ACCEPT: Addressing Cybersecurity and Cybercrime via a co-Evolutionary aPproach to reducing human-relaTed risks

接受：通过共同进化方法解决网络安全和网络犯罪问题，以减少与人类相关的风险

• 批准号: EP/P011896/1
• 负责人: Shujun Li
• 金额: $ 112.25万
• 依托单位: University of Surrey
• 依托单位国家: 英国
• 项目类别: Research Grant
• 财政年份: 2017
• 资助国家: 英国
• 起止时间: 2017 至 无数据
• 项目状态: 已结题
• 来源: https://gtr.ukri.org/projects?ref=EP%2FP011896%2F1
• 关键词: ACCEPT; Addressing; Cybersecurity; Cybercrime; via

Researchers and practitioners have acknowledged human-related risks among the most important factors in cybersecurity, e.g. an IBM report (2014) shows that over 95% of security incidents involved "human errors". Responses to human-related cyber risks remain undermined by a conceptual problem: the mindset associated with the term 'cyber'-crime which has persuaded us that that crimes with a cyber-dimension occur purely within a (non-physical) 'cyber' space, and that these constitute wholly new forms of offending, divorced from the human/social components of traditional (physical) crime landscapes. In this context, the unprecedented linking of individuals and technologies into global social-physical networks - hyperconnection - has generated exponential complexity and unpredictability of vulnerabilities.In addition to hyperconnectivity, the dynamic evolving nature of cyber systems is equally important. Cyber systems change far faster than biological/material cultures, and criminal behaviour and techniques evolve in relation to the changing nature of opportunities centring on target assets, tools and weapons, routine activities, business models, etc. Studying networks and relationships between individuals, businesses and organisations in a hyperconnected environment requires understanding of communities and the broader ecosystems. This complex, non-linear process can lead to co-evolution in the medium-longer term.The focus on cybersecurity as a dynamic interaction between humans and socio-technic elements within a risk ecosystem raises implementation issues, e.g. how to mobilise diverse players to support security. Conventionally they are considered under 'raising awareness', and many initiatives have been rolled out. However, activities targeting society as a whole have limitations, e.g. the lack of personalisation, which makes them less effective in influencing human behaviours.While there is isolated research across these areas, there is no holistic framework combining all these theoretical concepts (co-evolution, opportunity management, behavioural and business models, ad hoc technological research on cyber risks and cybercrime) to allow a more comprehensive understanding of human-related risks within cybersecurity ecosystems and to design more effective approaches for engaging individuals and organisations to reduce such risks.The project's overall aim is therefore to develop a framework through which we can analyse the behavioural co-evolution of cybersecurity/cybercrime ecosystems and effectively influence behaviours of a range of actors in the ecosystems in order to reduce human-related risks. To achieve the project's overall aim, this research will:(1) Be theory-informed: Incorporate theoretical concepts from social, evolutionary and behavioural sciences which provide insights into the co-evolutionary aspect of cybersecurity/cybercrime ecosystems. (2) Be evidence-based: Draw on extensive real-world data from different sources on behaviours of individuals and organisations within cybersecurity/cybercrime ecosystems. (3) Be user-centric: Develop a framework that can provide practical guidance to system designers on how to engage individual end users and organisations for reducing human-related cyber risks. (4) Be real world-facing: Conduct user studies in real-world use cases to validate the framework's effectiveness.The new framework and solutions it identifies will contribute towards enhanced safety online for many different kinds of users, whether these are from government, industry, the research community or the general public.This project will involve a group of researchers working in 5 academic disciplines (Computer Science, Crime Science, Business, Engineering, Behavioural Science) at 4 UK research institutes, and be supported by an Advisory Board with 12 international/UK researchers and a Stakeholder Group formed by 12 non-academic partners (including LEAs, NGOs and industry).

