Suspicious Behavior Research Articles

Toward a more dependable hybrid analysis of android malware using aspect-oriented programming

The growing threat to user privacy by Android applications (app) has tremendously increased the need for more reliable and accessible analysis techniques. This paper presents AspectDroid11A poster version of this paper appears in CODASPY 2016 (Ali-Gombe et al., 2016).—an offline app-level hybrid analysis system designed to investigate Android applications for possible unwanted activities. It leverages static bytecode instrumentation to weave in analysis routines into an existing application to provide efficient dataflow analysis, detection of resource abuse, and analytics of suspicious behaviors, which are then monitored dynamically at runtime. Unlike operating system or framework dependent approaches, AspectDroid does not require porting from one version of Android to another, nor does it depend on a particular Android runtime, making it a more adaptable and easier to use technique. We evaluate the strength of our dataflow algorithm on 105 apps from the DroidBench corpus, with experimental results demonstrating that AspectDroid can detect tagged data with 94.68% accuracy. Furthermore, we compare and contrast the behavioral patterns in 100 malware samples from the Drebin dataset (Arp et al., 2014) and 100 apps downloaded from Google Play. Our results showed more traces of sensitive data exfiltration, abuse of resources, as well as suspicious use of programming concepts like reflection, native code, and dynamic classes in the malware set than the Google Play apps. In terms of runtime overhead, our experiments indicate AspectDroid can comprehensively log relevant security concerns with an approximate overhead of 1 MB memory and a 5.9% average increase in CPU usage.

Theory of Mind and the Detection of Suspicious Behavior

Two studies examined whether deficits in theory of mind—the ability to understand and predict the intent, behaviors, and emotions of others—are related to slowness in recognizing that there is something suspicious about the way in which an interaction is unfolding. Participants listened to vignettes, some culminating in a crime, and indicated when they detected something suspicious about the situation unfolding in the scenario. Theory of mind was assessed using the Frith-Happe animations task, which requires the identification of mental states and emotions of pairs of interacting animated geometric stimuli ( White, Coniston, Rogers, & Frith, 2011 ). A meta-analysis of the studies found meaningful—albeit relatively weak—negative relationships between latency to react to cues to suspicious behavior and performance on the theory of mind measure. Ways to refine this novel paradigm that might sharpen the relationship between the key variables are discussed.

Supplemental Material for Theory of Mind and the Detection of Suspicious Behavior

Supplemental Material for Theory of Mind and the Detection of Suspicious Behavior

Communicating Risk

In a press conference on July 24, 2014, the director of the Norwegian Police Security Service (PST) and the Minister of Justice unexpectedly broke the news that Norway was facing an unspecific, but credible threat that terrorists from an “extreme Islamic group” would shortly attack the country. A national terror alert was issued for the first time, followed immediately by exceptional security measures, such as the arming of the usually unarmed police. In the anticipation of an attack, the public was for the first time involved in the counterterrorism efforts by being asked to be vigilant and to report any suspicious behavior. However, there was no attack on Norway, and the alert was called off a few days later without any explicit explanation. As part of the larger context of how risks and threats have been communicated in the past decades, this article describes the materialization of the event and discusses how the announcement and the content of the communications by the authorities were framed in the media coverage of it. Concretely, based on the concept of framing theory, the media coverage surrounding the announcement is considered, and the announcement is discussed via three identified frames emerging from the empirical data. These are discussed against the backdrop of the recent history of Norwegian counterterrorism practices, focusing on the effects and impacts of making such an announcement.

