No abstract

Several researchers have recently proposed technology for crowd-and-DJ interactions in nightclub environments. However, these attempts have not always met with success. In order to design better technologies and systems in this area, it is important to start with an understanding of how nightclub interaction currently happens. To build this understanding, we carried out an interview study focusing on DJ-audience interactions. We interviewed eleven DJs from several different cities, and asked them to discuss the ways that they interact with the audience, and the ways that they maintain and use awareness of the audience. We found that DJs gather a wide variety of information about their audiences, and that this information is important to them as they plan and shape the evening's musical experience. DJs are adept at gathering visual information about the audience, despite poor lighting conditions and a heavy workload of selecting and mixing music. Despite the difficulties, DJs took a dim view of technology designed to let crowds exert more control over the music. This study is one of the first to look closely at the interactive relationship between the DJ and the nightclub audience through the lens of HCI, and our findings provide a number of guidelines for the design of new DJfocused nightclub technologies.

The insider threat has long been considered one of the most serious threats in computer security, and one of the most difficult to combat. But the problem has never been defined precisely, and that lack of precise definition inhibits solutions. This paper presents a precise definition of insider threat, and shows how the definition enables an analysis of the set of problems traditionally lumped into "the insider threat". It introduces a hierarchy of policy abstractions, and argues that the discrepancies between the different layers of abstraction expose the potential for insider threat. It also presents a methodology for analyzing the threat based upon our definitions. In the process, we introduce AttributeBased Group Access Control, a generalization of the RoleBased Access Control model that allows any attributes to define a group. We apply this to the insider threat by defining groups based on access capabilities, and using that to identify users with a high level of threat with respect to high-risk resources.

NetFlow data is routinely captured at the border of many enterprise networks. Although not as rich as full packetcapture data, NetFlow provides a compact record of the interactions between host pairs on either side of the monitored border. Analysis of this data presents a challenge to the security analyst due to its volume. We report preliminary results on the development of a suite of visualization tools that are intended to complement command line tools, such as those from the SiLK Tools, that are currently used by analysts to perform forensic analysis of NetFlow data. The current version of the tool set draws on three visual paradigms: activity diagrams that display various aspects of multiple individual host behaviors as color 1 coded time series, connection bundles that show the interactions among hosts and groups of hosts, and the NetBytes viewer that allows detailed examination of the port and volume behaviors of an individual host over a period of time. The system supports drill down for additional detail and pivoting that allows the analyst to examine the relationships among the displays. SiLK data is preprocessed into a relational database to drive the display modes, and the tools can interact with the SiLK system to extract additional data as necessary.

Recent surveys indicate that the financial impact and operating losses due to insider intrusions are increasing. But these studies often disagree on what constitutes an "insider;" indeed, many define it only implicitly. In theory, appropriate selection of, and enforcement of, properly specified security policies should prevent legitimate users from abusing their access to computer systems, information, and other resources. However, even if policies could be expressed precisely, the natural mapping between the natural language expression of a security policy, and the expression of that policy in a form that can be implemented on a computer system or network, creates gaps in enforcement. This paper defines "insider" precisely, in terms of these gaps, and explores an access-based model for analyzing threats that include those usually termed "insider threats." This model enables an organization to order its resources based on the business value for that resource and of the information it contains. By identifying those users with access to high-value resources, we obtain an ordered list of users who can cause the greatest amount of damage. Concurrently with this, we examine psychological indicators in order to determine which users are at the greatest risk of acting inappropriately. We conclude by examining how to merge this model with one of forensic logging and auditing.