A Decadal Survey of the Social and Behavioral Sciences A Research Agenda for Advancing Intelligence Analysis (2019) / Chapter Skim
Currently Skimming:
6 Integrating Social and Behavioral Sciences (SBS) Research to Enhance Security in Cyberspace
6 Integrating Social and Behavioral Sciences (SBS) Research to Enhance Security in Cyberspace
Pages 141-188
The Chapter Skim interface presents what we've algorithmically identified as the most significant single chunk of text within every page in the chapter.
Select key terms on the right to highlight them within pages of the chapter.
From page 141... ...
The emerging field of social cybersecurity science has developed to 1For examples, see https://searchsecurity.techtarget.com/definition/cybersecurity December 2018] and https://www.paloaltonetworks.com/cyberpedia/what-is-cyber-security [December 2018]
|
From page 142... ...
. While researchers in the social cybersecurity area come from a large number of disciplines, many identify themselves as computational social scientists.
|
From page 143... ...
, social cybersecurity researchers have a different approach: they focus on activities aimed at influencing or manipulating individuals, groups, or communities, particularly activities that have large consequences for social groups, organizations, and countries. The solutions to some problems, such as denial-of-service attacks, malware distribution, and insider threats, require both types of expertise, but the emphasis in the two fields is quite different.
|
From page 144... ...
It is not surprising, then, that SBS research has been applied to many aspects of cybersecurity. In many cases, these applications have been focused on cybersecurity for the end user.
|
From page 145... ...
social media providers Illustrative Central RSA, Black Hat, DEFCON, World Wide Web, SBPConferences InfoSec World, International BRiMS, ASONAM, Social Conference on Cybersecurity Com, Web and Social Media
|
From page 146... ...
The field of social cybersecurity does not simply supplant the important work of SBS research. Rather, researchers in the field build on some existing work and extend other work to generate new knowledge and in some cases develop new theory and methods that arise from the transdisciplinary approach for studying the cyber environment.
|
From page 147... ...
Table 6-2, although not comprehensive, indicates this variety. One constant for researchers in social cybersecurity is the application of network science and social network analysis (see Chapter 5)
|
From page 148... ...
Information Cyber-physical- Machine learning Phone and banking How and Science social security, data when does social media information analytics diffuse in social media? Psychology Social Social media E-mail, laboratory When do engineering analytics, case experiments people studies contribute to conversations in social media?
|
From page 149... ...
Economics Digital economy, Economic Money trails, How do cybersecurity incentive price indices, social media economics assessment, cryptocurrency rates influence the econometrics and usage economy? A Social Cybersecurity Approach to Studying a False Information Campaign The issue of the spread of false information on Twitter illustrates the distinction between the approaches of social cybersecurity and either pure computer science or pure social science.
|
From page 150... ...
Box 6-2 highlights other data challenges for this research, which would affect all three approaches. In contrast, a pure social science approach to the same problem might be to begin by defining false information and its nuances in the context of BOX 6-2 Challenges in Data Access The fields of computer science, social science, and social cybersecurity all face several challenges in data access.
|
From page 151... ...
Drawing on the potential benefits of both of these approaches, a social cybersecurity researcher would take into account the following: • how social media technology can be manipulated to affect who receives which messages at which times; • the way the messages are presented and accessed; • the way humans, individually and in groups, can create, access, be influenced by, and influence others using these features of the technology; • how the content of a message can be manipulated to affect its persuasiveness, or the tendency of the technology to suspend the sender or recommend the message; • the features of the content that affect its longevity (e.g., the pres ence of images) ; 5Interrater reliability refers to the level of agreement between those rating or coding a particular item.
|
From page 152... ...
New methods would likely be tested on a combination of new and old data. As theoretical accounts are modified, social cybersecurity researchers develop new algorithms for collecting data on specific activities or measuring key features of those activities.
|
From page 153... ...
Bots, trolls, and cyborgs have supported information and disinformation campaigns aimed at influencing elections in the United States, Britain, Germany, and Sweden. Social cybersecurity attacks are prevalent: by one estimate, as many as one in five businesses have been subjected to a social media–based malware attack.7 Such cyberattacks are conducted by individuals, groups, nonstate actors, state actors, and actors sponsored by states, often supported by the use of bots.
|
From page 154... ...
