Mining user interaction patterns in the darkweb to predict enterprise cyber incidents

Soumajyoti Sarkar, Mohammad Almukaynizi, Jana Shakarian, Paulo Shakarian

Research output: Contribution to journalArticle

Abstract

With the rise in security breaches over the past few years, there has been an increasing need to mine insights from social media platforms to raise alerts of possible attacks in an attempt to defend conflict during competition. In this study, we attempt to build a framework that utilizes unconventional signals from the darkweb forums by leveraging the reply network structure of user interactions with the goal of predicting enterprise-related external cyber attacks. We use both unsupervised and supervised learning models that address the challenges that come with the lack of enterprise attack metadata for ground-truth validation as well as insufficient data for training the models. We validate our models on a binary classification problem that attempts to predict cyber attacks on a daily basis for an organization. Using several controlled studies on features leveraging the network structure, we measure the extent to which the indicators from the darkweb forums can be successfully used to predict attacks. We use information from 53 forums in the darkweb over a span of 17 months for the task. Our framework to predict real-world organization cyber attacks of three different security events suggests that focusing on the reply path structure between groups of users based on random walk transitions and community structures has an advantage in terms of better performance solely relying on forum or user posting statistics prior to attacks.

Original languageEnglish (US)
Article number57
JournalSocial Network Analysis and Mining
Volume9
Issue number1
DOIs
StatePublished - Dec 1 2019
Externally publishedYes

Fingerprint

interaction pattern
incident
Industry
Unsupervised learning
Information use
Supervised learning
Metadata
organization
social media
Statistics
statistics
event
lack
interaction
learning
community
performance
Group

Keywords

  • Cyber attack prediction
  • Machine learning
  • Social networks

ASJC Scopus subject areas

  • Information Systems
  • Communication
  • Media Technology
  • Human-Computer Interaction
  • Computer Science Applications

Cite this

Mining user interaction patterns in the darkweb to predict enterprise cyber incidents. / Sarkar, Soumajyoti; Almukaynizi, Mohammad; Shakarian, Jana; Shakarian, Paulo.

In: Social Network Analysis and Mining, Vol. 9, No. 1, 57, 01.12.2019.

Research output: Contribution to journalArticle

Sarkar, Soumajyoti ; Almukaynizi, Mohammad ; Shakarian, Jana ; Shakarian, Paulo. / Mining user interaction patterns in the darkweb to predict enterprise cyber incidents. In: Social Network Analysis and Mining. 2019 ; Vol. 9, No. 1.
@article{020fe0de9b4f45228fdd677e24881945,
title = "Mining user interaction patterns in the darkweb to predict enterprise cyber incidents",
abstract = "With the rise in security breaches over the past few years, there has been an increasing need to mine insights from social media platforms to raise alerts of possible attacks in an attempt to defend conflict during competition. In this study, we attempt to build a framework that utilizes unconventional signals from the darkweb forums by leveraging the reply network structure of user interactions with the goal of predicting enterprise-related external cyber attacks. We use both unsupervised and supervised learning models that address the challenges that come with the lack of enterprise attack metadata for ground-truth validation as well as insufficient data for training the models. We validate our models on a binary classification problem that attempts to predict cyber attacks on a daily basis for an organization. Using several controlled studies on features leveraging the network structure, we measure the extent to which the indicators from the darkweb forums can be successfully used to predict attacks. We use information from 53 forums in the darkweb over a span of 17 months for the task. Our framework to predict real-world organization cyber attacks of three different security events suggests that focusing on the reply path structure between groups of users based on random walk transitions and community structures has an advantage in terms of better performance solely relying on forum or user posting statistics prior to attacks.",
keywords = "Cyber attack prediction, Machine learning, Social networks",
author = "Soumajyoti Sarkar and Mohammad Almukaynizi and Jana Shakarian and Paulo Shakarian",
year = "2019",
month = "12",
day = "1",
doi = "10.1007/s13278-019-0603-9",
language = "English (US)",
volume = "9",
journal = "Social Network Analysis and Mining",
issn = "1869-5450",
publisher = "Springer Wien",
number = "1",

}

TY - JOUR

T1 - Mining user interaction patterns in the darkweb to predict enterprise cyber incidents

AU - Sarkar, Soumajyoti

AU - Almukaynizi, Mohammad

AU - Shakarian, Jana

AU - Shakarian, Paulo

PY - 2019/12/1

Y1 - 2019/12/1

N2 - With the rise in security breaches over the past few years, there has been an increasing need to mine insights from social media platforms to raise alerts of possible attacks in an attempt to defend conflict during competition. In this study, we attempt to build a framework that utilizes unconventional signals from the darkweb forums by leveraging the reply network structure of user interactions with the goal of predicting enterprise-related external cyber attacks. We use both unsupervised and supervised learning models that address the challenges that come with the lack of enterprise attack metadata for ground-truth validation as well as insufficient data for training the models. We validate our models on a binary classification problem that attempts to predict cyber attacks on a daily basis for an organization. Using several controlled studies on features leveraging the network structure, we measure the extent to which the indicators from the darkweb forums can be successfully used to predict attacks. We use information from 53 forums in the darkweb over a span of 17 months for the task. Our framework to predict real-world organization cyber attacks of three different security events suggests that focusing on the reply path structure between groups of users based on random walk transitions and community structures has an advantage in terms of better performance solely relying on forum or user posting statistics prior to attacks.

AB - With the rise in security breaches over the past few years, there has been an increasing need to mine insights from social media platforms to raise alerts of possible attacks in an attempt to defend conflict during competition. In this study, we attempt to build a framework that utilizes unconventional signals from the darkweb forums by leveraging the reply network structure of user interactions with the goal of predicting enterprise-related external cyber attacks. We use both unsupervised and supervised learning models that address the challenges that come with the lack of enterprise attack metadata for ground-truth validation as well as insufficient data for training the models. We validate our models on a binary classification problem that attempts to predict cyber attacks on a daily basis for an organization. Using several controlled studies on features leveraging the network structure, we measure the extent to which the indicators from the darkweb forums can be successfully used to predict attacks. We use information from 53 forums in the darkweb over a span of 17 months for the task. Our framework to predict real-world organization cyber attacks of three different security events suggests that focusing on the reply path structure between groups of users based on random walk transitions and community structures has an advantage in terms of better performance solely relying on forum or user posting statistics prior to attacks.

KW - Cyber attack prediction

KW - Machine learning

KW - Social networks

UR - http://www.scopus.com/inward/record.url?scp=85073249318&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85073249318&partnerID=8YFLogxK

U2 - 10.1007/s13278-019-0603-9

DO - 10.1007/s13278-019-0603-9

M3 - Article

AN - SCOPUS:85073249318

VL - 9

JO - Social Network Analysis and Mining

JF - Social Network Analysis and Mining

SN - 1869-5450

IS - 1

M1 - 57

ER -