Understanding the Relationship between Human Behavior and Susceptibility to Cyber Attacks

Ovelgönne, Michael; Dumitraş, Tudor; Prakash, B. Aditya; Subrahmanian, V. S.; Wang, Benjamin

doi:10.1145/2890509

Cited by 37 publications

(16 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Researchers have also developed methods to predict if users will be subject to compromise or whether they will visit malicious websites [9,10,50,59]. Among those, Canali et al [10]'s work is the closest to ours.…”

Section: Related Workmentioning

confidence: 99%

Predicting Impending Exposure to Malicious Content from User Behavior

Sharif

Urakawa

Christin

et al. 2018

Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

Many computer-security defenses are reactive-they operate only when security incidents take place, or immediately thereafter. Recent efforts have attempted to predict security incidents before they occur, to enable defenders to proactively protect their devices and networks. These efforts have primarily focused on long-term predictions. We propose a system that enables proactive defenses at the level of a single browsing session. By observing user behavior, it can predict whether they will be exposed to malicious content on the web seconds before the moment of exposure, thus opening a window of opportunity for proactive defenses. We evaluate our system using three months' worth of HTTP traffic generated by 20,645 users of a large cellular provider in 2017 and show that it can be helpful, even when only very low false positive rates are acceptable, and despite the difficulty of making "on-the-fly" predictions. We also engage directly with the users through surveys asking them demographic and security-related questions, to evaluate the utility of self-reported data for predicting exposure to malicious content. We find that self-reported data can help forecast exposure risk over long periods of time. However, even on the long-term, self-reported data is not as crucial as behavioral measurements to accurately predict exposure. CCS CONCEPTS• Security and privacy → Network security; Human and societal aspects of security and privacy; • Computing methodologies → Neural networks; KEYWORDS Exposure prediction; network security; proactive security ACM Reference Format:

show abstract

Section: Related Workmentioning

confidence: 99%

Predicting Impending Exposure to Malicious Content from User Behavior

Sharif

Urakawa

Christin

et al. 2018

Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

show abstract

“…For both cases, the behaviour is an indicator of the method used. So, there is a good relationship between human behaviour and cyber attacks [24].…”

Section: Threat Intelligencementioning

confidence: 99%

Analysis of adversary activities using cloud-based web services to enhance cyber threat intelligence

Al-Mohannadi

Awan

Hamar

2020

SOCA

View full text Add to dashboard Cite

The understanding of cyber threats to a network is challenging yet rewarding as it allows an organisation to prevent a potential attack. Numerous efforts have been made to predict cyber threat before they occur. To build a threat intelligence framework, an organisation must understand attack data collected from the network events and analyse them to identify the cyber attack artefacts such as IP address, domain name, tools and techniques, username and password, and geographic location of the attacker, which could be used to understand the nature of attack to a system or network. However, it is very difficult or dangerous to collect and analyse live data from a production system. Honeypot technology is well known for mimicking the real system while collecting actual data that can be in near real time in order to monitor the activities on the network. This paper proposes a threat intelligence approach analysing attack data collected using cloud-based web service in order to support the active threat intelligence.

show abstract

“…Cyber-attack Concept the method used. So, there is a good relationship between human behaviour and cyber attacks [23].…”

Section: A Threat Intelligencementioning

confidence: 99%

Cyber Threat Intelligence from Honeypot Data Using Elasticsearch

Al-Mohannadi

Awan

Hamar

et al. 2018

2018 IEEE 32nd International Conference on Advanced Information Networking and Applications (AINA)

View full text Add to dashboard Cite

Cyber attacks are increasing in every aspect of daily life. There are a number of different technologies around to tackle cyber-attacks, such as Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), firewalls, switches, routers etc., which are active round the clock. These systems generate alerts and prevent cyber attacks. This is not a straightforward solution however, as IDSs generate a huge volume of alerts that may or may not be accurate: potentially resulting in a large number of false positives. In most cases therefore, these alerts are too many in number to handle. In addition, it is impossible to prevent cyber-attacks simply by using tools. Instead, it requires greater intelligence in order to fully understand an adversary's motive by analysing various types of Indicator of Compromise (IoC). Also, it is important for the IT employees to have enough knowledge to identify true positive attacks and act according to the incident response process. In this paper, we have proposed a new threat intelligence technique which is evaluated by analysing honeypot log data to identify behaviour of attackers to find attack patterns. To achieve this goal, we have deployed a honeypot on an AWS cloud to collect cyber incident log data. The log data is analysed by using elasticsearch technology namely an ELK (Elasticsearch, Logstash and Kibana) stack.

show abstract

Understanding the Relationship between Human Behavior and Susceptibility to Cyber Attacks

Cited by 37 publications

References 23 publications

Predicting Impending Exposure to Malicious Content from User Behavior

Predicting Impending Exposure to Malicious Content from User Behavior

Analysis of adversary activities using cloud-based web services to enhance cyber threat intelligence

Cyber Threat Intelligence from Honeypot Data Using Elasticsearch

Contact Info

Product

Resources

About