The field of social cybersecurity offers important perspectives on how to recognize and respond to such attacks. Other SBS research, particularly in the application of organization theory to high-risk organizations, provides guidance on how to promote heedful interaction in the cyber-mediated realm and how to develop and sustain an effective social cybersafety culture.
|
From page 155... ...
These individuals are often identified using metrics from social network analysis such as page rank, superspreader, or superfriend. Superspreaders in particular have a large number of followers and are central figures in their topic-group.
|
From page 156... ...
The Firibi Gnome bot is in that core. The promoted account is the Twitter site associated with a website that is collecting money for the children of Syria.
|
From page 157... ...
Social cybersecurity research based on this work uses these computational methods in developing new sociotechnical theories and methods focused on the spread of multiple types of information maneuvers that were previously treated as a single phenomenon. RESEARCH NEEDED IN THE COMING DECADE Research in the field of social cybersecurity is needed on two parallel fronts: (1)
|
From page 158... ...
Multidisciplinary computational social science research building on both technological advances in computer science and SBS research has the potential to advance the research infrastructure in the field of social cybersecurity and expand the intelligence analyst's capability to address cybersecurity questions. Having the tools necessary to predict and prevent attacks in the social cyberspace will require an aggressive research effort to identify, characterize, and understand such attacks.
|
From page 159... ...
Recent advances in social network/network science (Benigni et al., 2019) and social cyberforensic techniques (Al-Khateeb et al., 2017)
|
From page 160... ...
Some promising avenues include • research to improve the capacity to detect online behavioral patterns of perpetrators; • translational research to improve the utility for the IC of existing computational social science research techniques for identifying whether apparent attacks stem from humans, bots, or cyborgs; • interdisciplinary research led by SBS researchers (those with deep under standing of how and why people manipulate media technology) to develop tools for predicting how bots and cyborgs will evolve in the future; and • the development of sharable and continuously expanding data about known bots and cyborgs.
|
From page 161... ...
. Information maneuvers can take different forms with very subtle nuances, and they require elaborate setups.
|
From page 162... ...
. The literature on information warfare also sheds some light on new forms of information maneuvers.
|
From page 163... ...
Although hundreds of social cybersecurity studies have used computational text analysis methods, there appear to be only a few that have used any form of computational image or video processing.13 An area of research prime for breakthroughs in the near future, then, is understanding how the presentation of emotion-laden messages and images in social media can influence groups, how such presentation varies across messages containing true and false information, and how the impact of such messages and images can be countered within and through information maneuvers. 13This observation is based on an examination of all papers identified by Carley and col leagues (2018)
|
From page 164... ...
Moving beyond these theories to account for the technical, global, and temporal nature of the new cyber environment will be a valuable step forward. Promising avenues include • research to understand how operational features of specific social media and entertainment technologies are being exploited as part of these information maneuvers; • research expanding on new work to characterize information maneuvers and to develop a unified list of such maneuvers and associated data; • research to develop theories for identifying, explaining, predicting, and coun tering information maneuvers in cyberspace; • research to further develop tactics, techniques, and procedures, currently in their infancy, for detecting information manipulation as it is happening and identifying the strategies being used, and for reducing the societal and group level risks of such manipulation; and • translational research on the operational technology that can allow the IC to identify and characterize information maneuvers and their intended audience rapidly, at scale, and in a semiautomated fashion.
|
From page 165... ...
Thus information maneuvers useful for spreading false information are also useful for spreading true information. Tactics used to market real products (e.g., Safko, 2010; Scott, 2015)
|
From page 166... ...
Research Directions Conduct research to develop techniques and tools with the capabilities to determine automatically and rapidly the intent of those conducting social cybersecurity information maneuvers. Although such techniques and tools exist, they need to be better linked to theo ries of motivation and tools for linking motivation to behaviors.
|
From page 167... ...
. However, there are only a few theories of or models for information diffusion when multiple social media are present and in use (an exception being a model called Construct [Carley et al., 2009, 2014]
|
From page 168... ...