Detection of Covert and Suspicious DNS Behavior in Advanced Persistent Threats

Detection of Covert and Suspicious DNS Behavior in Advanced Persistent Threats

Testbed@TWISC: A network security experiment platform

SummaryAs the internet continues to grow in width and depth, its very architecture brings many challenges in network research. One significant issue is cybersecurity. Owing to the characteristics of network connectivity, malicious actions may cause losses during information exchanges in communication. Therefore, studying suspicious behaviors and covering potential exploits are necessary to protect networked computers. To determine possible threats, researchers need an experimental environment that enables them to explore and practice. A network emulation testbed provides such a platform to fulfill these purposes. This paper introduces Testbed@TWISC, a large‐scale network emulation testbed on Taiwan's research and education network that supported open research and cybersecurity education for almost 10 years. The paper reviews this testbed's origination, development, and operation experiences. Several findings and open issues of the testbed are also discussed. Readers who plan to build network security testbeds may find useful information in this paper for a case study.

Retributivism, Consequentialism, and the Risk of Punishing the Innocent: The Troublesome Case of Proxy Crimes

This paper discusses differences between two major schools in philosophy of criminal law, retributivism and consequentialism, with regard to the risk of (unintentionally) punishing the innocent. As it is argued, the main point of departure between these two camps in this respect lies in their attitude towards the high evidentiary threshold in a criminal trial: while retributivism seems to strongly support setting this standard high, consequentialists may find it desirable to relax it in some cases. This discussion is set in the context of proxy criminalization, i.e. a situation, in which some suspicious behaviour (i.e. behaviour that is only in some correlation with wrongful conduct, while not being substantially wrongful in itself) is criminalized. Since proxy criminalization may be understood as an effective lowering of the evidentiary threshold, its employment is justifiable from the consequentialist perspective, while being highly problematic for the retributivists.

Optional interactions and suspicious behaviour facilitates trustful cooperation in prisoners dilemma

In evolutionary game theory interactions between individuals are often assumed obligatory. However, in many real-life situations, individuals can decide to opt out of an interaction depending on the information they have about the opponent. We consider a simple evolutionary game theoretic model to study such a scenario, where at each encounter between two individuals the type of the opponent (cooperator/defector) is known with some probability, and where each individual either accepts or opts out of the interaction. If the type of the opponent is unknown, a trustful individual accepts the interaction, whereas a suspicious individual opts out of the interaction. If either of the two individuals opt out both individuals remain without an interaction. We show that in the prisoners dilemma optional interactions along with suspicious behaviour facilitates the emergence of trustful cooperation.

DAPASA: Detecting Android Piggybacked Apps Through Sensitive Subgraph Analysis

With the exponential growth of smartphone adoption, malware attacks on smartphones have resulted in serious threats to users, especially those on popular platforms, such as Android. Most Android malware is generated by piggybacking malicious payloads into benign applications (apps), which are called piggybacked apps. In this paper, we propose DAPASA, an approach to detect Android piggybacked apps through sensitive subgraph analysis. Two assumptions are established to reflect the different invocation patterns of sensitive APIs in the injected malicious payloads (rider) of a piggybacked app and in its host app (carrier). With these two assumptions, DAPASA generates a sensitive subgraph (SSG) to profile the most suspicious behavior of an app. Five features are constructed from SSG to depict the invocation patterns. The five features are fed into the machine learning algorithms to detect whether the app is piggybacked or benign. DAPASA is evaluated on a large real-world data set consisting of 2551 piggybacked apps and 44 921 popular benign apps. Extensive evaluation results demonstrate that the proposed approach exhibits an impressive detection performance compared with that of three baseline approaches even with only five numeric features. Furthermore, the proposed approach can complement permission-based approaches and API-based approaches with the combination of our five features from a new perspective of the invocation structure.

