Suspicious Behavior Research Articles

Exponential Squirrel Search Algorithm-Based Deep Classifier for Intrusion Detection in Cloud Computing with Big Data Assisted Spark Framework

Intrusion detection systems (IDS) are extensively employed for detecting suspicious behaviors in hosts. The ability of distributed IDS solutions makes it viable to combine and handle various kinds of sensors and generate alerts to different hosts positioned in distributed platforms. However, to offer secure and feasible services in a cloud platform is an imperative issue due to the impacts of attacks. This paper devises a novel IDS framework using cloud data to counter the influence of attacks. Here, the spark architecture is employed for discovering the intrusions. The pre-processing is applied to the input data for removing artifacts and noise considering input data. Thereafter, the feature extraction and feature fusion are performed in slave nodes. The feature fusion is carried out with the proposed Exponential Squirrel Search Algorithm (ExpSSA) algorithm. The fused features are considered in a deep-stacked autoencoder (Deep SAE) for performing effective intrusion detection. The proposed ExpSSA is adapted to train Deep SAE for tuning optimum weights. The exponential weighted moving average (EWMA) and squirrel search algorithm (SSA) are combined to create the proposed ExpSSA. The proposed ExpSSA-based Deep SAE offered improved performance compared to other techniques with the highest accuracy, detection rate of 0.846, and minimal FPR.

Intrusion Detection for Cyber-Physical Security System Using Long Short-Term Memory Model

In the present context, the deep learning approach is highly applicable for identifying cyber-attacks on intrusion detection systems (IDS) in cyber-physical security systems. As a key part of network security defense, cyber-attacks can change and penetrate the security of the network system, then, the role of an IDS is to detect suspicious behaviors and act appropriately to protect the network from the onset of attacks. Machine learning and deep learning techniques are important for current intrusion detection systems. However, traditional intrusion detection systems are far from being able to quickly and accurately identify complex and diverse network attacks and obtained low accuracy and detection rates, thus, these methods frequently fail to manage big amounts of data in a vast network infrastructure and utilize a lot of features leads to poor performance. For addressing these issues and improving the accuracy and scalability, in this paper, we have implemented the deep learning method based on a new approach multilayer long short-term memory (LSTM) model for detecting attacks on a network. The novelty of the proposed scheme is that the optimum multilayer architecture is built to achieve maximum accuracy in the network architecture in order to boost performance using stacking multiple layers of LSTM cells in a more effective manner, and better stability to perform consistently in both binary classification and multiclass classification on NSL-KDD datasets. Experimental tests with KDDTest + datasets show that the proposed multilayer LSTM model provides outstanding results with 95% and 96% accuracy, respectively, in binary and multiclass classification. In order to deal with actual datasets and obtain good performance in the network design, our optimum multilayer architecture must be put into practice in order to execute real-time applications. Therefore, the results are better and more robust than the existing state-of-the-art methods.

BBAC: Behavior-based access control to detect user suspicious behavior

One of the most significant issues in information security today is monitoring users’ behavior while accessing software resources. This paper proposes a new access control model based principally on user behavior as a sequence of events regarding the processes within the software. The proposed model consists of three main components. The first component analyses system logs for events triggered by each user’s access to the system. The second component provides a policy engine to determine the risk of permitting the subsequent access requested by the user. According to the access history, the third component, which reflects the user’s behavior and the existing policies, determines the level of risk of any subsequent access of the user and acts accordingly. To generate the policies in the detection engine, a behavior-based risk management cycle is presented by applying the Ordered Weighted Averaging method to determine and rank the behavior-based risks. For modeling the behaviors, the BIZAGI Studio tool is utilized, and also for investigating all possible conditions. Kaggle and two random datasets are used to evaluate the accuracy of the proposed method. The results show an increase in the accuracy of the proposed method compared to recent research. Applying the proposed method creates more precise access control and enhances information confidentiality.

