945.2021.9624746","DOIUrl":"https://doi.org/10.1109/ISI53945.2021.9624746","url":null,"abstract":"The remote control is widely used for its convenience and its support of resource sharing. However, it can be exploited by hackers. This work aims to prevent remote network threats using behavioral features and machine learning mechanisms. A threat intelligence monitoring engine called DEtect remote Shell Threat system (DEST) was designed and divided into three levels, depending on the hazard. The performance analysis results demonstrate that the proposed DEST system has an accuracy of 99.20% and an F1-score of 99.80%. It is superior to existing detection methods, offering 4% and 1% improvement in accuracy and F1-score.","PeriodicalId":347770,"journal":{"name":"2021 IEEE International Conference on Intelligence and Security Informatics (ISI)","volume":"10 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124278729","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Mining User’s Opinion Towards the Rising and Falling Trends of the Stock Market: A Hybrid Model","authors":"Haoda Qian, Liping Chen, Qi-fen Zha","doi":"10.1109/ISI53945.2021.9624687","DOIUrl":"https://doi.org/10.1109/ISI53945.2021.9624687","url":null,"abstract":"Mining users’ opinions towards the rising and falling trends of the stocks may help the management department estimate the risk and make timely decision. Existing methods ignore the effective fusion of domain information and pre-trained language models, hindering mining implicit semantic information. This paper proposes a hybrid method that adopts masked language modeling to obtain a domain-information-enhanced language model. Firstly, it generates an attention-mechanism-oriented masking based on words’ importance, word-level polarity and terminology. Then, the masked words and their corresponding knowledge are predicted to acquire domain-aware language representation. Experimental results on two public financial sentiment analysis datasets show the efficacy of the proposed model.","PeriodicalId":347770,"journal":{"name":"2021 IEEE International Conference on Intelligence and Security Informatics (ISI)","volume":"28 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114785861","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Zizhen Deng, Xiaolong Zheng, Zifan Ye, Zhen Cai, D. Zeng
{"title":"Credible Influence Analysis in Mass Media Using Causal Inference","authors":"Zizhen Deng, Xiaolong Zheng, Zifan Ye, Zhen Cai, D. Zeng","doi":"10.1109/ISI53945.2021.9624679","DOIUrl":"https://doi.org/10.1109/ISI53945.2021.9624679","url":null,"abstract":"The mass media has recorded major events around the world for a long time, which is very helpful in describing the dynamic changes in all aspects of human society, including the analysis of national influence using news data. Due to the publicity and significance of mass media, the results of influence analysis must be reliable. However, the current most influence analysis methods are mainly concentrated on social media networks and cannot simply be transferred to mass media. Due to the causality as the main driving factor of influence, we introduced the causal inference method convergent cross mapping, combined with the existing general influence analysis method, proposed a credible influence analysis method in mass media. This method can filter out non-causal influences, making the results more credible. We conducted experiments on the GDELT datasets, and the results proved the effectiveness and reliability of the proposed credible influence analysis in mass media.","PeriodicalId":347770,"journal":{"name":"2021 IEEE International Conference on Intelligence and Security Informatics (ISI)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131257654","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Analysis and detection of application-independent slow Denial of Service cyber attacks","authors":"M. Sikora, R. Fujdiak, J. Misurec","doi":"10.1109/ISI53945.2021.9624789","DOIUrl":"https://doi.org/10.1109/ISI53945.2021.9624789","url":null,"abstract":"This paper investigates current application-independent slow Denial of Service (DoS) attacks. We propose Slowcomm and Slow Next attack models and present an attack simulation tool. We used this tool for vulnerability testing of several Internet services, including Hypertext Transfer Protocol (HTTP), File Transfer Protocol (FTP), and Secure Shell (SSH) servers. We also propose attack signatures and detection methods. We implemented these methods as an Intrusion Detection System (IDS) and tested them in an experimental network. Our testing revealed vulnerabilities in five of the six tested servers that caused the denial of service to legitimate users. Deployment of the proposed attack detector has shown a high detection success. We conclude that there is a need to increase the level of cybersecurity. Internet services are vulnerable to these new DoS attacks. Our analysis can be used for the security development of tested services. Our detector in combination with a network traffic filtering tool can be used to mitigate the attacks and keep the service available to Internet users.","PeriodicalId":347770,"journal":{"name":"2021 IEEE International Conference on Intelligence and Security Informatics (ISI)","volume":"140 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131890452","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Tala Vahedi, Benjamin Ampel, S. Samtani, Hsinchun Chen
{"title":"Identifying and Categorizing Malicious Content on Paste Sites: A Neural Topic Modeling Approach","authors":"Tala Vahedi, Benjamin Ampel, S. Samtani, Hsinchun Chen","doi":"10.1109/ISI53945.2021.9624765","DOIUrl":"https://doi.org/10.1109/ISI53945.2021.9624765","url":null,"abstract":"Malicious cyber activities impose substantial costs on the U.S. economy and global markets. Cyber-criminals often use information-sharing social media platforms such as paste sites (e.g., Pastebin) to share vast amounts of plain text content related to Personally Identifiable Information (PII), credit card numbers, exploit code, malware, and other sensitive content. Paste sites can provide targeted Cyber Threat Intelligence (CTI) about potential threats and prior breaches. In this research, we propose a novel Bidirectional Encoder Representation from Transformers (BERT) with Latent Dirichlet Allocation (LDA) model to categorize pastes automatically. Our proposed BERT-LDA model leverages a neural network transformer architecture to capture sequential dependencies when representing