Effect of intelligence collection training on suspicious activity recognition by front line police officers

This study examines the impact of InCOP1 – Information Collection on Patrol, a training course that adopts a behavior-based approach to the identification of suspicious activities and behaviors, on information collection by front-line police officers. For this research, we developed a web-based instrument situational awareness assessment instrument to evaluate empirically the individual judgments of police officers drawn came from a cross-section of American state, county, and municipal law enforcement agencies who previously completed InCOP1 training compared with those of officers who did not participate in that training. Study participants employed an 11-point Likert type scale to assess a series of subject matter expert-generated scenarios that emulated a mix of non-suspicious behaviors, generic suspicious behaviors, traditional criminal behaviors and terrorism-centric activities. The results based on 3036 individual judgments indicate trainees had enhanced ability to recognize suspicious activity (more true positives) when compared with officers who did not participate in InCOP1 training. This finding is consistent with criminology studies that suggest training affects police decision making generally and situational awareness specifically.

Identifying Effective Signals to Predict Deleted and Suspended Accounts on Twitter Across Languages

Social networks have an ephemerality to them where accounts and messages are constantly being edited, deleted, or marked as private. This continuous change comes from concerns around privacy, a potential desire for to be forgotten and suspicious behavior. In this study we present a novel task – predicting suspicious e.g., to be deleted or suspended accounts in social media. We analyze multiple datasets of thousands of active, deleted and suspended Twitter accounts to produce a series of predictive representations for the removal or shutdown of an account. We selected these accounts from speakers of three languages – Russian, Spanish, and English to evaluate if speakers of various languages behave differently with regards to deleting accounts. We compared the predictive power of the state-of-the-art machine learning models to recurrent neutral networks trained on previously unexplored features. Furthermore, this work is the first to rely on image and affect signals in addition to language and network to predict deleted and suspended accounts in social media. We found that unlike widely used profile and network features, the discourse of deleted or suspended versus active accounts forms the basis for highly accurate account deletion and suspension prediction. More precisely, we observed that the presence of certain terms in tweets leads to a higher likelihood for that user’s account deletion or suspension. Moreover, despite image and affect signals yield lower predictive performance compared to language, they reveal interesting behavioral differences across speakers of different languages. Our extensive analysis and novel findings on language use and suspicious behavior of speakers of different languages can improve the existing approaches to credibility analysis, disinformation and deception detection in social media.

Female student athletes’ perceptions of acceptability and the occurrence of sexual-related behaviour by their coaches in India

ABSTRACTThe current study assessed the perceptions of acceptable sexual behaviour of coaches and the occurrence of sexual harassment among female student in India. A sample of 180 Indian female student-athletes at intercollegiate and inter-university levels with male coaches participated in this study. A questionnaire on sport-specific Touch and Behaviour versus Unwanted Intimacy from coaches (Vanden Auweele et al., 2008), consisting of 41 items on a 5-point rating scale was used. The participants were asked to indicate the acceptability of specific coaching behaviour as well as the occurrence of the behaviour represented in each item. The acceptability of the behaviour was determined by means and standard deviations, while the occurrence was determined by frequencies. Factor analysis was performed to determine the structure of the coaches’ behaviour and athletes’ acceptability thereof, which yielded four factors. Cronbach’s alpha was used to determine the internal consistency of the extracted items on each factor. Two factors, namely, unwanted sexual behaviour and inappropriate verbal and physical sexual behaviour, were regarded by athletes as very serious and unacceptable coach behaviour, while a third factor represented context-dependent suspicious behaviour (a grey area in which athletes differ in their opinion) and was perceived to be serious and unacceptable. A fourth factor represented acceptable behaviour. The occurrence of very serious and unacceptable behaviour was reported by 31% of the female athletes.

Discovering suspicious behavior in multilayer social networks

Discovering suspicious and illicit behavior in social networks is a significant problem in social network analysis. The patterns of interactions of suspicious users are quite different from their peers and can be identified by using anomaly detection techniques. The existing anomaly detection techniques on social networks focus on networks with only one type of interaction among the users. However, human interactions are inherently multiplex in nature with multiple types of relationships existing among the users, leading to the formation of multilayer social networks. In this paper, we investigate the problem of anomaly detection on multilayer social networks by combining the rich information available in multiple network layers. We propose a pioneer approach namely ADOMS (Anomaly Detection On Multilayer Social networks), an unsupervised, parameter-free, and network feature-based methodology, that automatically detects anomalous users in a multilayer social network and rank them according to their anomalousness. We consider the two well-known anomalous patterns of clique/near-clique and star/near-star anomalies in social networks, and users are ranked according to the degree of similarity of their neighborhoods in different layers to stars or cliques. Experimental results on several real-world multilayer network datasets demonstrate that our approach can effectively detect anomalous nodes in multilayer social networks.