PARANOID SCHIZOPHRENIA SECONDARY TO PHYSICAL AND EMOTIONAL ABUSE BY SPOUSE: A CASE REPORT

Schizophrenia, which is distinguished by psychotic symptoms and frequently leads to social and vocational decline, persists to be a challenge in terms of its aetiology and treatment. Physical and emotional abuse from the partner can lead to paranoid schizophrenia. Paranoid schizophrenia patient shows disturbed thought process due to several causative agents such as chemical and structural dysfunction and environmental influences. Further patient have poor insight, experience disorder of thought and have negative symptoms. A 32 year old female patient was brought to psychiatric department by her mother with the presenting complaints of acute symptoms which include delusion of percussion, delusion of reference, delusion of infidelity, auditory hallucination, suspicious behavior and restlessness. Prior to the current situation patient have taken I week of treatment and visit the psychiatrist for follow up. Clinical features and mental status examination met the criteria for paranoid schizophrenia and administration of antipsychotics to the patient. The client was under the observation for 1 week. The drug therapy was helpful to the client. The course of the disorder in the client was ‘episodic with stable deficit’. The symptoms of the client were reduced and she was stable.

MIDAS: Safeguarding IoT Devices Against Malware via Real-Time Behavior Auditing

The number of IoT devices on the Internet has surged recently, accompanied by a barrage of large-scale IoT malware infections breakouts. Designing security mechanisms for IoT devices poses significant challenges due to constantly changing malware variants that have numerous camouflage strategies, limited hardware resources, and heterogeneous architectures. In this article, we propose MIDAS, an adaptive safeguard framework for Linux-based IoT devices to defend against malwares with the real-time behavior auditing mechanism. First, we construct a stable and abstract behavior paradigm through behavioral characteristic extraction of 115 970 malwares. Then, based on the behavior paradigm, MIDAS can: 1) monitor suspicious behaviors of break-in programs in real-time driven by our built-in SELinux policy customized for malware defense; 2) aggregate behaviors of the program’s submodules with homology tracing; and 3) summarize these behaviors into abstract behavior pairs to unveil a possible IoT malware. Using the aforementioned real-time behavior auditing, MIDAS can constrain mutating and camouflaged malwares to protect discrepant IoT devices from being compromised while maintaining low overheads. We thoroughly evaluated the defense capabilities of MIDAS. On the benchmark dataset, MIDAS successfully constrained up to 94.46%, 91.79%, and 88.34% of 115970 malware samples on ARM, MIPS, and MIPSEL architectures, with less than 1.8 MiB of memory consumption and 0.54% CPU usage. Furthermore, we deployed virtual IoT devices worldwide to examine the performance of MIDAS when defending against real-world attacks. Over a duration of 25 days, these devices suffered from 971 951 attacks originating from 71 979 intruding malwares and 48 805 unique IPs distributed in 167 countries. For devices with MIDAS protection, the number of compromised incidents decreases by <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$343.1\times $ </tex-math></inline-formula> , and the duration of continuous operation is <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$179.2\times $ </tex-math></inline-formula> greater than devices without MIDAS on average. The evaluation results demonstrate that MIDAS can effectively safeguard IoT devices with minimal resource consumption.

Detecting dodgy behaviour: The role of autism, autistic traits and theory of mind.

Difficulties in reading others' minds make it difficult to anticipate their future behaviour. It has often been argued that such difficulties contribute to autistic individuals becoming enmeshed in criminal activity. However, supportive scientific evidence is virtually non-existent. We compared the ability of groups of autistic and non-autistic adults of similar intellectual ability to detect dodgy or suspicious behaviour across a wide range of scenarios. Although the autistic group performed more poorly than the non-autistic group on an established measure of mindreading, there were no group differences in the ability to detect dodginess. Nor did we find any evidence that detecting dodgy behaviour was associated with the degree of autistic traits reported by individual participants. However, when we combined the two groups, difficulty reading the minds of others was indeed associated with poorer detection of dodginess, thus highlighting a characteristic of individuals that may well increase the likelihood of becoming involved in crime or exploited for autistic and non-autistic individuals alike.