This research can build on social cyberforensics technologies, social network/network science techniques, and social theories of information diffusion and group formation. New theories of information diffusion that account for multimedia use in cyberspace can then be applied to the development of techniques and tools for tracking, explaining, and predicting the movement of individuals, groups, ideas, and beliefs through and across multiple social media.
|
From page 169... ...
Research Directions Develop methods for measuring the impact of an information campaign, in both the short and long terms. Given the benefits of such methods for intelligence analysis, progress on real-time measurement of the effects of information maneuvers in cyberspace is an import ant area for future research in social cybersecurity.
|
From page 170... ...
Given the high volume of data in social media, it is often argued that trust in the source is used as a way of filtering information and reducing cognitive load, in which case false information from a trusted source is more trusted than true information from an untrusted source (Tang and Liu, 2015)
|
From page 171... ...
Such research could build on research in education and social psychology; the ories of social influence, marketing, participatory democracy, and cognitive bias reduction; and social and political theories of group formation and dissolution. Promising avenues include • empirical research on the key factors that put individuals and groups at risk of being targeted by information maneuvers in cyberspace, how these factors and the individuals and groups targeted may vary depending on the specific social media platform, and how that risk can be measured and reduced in specific media; • research to better understand how recipients are influenced by information maneuvers, and any differences among certain populations; and • research to develop techniques for measuring the actual and potential impacts of deceptive action or the misplacement of trust at the group or population level.
|
From page 172... ...
. S Because information maneuvers in social media involve manipulation of both groups and messages, moreover, new approaches to countermessages that include attention to the nature of the group are needed.
|
From page 173... ...
Such research could build on work on information warfare from social psychology; research on cognitive biases, marketing, and communication; theories of social cognition; and knowledge of participation and group formation gleaned from so ciology and political science. Promising avenues include • research focused specifically on identifying effective countermessaging strat egies while taking into account the technical features of the social media; • research directed at identifying effective countermessaging strategies while taking into account the authorities governing those doing the counter essaging; m and • research on how to implement, measure the prevalence of, and assess the effectiveness of a social cybersecurity safety culture.
|
From page 174... ...
We caution, however, that issues associated with terrorism, social cybersecurity, and cybersecurity each demand distinct sets of skills and authorities. Designing ways to protect against such threats requires the ability to collect data on and analyze and visualize high-dimensional dynamic networks with both social network and knowledge network components; Twitter networks, for example, generate both social data on who replies, retweets, or mentions or which individuals are quoted, and knowledge data on hashtags or topics that co-occur.
|
From page 175... ...
efforts to address the social cybersecurity threat in the coming decade. The emerging field of social cybersecurity research can yield insights that would supplement the IC's training and technology acquisition in the area of social cyber security threats and foster an effective social cybersafety culture.
|
From page 176... ...
. Understanding strategic information maneuvers in network media to advance cyber operations: A case study analysing pro-Russian sepa ratists' cyber information operations in Crimean water crisis.
|
From page 177... ...
In 2018 IEEE/ACM International Conference on Ad vances in Social Networks Analysis and Mining (ASONAM)
|
From page 178... ...
. Online social networks: Why do stu dents use Facebook?
|
From page 179... ...
. A Structural Theory of Social Influence (Vol.
|
From page 180... ...
. Affect control theory: Concepts and model.
|
From page 181... ...
In Proceedings of the 2013 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (pp.
|
From page 182... ...
. Why people use social networking sites: An empirical study integrating network externalities and motivation theory.
|
From page 183... ...
In Proceedings of the 2016 IEEE/ACM Interna tional Conference on Advances in Social Networks Analysis and Mining (pp.
|
From page 184... ...
. Brandjacking on social networks: Trademark infringement by imper sonation of markholders.
|
From page 185... ...
. The statistical evaluation of social network dynamics.
|
From page 186... ...
. Seven Deadliest Social Network Attacks (Syngress Seven Deadliest Attacks)
|
From page 187... ...
. Exploring characteristics of suspended users and network stability on Twitter. Social Network Analysis and Mining, 6(1)
|
From page 188... ...
. Weak ties: Subtle role of information diffusion in online social networks.
|
Key Terms
This material may be derived from roughly machine-read images, and so is provided only to facilitate research.
More
information on Chapter Skim is available.