Mining user Message Pattern for Suspicious Behavior on Terrorism using NLP in Social Networks with Single Sign-On

Objectives: To find an effective way to find Suspicious Behavior on Terrorism Using NLP in Social Networks with Single Sign-On in advance and prevent the massive destruction of life and property. Methods/Statistical Analysis: A survey has been made to understand the behavior of people using the social networking. Social networking has seen a massive growth for more than a decade and popular among people. So, taking this into consideration it aim at developing a monitoring system which continuously monitors user activity in the social network to find any suspicious activity regarding terrorism. Natural Language Processing Technique is used for analyzing the text data and Least Significant Bit algorithm is used for Steganographic images. Findings: In our research work, we have considered two social network sites - Gmail and Twitter. We work on real time dataset fetched from Gmail and Twitter. These social networks are continuously monitored for user behavior. The user data from Gmail inbox, sent items, tweets, sent and replied twitter messages are fetched and passed to Natural Language processing to extract the data patterns related to terrorism. Based on the threshold of terrorism related data, the user behavior would be classified as normal, little suspicious and offensive. It considers a single sign on of the user into social network. It has considered the user activity in two social networks to get a precise data. There are existing works analyzing on user sentiments, sarcasm, psychological effects, political, expert advice, and recommendations on user ratings. To my knowledge there is no work done on analyzing user data on more than one social network on text and image data to find their suspicious behavior on terrorism. Application/Improvements: In our application, we are using the real data set of the users from Gmail and Twitter account using single sign on. The work is to analyse both the users text information and image shared via Gmail to find the suspicious behavior on terrorism and categorize them to normal, little suspicious and offensive. This information can be shared with the investigation team, where they can take any precautionary action preventing the world from massive destruction of life and property.

Discovering Attackers Past Behavior to Generate Online Hyper-Alerts

To support information security, organizations deploy Intrusion Detection Systems (IDS) that monitor information systems and networks, generating alerts for every suspicious behavior. However, the huge amount of alerts that an IDS triggers and their low-level representation make the alerts analysis a challenging task. In this paper, we propose a new approach based on hierarchical clustering that supports intrusion alert analysis in two main steps. First, it correlates historical alerts to identify the most common strategies attackers have used. Then, it associates upcoming alerts in real time according to the strategies discovered in the first step. The experiments were performed using a real dataset from the University of Maryland. The results showed that the proposed approach could properly identify the attack strategy patterns from historical alerts, and organize the upcoming alerts into a smaller amount of meaningful hyper-alerts.

Toward Exposing Timing-Based Probing Attacks in Web Applications.

Web applications have become the foundation of many types of systems, ranging from cloud services to Internet of Things (IoT) systems. Due to the large amount of sensitive data processed by web applications, user privacy emerges as a major concern in web security. Existing protection mechanisms in modern browsers, e.g., the same origin policy, prevent the users’ browsing information on one website from being directly accessed by another website. However, web applications executed in the same browser share the same runtime environment. Such shared states provide side channels for malicious websites to indirectly figure out the information of other origins. Timing is a classic side channel and the root cause of many recent attacks, which rely on the variations in the time taken by the systems to process different inputs. In this paper, we propose an approach to expose the timing-based probing attacks in web applications. It monitors the browser behaviors and identifies anomalous timing behaviors to detect browser probing attacks. We have prototyped our system in the Google Chrome browser and evaluated the effectiveness of our approach by using known probing techniques. We have applied our approach on a large number of top Alexa sites and reported the suspicious behavior patterns with corresponding analysis results. Our theoretical analysis illustrates that the effectiveness of the timing-based probing attacks is dramatically limited by our approach.

