Discussions in Deep, Dark, and Open. Monitoring The Social Discourse of Cyberattack, 10 Oct 2013

Discussions in Deep, Dark, and Open: Monitoring the Social Discourse of Cyberattack
Oct 10, 2013 Jack Zaientz, Bob Bechtel, Matt Hollingsworth [email protected] [email protected]
Soar Technology, Inc. Proprietary
Support cyberattack analysis through social discourse

What Needs to Be Done: Provide cyber analysts with better tools for monitoring large social media streams by detecting expected and unknown items of interest detecting deliberate attempts to spread disinformation, incite hostilities, propagate cyberattack tools assessing source quality Whats Hard: We have a haystack, but are not sure that its needles were looking for Difficult to detect unknown facts (new cyber-attack methods) Difficult to manually develop filters that capture the complexity of the domain Difficult to understand map of community boundaries relative to cyberattack development What were doing / Core Insight: Developing a search query grammar and associated filter algorithms and visualization tools to leverage the innate linguistic and communication structure of social media Timeline: Have done initial experimentation under IRAD funds. Will be developing prototype interfaces and algorithms over next two years with goal of operational testing Insight/hypothesis: Much as frequency analysis is a core cryptanalysis technique because it exploits known regularities in language, social discourse analysis can be a core technique in social media analysis because it exploits known regularities in Soar Technology, Inc. 6/27/2013 language (including communications patterns, term use)
Social Media as OSINT, both HUMINT and COMINT

HUMINT direct observation, where sensor is secondary to observation Intentional or inadvertent civilian sensors with eyes on a situation Comparing pre- and post- event social media behavior to gauge civilian reaction and attitudes Disaster Impact and Battle Damage Assessment imagery
New Checking for the new SabPub malware in OS X http://t.co/wUK3A8rL
new malware version
COMINT intercepted communications, where sender/receiver is critical Adversarial influence operations & disinformation Requests for support (HA/DR supplies, intervention) Advertisement / movement of contraband (particularly cyber) Claims of responsibility for attacks Development of trans-national networks
political New Checking for the new SabPub malware in OS X http://t.co/wUK3A8rL hacktivists are #occupycanada #occupytoronto #occupyvancouver aware of new Soar Technology, Inc. malware version #occupymiami #occupydc
CyberAttack communication in the open web

Cyber Attack Tool Development
Semi-skilled Students Professionals Engineers
for praise / reputation
for product distribution
for info exchange & reputation
Researchers
Analysts need to Detect unknown items of interest & Assess source quality
Internet Channels Dark Web Channels

Criminal organizations, adversary nations, independent hackers & hacktivists
Ecosystem where connections and profits are made when previously unknown parties find each other
The internet is used by to facilitate communication between anonymous or Soar Technology, Inc. 6/27/2013 previously unknown-to-each-other collaborators
Monitoring social media for communication

Leveraging social media communication structure helps overcome big-data scaling issues
but new end-user tools are needed
Novelty Signaling
Combine novelty & cyberattack terms Novelty: new, novel, recent CyberAttack: access control, adware, arbitrary memory, bot, botnet, brute force, buffer overflow, buffer size validation, cache poisoning, ddos Recent experiment used over 300 term pairs to filter 1 year of twitter fire-hose to less than 5 cyber-relative tweets per day.
Community-specific language:
Communities use specific terminology that can be used for filtering, but its challenging to discover and results in combinatorics in filter definition
Communication Patterns:
Communities use stable communication patterns ; e.g. novelty signaling, shouting/#beaconing
Twitter Shout
Using multiple hashtags to make a tweet findable by target communities
Adversaries, collaborators, and at-risk populations want to be found. Soar Technology, Inc. 6/27/2013 But we need to be listening properly
More examples from the wild..
Novelty Signaling behavior is common but analysts cant handle vast combinatorics with text-literal query interfaces
6 Soar Technology, Inc. 6/27/2013
Next Steps for Cyber and Crisis analysis SA

On the ground now
Improve understanding of communication flows and community vocabularies within target domains to anticipate deliberate communication Use current keyword based (e.g. ONRs TweetTracker) tools in a systematic manner to develop term use base-lines and to monitor for key tweets
Future S&T Develop next-generation analysis tools that ease burden on analysts and improve search results by leveraging social discourse structure
Are you a hashtag? If I tweeted this, would it reach you?
Important workshop on social media impacts on human security & military operations. Be there. #nato #onr #dhs #red cross #UNHCR #GDACC #social media #humansecurity #cybersecurity #resiliency #disasterrelief #civilconflict #crisisoperations #privacy
7 Soar Technology, Inc. 10/10/2013
Soar Technology, Inc. Proprietary
10/10/2013

Discussions in Deep, Dark, and Open. Monitoring The Social Discourse of Cyberattack, 10 Oct 2013

Uploaded by

Copyright:

Available Formats

Discussions in Deep, Dark, and Open. Monitoring The Social Discourse of Cyberattack, 10 Oct 2013

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Discussions in Deep, Dark, and Open. Monitoring The Social Discourse of Cyberattack, 10 Oct 2013

Uploaded by

Copyright:

Available Formats

Discussions in Deep, Dark, and Open: Monitoring the Social Discourse of Cyberattack

Soar Technology, Inc. Proprietary

Support cyberattack analysis through social discourse

Social Media as OSINT, both HUMINT and COMINT

CyberAttack communication in the open web

for praise / reputation

for product distribution

for info exchange & reputation

Internet Channels Dark Web Channels

Monitoring social media for communication

More examples from the wild..

Next Steps for Cyber and Crisis analysis SA

Soar Technology, Inc. Proprietary

You might also like