COMMUNITY ORIENTED POLICING AND PREVENTION OF TRANSNATIONAL CRIMES IN RWANDA: A CASE OF RUBAVU DISTRICT

The research project was conducted in Rubavu District under the topic of assessment of community oriented policing and homeland security in Rwanda, case study of Rubavu District. The general objectives the contribution of community oriented policing strategies on home Land security in Rubavu District. Specifically, the researcher assessed the to establish the contribution of community partnership on home land security in Rubavu District, to assess the contribution of training on home land security in Rubavu District and to find out the relationship between Decentralize decision making and home land security in Rubavu District. The research project employed a descriptive research design with a mixed approach including qualitative and quantitative with respondents of 100 participants. The analysis was done with IBM SPSS version 21.0. The questionnaire was the primary method of data collection. The results were presented in Tables. The findings demonstrated that males dominated the socio-demographic of respondents from Rubavu District; about age, the majority was in the range of adult’s persons between 36-65 years dominated the age, the majority of respondents was married. About education level of respondents, the majority of respondent has finished secondary school (A2) and. regarding the occupation, the majority is public servants. Regarding community partnership on homeland security in Rubavu District, the findings shown that there is effective collaboration with community night patrol to fight crimes (41%). The communities work with community security committee for problem solving (45%). The citizens of Rubavu District provide willingly, timely information to community security (39%). Furthermore, the population of Rubavu District willingly contributes to ensure homeland safety services in partnership with the private security companies (47%). Regarding community training on home land security in Rubavu, the findings indicated that community security committee willingly contributes to solve problem of security due to the training given (43%) to contribute on homeland security in Rubavu district. Particular training on community policing contribute to prevention of crimes and problem solving (41%), The officers willingly provide the training on engagement of community problem solving (49%) that training contribute to homeland security in Rubavu District and Private security companies contribute in the training of communities on measures of crimes prevention (32%) that training contribute to homeland security in Rubavu District. Regarding relationship between decentralize decision making and home land security in Rubavu District, the findings indicated that District security committee willingly be flexible to make decision when community-policing committee decided (45%). The local community Security Council willingly made decision about community security and approved (37%). Furthermore, the local communities decision about crimes and miss behavior is approved by district security council (36%) and the local community security committee and private security companies reporting suspicious behaviour to district security council(37%). The model summary results indicated that the independent variables explained 85.2 percent of the variation in community oriented policing strategies on home Land security in Rubavu District, as measured by an adjusted R2 of 85.2 percent, while other variables outside the model and the error term explained 4.8 percent. The correlation results indicated that there is high significant correlation between community partnership and community training with Pearson correlation equal to 0.265±0.001. The same way there is a correlation between community partnership and decentralization (decentralize decision-making) (0.513±0.000). There is a positive correlation between community training and decentralize decision-making (0.431±0.000). The researcher found that there was the contribution of community oriented policing strategies on home Land security in Rubavu District. In additional, a research recommended to mobilize more the youth to be involved in Security Council committee. For more enhancing to the Vigilantes to be given basic training on conduct of their operations and information management. Moreover, the local authorities should do the needful and sensitize the people on the need for homeland security if they are to participate in it fully.&#x0D;

Early Detection of Suspicious Behaviors for Safe Residence from Movement Trajectory Data

Early detection of people’s suspicious behaviors can aid in the prevention of crimes and make the community safer. Existing methods that are focused on identifying abnormal behaviors from video surveillance that are based on computer vision, which are more suitable for detecting ongoing behaviors. While criminals intend to avoid abnormal behaviors under surveillance, their suspicious behaviors prior to crimes will be unconsciously reflected in the trajectories. Herein, we characterize several suspicious behaviors from unusual movement patterns, unusual behaviors, and unusual gatherings of people, and analyze their features that are hidden in the trajectory data. Meanwhile, the algorithms for suspicious behavior detection are proposed based on the main features of the corresponding behavior, which employ spatiotemporal clustering, semantic annotation, outlier detection, and other methods. A practical trajectory dataset (i.e., TucityLife) containing more than 1000 suspicious behaviors was collected, and experiments were conducted to verify the effectiveness of the proposed method. The results indicate that the proposed method for suspicious behavior detection has a recall of 93.5% and a precision of 87.6%, demonstrating its excellent performance in identifying the possible offenders and potential target places. The proposed methods are valuable for preventing city crime and supporting the appropriate allocation of police resources.