研究人员和从业者已经承认，与人类相关的风险是网络安全中最重要的因素之一。 IBM 报告（2014 年）显示，超过 95% 的安全事件涉及“人为错误”。对与人类相关的网络风险的反应仍然受到一个概念问题的影响：与“网络”犯罪一词相关的思维方式使我们相信，网络维度的犯罪纯粹发生在（非物理）“网络”空间内，并且这些犯罪构成了全新的犯罪形式，脱离了传统（物理）犯罪景观的人类/社会组成部分。在此背景下，个人和技术前所未有地连接到全球社会物理网络（超连接），产生了指数级的复杂性和漏洞的不可预测性。除了超连接之外，网络系统的动态演化性质也同样重要。网络系统的变化速度远远快于生物/物质文化，犯罪行为和技术的发展与以目标资产、工具和武器、日常活动、商业模式等为中心的机会性质的变化有关。研究超连接环境中个人、企业和组织之间的网络和关系需要了解社区和更广泛的生态系统。这种复杂的非线性过程可能会导致中长期的共同进化。将网络安全视为风险生态系统中人类与社会技术要素之间的动态互动，这会带来实施问题，例如如何动员不同的参与者支持安全。传统上，它们被视为“提高认识”，并且已经推出了许多举措。然而，针对整个社会的活动有其局限性，例如缺乏个性化，这使得它们在影响人类行为方面效率较低。虽然这些领域的研究都是孤立的，但没有一个整体框架将所有这些理论概念（共同进化、机会管理、行为和商业模式、网络风险和网络犯罪的临时技术研究）结合起来，以便更全面地了解网络安全生态系统中与人类相关的风险，并设计出更有效的方法来吸引个人和组织 因此，该项目的总体目标是开发一个框架，通过该框架我们可以分析网络安全/网络犯罪生态系统的行为共同演化，并有效影响生态系统中一系列参与者的行为，以减少与人类相关的风险。为了实现该项目的总体目标，本研究将：（1）以理论为基础：结合社会科学、进化科学和行为科学的理论概念，为网络安全/网络犯罪生态系统的共同进化提供见解。 (2) 以证据为基础：利用来自不同来源的关于网络安全/网络犯罪生态系统中个人和组织行为的广泛现实数据。 (3) 以用户为中心：开发一个框架，为系统设计者如何吸引个人最终用户和组织减少与人类相关的网络风险提供实用指导。 (4) 面向现实世界：在现实世界的用例中进行用户研究，以验证框架的有效性。它确定的新框架和解决方案将有助于增强许多不同类型用户的在线安全，无论这些用户是来自政府、行业、研究界还是普通公众。该项目将涉及一组在 4 个英国研究机构从事 5 个学科（计算机科学、犯罪科学、商业、工程、行为科学）的研究人员，并在 由 12 名国际/英国研究人员组成的顾问委员会和由 12 名非学术合作伙伴（包括 LEA、非政府组织和行业）组成的利益相关者小组提供支持。

项目成果

Are Donors Afraid of Core Costs? Economies of Scale and Contestability in Charity Markets*

捐助者是否害怕核心成本？

• DOI: 10.1093/ej/uez006
• 发表时间: 2019
• 期刊: The Economic Journal
• 作者: Perroni C

Consumer-Perceived Vulnerability, Privacy Calculus and Information Disclosure: An Empirical Investigation in Retailer Loyalty Program

消费者感知的脆弱性、隐私计算和信息披露：零售商忠诚度计划的实证研究

• 发表时间: 2017
• 作者: Dixon M

The Data Science of Hollywood: Using Emotional Arcs of Movies to Drive Business Model Innovation in Entertainment Industries

好莱坞的数据科学：利用电影的情感弧线推动娱乐行业的商业模式创新

• DOI: 10.48550/arxiv.1807.02221
• 发表时间: 2018
• 期刊: arXiv e-prints
• 作者: Del Vecchio Marco

THE PROBLEM WITH CRIME PROBLEM-SOLVING: TOWARDS A SECOND GENERATION POP?

• DOI: 10.1093/bjc/azz029
• 发表时间: 2020-01-01
• 期刊: BRITISH JOURNAL OF CRIMINOLOGY
• 影响因子: 2.6
• 作者: Borrion, Herve;Ekblom, Paul;Toubaline, Sonia
• 通讯作者: Toubaline, Sonia

Predictably Intransitive Preferences

可预测的不及物偏好

• 发表时间: 2018
• 期刊: Judgement and Decision Making
• 作者: Butler, D.