SBE TTP: Medium: Securing Cyber Space: Understanding the Cyber Attackers and Attacks via Social Media Analytics

随着社会变得更加依赖网络基础设施，网络和信息技术的安全成为一个日益令人担忧的问题。个人、企业和政府组织现在是网络攻击的常见受害者，这些攻击试图窃取私人数据，获得对远程系统的远程控制，并通过其他恶意手段对网络和系统造成损害。此外，智能电网和通信网络等关键基础设施正面临越来越多的基于网络的威胁。因此，许多研究人员和安全从业者已经开始调查网络攻击者社区，以便更多地了解网络攻击者行为、新出现的威胁和网络犯罪供应链。不幸的是，网络安全研究缺乏成熟的科学。缺乏文献对希望了解更多信息的研究人员来说是一个问题，以便他们可以为网络安全研究的现状做出贡献并推动其发展。例如，许多网络攻击者社区采取谨慎措施，通过采用反爬行措施来隐藏自己。这对许多研究人员和安全从业者来说将是一个挑战。此外，一些人可能会发现，由于网络攻击术语、先进的安全概念或来自不同国家或地区的网络攻击组织的外来内容，网络攻击社区的讨论很难解释。因此，非常需要研究黑客社区，以及促进其他人的研究？理解和调查来自此类社区的内容的能力。具体地说，自动化工具和分析的开发增加了更多网络安全研究的潜力。Web挖掘和机器学习技术可以与社会科学方法结合使用，以帮助回答与黑客行为和文化、非法市场和秘密网络、网络犯罪供应链、恶意软件分析、新出现的安全威胁等相关的许多问题。通过将黑客社区数据与社会科学方法、计算技术和安全分析相结合，可以扩展当前的网络安全研究。在这项研究中，对黑客行为、市场、社区结构、社区内容、文物和文化差异等重要问题进行了探索。将开发从论坛、互联网接力聊天和蜜罐收集和分析数据的自动化技术。这类工具的开发将有助于进一步采取积极主动的方法来防止基于网络的威胁，而不是采取传统的方法，即在“坏”事情发生时做出反应。更好地了解多个地缘政治地区的黑客社区将有助于更好地了解网络犯罪行为，并为安全研究人员和实践者提供改进和更安全的实践。拟议的集成计算框架以及由此产生的算法和软件还将使社会科学研究人员和安全实践者能够仔细检查网络攻击者群体如何形成、发展和传播他们的想法；识别在线世界中重要的和有影响力的网络罪犯；并开发通过他们的通信和交互风格识别在线黑客身份的方法。更多地了解网络罪犯、黑客及其非法黑市可以帮助政策制定者和安全专业人士就如何预防或应对攻击做出更好的决策。拟议的工作还有助于为其作出贡献的学生研究助理的教育和专业发展。他们将学习可靠的研究方法，以及如何为科学和其他专业观众撰写和展示他们的工作。

As society becomes more dependent on cyber infrastructure, the security of networks and information technologies has become a growing concern. Individuals, businesses, and governmental organizations are now common victims of cyber-attacks that seek to steal private data, gain remote control over remote systems, and cause harm to networks and systems through other malicious means. Additionally, critical infrastructures such as smart power grids and communication networks are facing an increasing number of cyber-based threats. As a result, many researchers and security practitioners have begun to investigate cyber attacker communities in order to learn more about cyber attacker behaviors, emerging threats, and the cybercriminal supply chain. Unfortunately, there is a lack of established science for cyber security research. The lack of literature is problematic for researchers wanting to learn more so that they may contribute to and advance the current state of cyber security research. For example, many cyber attacker communities take careful measures to hide themselves by employing anti-crawling measures. This would be a challenge for many researchers and security practitioners. Furthermore, some may find cyber attacker community discussion difficult to interpret due to cyber attacker jargon, advanced security concepts, or foreign contents belonging to cyber attacker groups spanning across different countries or regions.For these reasons, research studying hacker communities is greatly needed, as well as research that advances others? capacity to understand and investigate contents from such communities. Specifically, the development of automated tools and analyses increases the potential for more cyber security research. Web mining and machine learning technologies can be used in tandem with social science methodologies to help answer many questions related to hacker behaviors and culture, illegal markets and covert networks, cybercriminal supply chain, malware analysis, emerging security threats, and other matters. There are many opportunities for extending current cyber security research by combining hacker community data with social science methodologies, computational techniques, and security analysis. In this research, important questions about hacker behaviors, markets, community structure, community contents, artifacts, and cultural differences are explored. Automated techniques to collect and analyze data from forums, Internet Relay Chat, and honeypots will be developed. The development of such tools will help further proactive approaches for preventing cyber-based threats, rather than taking the traditional approach of reacting when something "bad" happens. Better understanding of hacker communities across multiple geopolitical regions will support a better understanding of cybercriminal behavior, and improved and safer practices for security researchers and practitioners.The proposed integrated computational framework and the resulting algorithms and software will also allow social science researchers and security practitioners to closely examine how cyber attacker groups form, develop, and spread their ideas; identify important and influential cyber criminals in the online world; and develop the means to recognize online hacker identities through their communication and interaction styles. Knowing more about cyber criminals, hackers, and their illegal black markets can help policy makers and security professionals make better decisions about how to prevent or respond to attacks. The proposed work also contributes to the educational and professional development of the student research associates who contribute to it. They will learn sound research methods, and how to write about and present their work for scientific and other professional audiences.