A Hybrid Machine Learning Based Feature Selection Technique for Attack Detection in NIDS

Network security has arisen as a critical investigation area in the last period as the internet and communiqué technologies have grown in popularity. The network is protected by firewalls, antivirus software, and intrusion detection systems (IDS) and its related assets in a cyberspace against unauthorised access. These include a network-based intrusion detection system (NIDS) that constantly screens network traffic for hostile and suspicious behaviour in order to ensure the confidentiality, integrity, and availability of the data being transmitted over the Internet. However, researchers have made huge efforts to improve detection accuracy while decreasing False Alarm Rates (FAR) and to detect novel incursions, but they still confront difficulties. There has been an increase in the use of IDS systems based on machine learning and deep learning (ML and DL) in recent years. The study’s main goal is to detect attacks using a hybrid ML technique, and essential traits are identified via the Crow Search Algorithm (CSA). In order to improve classification accuracy, the decision tree is mapped to the Extreme Learning Machine (ELM). The decision tree selects features that are good at classifying. Additional weights for the selected features are calculated to improve their categorization accuracy. On the KDDCup dataset, the experiment is carried out in terms of a variety of parameter metrics.

A New Network Digital Forensics Approach for Internet of Things Environment Based on Binary Owl Optimizer

Abstract The Internet of Things (IoT) is widespread in our lives these days (e.g., Smart homes, smart cities, etc.). Despite its significant role in providing automatic real-time services to users, these devices are highly vulnerable due to their design simplicity and limitations regarding power, CPU, and memory. Tracing network traffic and investigating its behavior helps in building a digital forensics framework to secure IoT networks. This paper proposes a new Network Digital Forensics approach called (NDF IoT). The proposed approach uses the Owl optimizer for selecting the best subset of features that help in identifying suspicious behavior in such environments. The NDF IoT approach is evaluated using the Bot IoT UNSW dataset in terms of detection rate, false alarms, accuracy, and f-score. The approach being proposed has achieved 100% detection rate and 99.3% f-score and outperforms related works that used the same dataset while reducing the number of features to three features only.

DL-FHMC: Deep Learning-Based Fine-Grained Hierarchical Learning Approach for Robust Malware Classification

The acceptance of the Internet of Things (IoT) for both household and industrial applications is accompanied by the rapid growth of IoT malware. With the increase of their attack surface, analyzing, understanding, and detecting IoT malicious behavior are crucial. Traditionally, machine and deep learning-based approaches are used for malware detection and behavioral understanding. However, recent research has shown the susceptibility of those approaches to adversarial attacks by introducing noise to the feature space. In this work, we introduce DL-FHMC, a fine-grained hierarchical learning approach for robust IoT malware detection. DL-FHMC utilizes Control Flow Graph (CFG)-based behavioral patterns for adversarial IoT malicious software detection. In particular, we extract a comprehensive list of behavioral patterns from a large dataset of malicious IoT binaries, represented by the shared execution flows, and use them as a modality for malicious behavior detection. Leveraging machine learning and subgraph isomorphism matching algorithms, DL-FHMC provides state-of-the-art performance in detecting malware samples and adversarial examples (AEs). We first highlight the caveats of CFG-based IoT malware detection systems, showing the adversarial capabilities in generating practical functionality-preserving AEs with reduced overhead using Graph Embedding and Augmentation (GEA) techniques. We then introduce Suspicious Behavior Detector, a component that extracts comprehensive behavioral patterns from three popular IoT malicious families, Gafgyt, Mirai, and Tsunami, for AEs detection with high accuracy. The proposed detector operates as a model-independent standalone module, with no prior assumptions of the adversarial attacks nor their configurations.