A new method to detect deception in electronic banking using the algorithm bagging and behavior patterns abnormal users

Nowadays, large volumes of money transfers done in electronically channel and daily increasing grow in these services and transactions, on the one hand, and anonymity of offenders in the Internet on the other hand, encourage the fraudsters to enter to this field. One of the main obstacles in the use of internet banking is lack of security in transactions and some of abuses in the way of the financial exchanges. For this reason, prevent from unauthorized penetration and detection of crime is an important issue in financial institutions and banks. In the meantime, the necessity of applying fraud detection techniques in order to prevent from fraudulent activities in banking systems, especially electronic banking systems, is inevitable. In this paper, design and implementation system that recognizes suspicious and unusual behavior of bank users in the electronic banking systems. In this paper, we use data mining techniques to detect fraud in electronic banking. For this purpose, we use from a multi-stage hybrid method include: Clustering to separate customers and improve rankings and category for fraud detection. In the clustering method used from k center method and in the category method used from classification of C4.5 decision tree and also bagging's collective method of classification. Finally, the results indicate the high potential of the proposed method. The proposed method in compared with the previous method in the benchmark of accuracy 3.22 percent, in the benchmark of correctness 3.27 percent and in the benchmark of convocation 4.32 percent and in the benchmark of F1 3.81 been improved.

An Automated Surveillance System based on Multi-Processor System-on-Chip and Hardware Accelerator

The video surveillance, such as an example of security system presents one of the powerful techniques used in advanced systems. Manual vision which is used to analyze video in the traditional approach should be avoided. An automated surveillance system based on suspicious behavior presents a great challenge to developers. The detection is encountered by complexity and time-consuming process. An abnormal behavior could be identified by different ways: actions, face, trajectory, etc. The characteristics of an abnormal behavior still presents a great problem. This paper proposes a specific System On Chip architecture for surveillance system based on Multi-Processor (MPSOC) and hardware accelerator. The aim is to accelerate the processing and obtain a reliable and accelerated suspicious behavior recognition. Finally, the experiment section proves the opportunity of the proposed system in terms of performance and cost.

TRILLION project approach on scenarios definition for citizen security services

TRILLION project proposes an open, flexible, secure and resilient socio-technical platform to foster effective collaboration between citizens and law enforcement officers. Using the TRILLION platform, citizens will be able to report crimes, suspicious behaviour and incidents, identify hazards and assist law enforcement agents through active participation for achieving better urban security management. In the context of the preparation of scenarios that will serve the needs for enhanced citizen participation and improved citizen-LEA collaboration, our target is to propose a methodology towards a comprehensive definition of scenarios, accounting for all related aspects, such as technical, social, organisational and regulatory. A particular scenario from the project is used in order to demonstrate the application of the proposed methodology.

Uncovering Suspicious Activity From Partially Paired and Incomplete Multimodal Data

Multimodal data can be used to gain additional perspective on a phenomenon. For applications, such as security and the detection of suspicious activity, the need to aggregate and analyze data from multiple modes is vital. Recent research in suspicious behavior detection has introduced methods for identifying and scoring dense blocks in multivariate tensors, which are consistent indicators of suspicious activity. None yet, however, have proposed a method for the merging and analysis of multiple modes of data for suspicious behavior, especially when the set of items described in each data set do not match—that is, the data is partially paired—which is common when data sets originate from different sources. Neither has a method been described for dealing with the similar case of incomplete data. This paper introduces a technique for multimodal data analysis for suspicious activity detection when the data are only partially paired and/or incomplete. The method is applied to synthetic and real data, demonstrating strong precision and recall even in poorly paired cases.