each sentence in a paste. BERT-LDA replaces the Bag-of-Words (BoW) approach in the conventional LDA with a Bag-of-Labels (BoL) that encompasses class labels at the sequence level. We compared the performance of the proposed BERT-LDA against the conventional LDA and BERT-LDA variants (e.g., GPT2-LDA) on 4,254,453 pastes from three paste sites. Experiment results indicate that the proposed BERT-LDA outperformed the standard LDA and each BERT-LDA variant in terms of perplexity on each paste site. Results of our BERT-LDA case study suggest that significant content relating to hacker community activities, malicious code, network and website vulnerabilities, and PII are shared on paste sites. The insights provided by this study could be used by organizations to proactively mitigate potential damage on their infrastructure.","PeriodicalId":347770,"journal":{"name":"2021 IEEE International Conference on Intelligence and Security Informatics (ISI)","volume":"2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123698003","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Joe Harrison, Joshua Lyons, Lauren Anderson, Lauren Maunder, Paul O'Donnell, Kiernan B. George, Alan J. Michaels
{"title":"Quantifying Use and Abuse of Personal Information","authors":"Joe Harrison, Joshua Lyons, Lauren Anderson, Lauren Maunder, Paul O'Donnell, Kiernan B. George, Alan J. Michaels","doi":"10.1109/ISI53945.2021.9624816","DOIUrl":"https://doi.org/10.1109/ISI53945.2021.9624816","url":null,"abstract":"Once shared, our personal information on the Internet is no longer private. We routinely receive emails from companies that we have not had any known interaction with, and are receiving an increasingly large volume of spam phone calls. In this paper, we describe interim results from an experiment designed to quantify who is using and distributing our personally identifying information (PII). To do this, we set up 300 fake identities, each with an email address and around half with a live phone number, and performed one-time online interactions with 188 distinct companies. Over a 9-month span, we received around 20,000 artifacts and found that reputable companies, surprisingly, do not sell our information in ways that we could detect, that there was no observation of undue foreign interest during the election, and that the classic “extended vehicle warranty” scam is still in active use today.","PeriodicalId":347770,"journal":{"name":"2021 IEEE International Conference on Intelligence and Security Informatics (ISI)","volume":"52 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125158819","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Tianyi Luo, Zhidong Cao, Pengfei Zhao, D. Zeng, Qingpeng Zhang
{"title":"Evaluating the Impact of Vaccination on COVID-19 Pandemic Used a Hierarchical Weighted Contact Network Model","authors":"Tianyi Luo, Zhidong Cao, Pengfei Zhao, D. Zeng, Qingpeng Zhang","doi":"10.1109/ISI53945.2021.9624841","DOIUrl":"https://doi.org/10.1109/ISI53945.2021.9624841","url":null,"abstract":"The 2019 Novel Coronavirus Disease (COVID-19) vaccines have been placed significant expectation to end the COVID-19 pandemic sooner. However, issues related to vaccines still need to be resolved urgently, including the vaccination number and range. In this paper, we proposed an epidemic spread model based on the hierarchical weighted network. This model fully considers the heterogeneity of the community social contact network and the epidemiological characteristics of COVID-19 in China, which enables to evaluate the potential impact of vaccine efficacy, vaccination schemes, and mixed interventions on the epidemic. The results show that a mass vaccination can effectively control the epidemic but cannot completely eliminate it. In the case of limited resources, giving vaccination priority to the individuals with high contact intensity in the community is necessary. Joint implementation with non-pharmacological interventions strengthening the control of virus transmission. The results provide insights for decision-makers with effective vaccination plans and prevention and control programs.","PeriodicalId":347770,"journal":{"name":"2021 IEEE International Conference on Intelligence and Security Informatics (ISI)","volume":"28 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129179540","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Kaeli Otto, Benjamin Ampel, S. Samtani, Hongyi Zhu, Hsinchun Chen
{"title":"Exploring the Evolution of Exploit-Sharing Hackers: An Unsupervised Graph Embedding Approach","authors":"Kaeli Otto, Benjamin Ampel, S. Samtani, Hongyi Zhu, Hsinchun Chen","doi":"10.1109/ISI53945.2021.9624846","DOIUrl":"https://doi.org/10.1109/ISI53945.2021.9624846","url":null,"abstract":"Cybercrime was estimated to cost the global economy $945 billion in 2020. Increasingly, law enforcement agencies are using social network analysis (SNA) to identify key hackers from Dark Web hacker forums for targeted investigations. However, past approaches have primarily focused on analyzing key hackers at a single point in time and use a hacker’s structural features only. In this study, we propose a novel Hacker Evolution Identification Framework to identify how hackers evolve within hacker forums. The proposed framework has two novelties in its design. First, the framework captures features such as user statistics, node-level metrics, lexical measures, and post style, when representing each hacker with unsupervised graph embedding methods. Second, the framework incorporates mechanisms to align embedding spaces across multiple time-spells of data to facilitate analysis of how hackers evolve over time. Two experiments were conducted to assess the performance of prevailing graph embedding algorithms and nodal feature variations in the task of graph reconstruction in five time-spells. Results of our experiments indicate that Text-Associated Deep-Walk (TADW) with all of the proposed nodal features outperforms methods without nodal features in terms of Mean Average Precision in each time-spell. We illustrate the potential practical utility of the proposed framework with a case study on an English forum with 51,612 posts. The results produced by the framework in this case study identified key hackers posting piracy assets.","PeriodicalId":347770,"journal":{"name":"2021 IEEE International Conference on Intelligence and Security Informatics (ISI)","volume":"51 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117216425","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}