Primary melanoma of submandibular gland: case report and literature review of a very rare entity

BackgroundCutaneous melanomas account for more than 95% of all cases of primary melanoma, making non-cutaneous primary melanomas truly rare. Cases of primary mucosal melanomas of the oral cavity have been widely described; however, instances of primary melanomas arising from salivary glands have been rarely described. To date, this is only the second case of primary melanoma of the submandibular gland.Case presentationThis is a report of a case of a 36-year-old healthy male patient, who was referred to us with the chief complaint of a growing swelling on the left side of his lower jaw. Evaluations revealed an evident facial asymmetry in the frontal view with a firm, non-tender swelling. Initial orthopantomogram did not reveal any alterations in the trabeculation or morphology of the jaws and the surrounding structures. A soft tissue ultrasonography of the left submandibular gland and anterior region of mandible revealed a hypoechoic cystic mass with numerous micro-echoes. Further para-clinical examinations yielded the definitive diagnosis of primary melanoma of the submandibular gland. Moreover, no evidence of distant osteometastasis was observed in whole-body scans. Subsequent surgical management with the approach of excising the submandibular salivary gland and concurrent selective neck dissection was implemented.ConclusionsThis report emphasizes the importance of thorough examination and prompt referral to designated specialists in cases with suspicious behaviors which are unresponsive to treatments. It can be further concluded that melanoma can mimic a range of benign pathologies; therefore, putting it in the list differential diagnosis of similar lesions seems plausible.

Advanced Feature-Selection-Based Hybrid Ensemble Learning Algorithms for Network Intrusion Detection Systems

As cyber-attacks become remarkably sophisticated, effective Intrusion Detection Systems (IDSs) are needed to monitor computer resources and to provide alerts regarding unusual or suspicious behavior. Despite using several machine learning (ML) and data mining methods to achieve high effectiveness, these systems have not proven ideal. Current intrusion detection algorithms suffer from high dimensionality, redundancy, meaningless data, high error rate, false alarm rate, and false-negative rate. This paper proposes a novel Ensemble Learning (EL) algorithm-based network IDS model. The efficient feature selection is attained via a hybrid of Correlation Feature Selection coupled with Forest Panelized Attributes (CFS–FPA). The improved intrusion detection involves exploiting AdaBoosting and bagging ensemble learning algorithms to modify four classifiers: Support Vector Machine, Random Forest, Naïve Bayes, and K-Nearest Neighbor. These four enhanced classifiers have been applied first as AdaBoosting and then as bagging, using the aggregation technique through the voting average technique. To provide better benchmarking, both binary and multi-class classification forms are used to evaluate the model. The experimental results of applying the model to CICIDS2017 dataset achieved promising results of 99.7%accuracy, a 0.053 false-negative rate, and a 0.004 false alarm rate. This system will be effective for information technology-based organizations, as it is expected to provide a high level of symmetry between information security and detection of attacks and malicious intrusion.

How Twitter data sampling biases U.S. voter behavior characterizations.

Online social media are key platforms for the public to discuss political issues. As a result, researchers have used data from these platforms to analyze public opinions and forecast election results. The literature has shown that due to inauthentic actors such as malicious social bots and trolls, not every message is a genuine expression from a legitimate user. However, the prevalence of inauthentic activities in social data streams is still unclear, making it difficult to gauge biases of analyses based on such data. In this article, we aim to close this gap using Twitter data from the 2018 U.S. midterm elections. We propose an efficient and low-cost method to identify voters on Twitter and systematically compare their behaviors with different random samples of accounts. We find that some accounts flood the public data stream with political content, drowning the voice of the majority of voters. As a result, these hyperactive accounts are over-represented in volume samples. Hyperactive accounts are more likely to exhibit various suspicious behaviors and to share low-credibility information compared to likely voters. Our work provides insights into biased voter characterizations when using social media data to analyze political issues.

ATOVis – A visualisation tool for the detection of financial fraud

Fraud detection is related to the suppression of possible financial losses for institutions and their clients. It is a task of high responsibility and, therefore, an important phase of the decision-making chain. Nowadays, experts in charge base their analysis on tabular data, usually presented in spreadsheets and seldom supplemented with simple visualisations. However, this type of inspection is laborious, time-consuming, and may be of little use for the analysis and overview of complex transactional data. To aid in the inspection of fraudulent activities, we develop ATOVis – a visualisation tool that enables a fast analysis and detection of suspicious behaviours. We aim to ease and accelerate fraud detection by providing an overview of specific patterns within the data, and enabling details on demand. ATOVis focuses on applying visualisation techniques to the Finance domain, specifically e-commerce, contributing to the state-of-the-art as the first visualisation tool primarily specialised in Account Takeover (ATO) patterns. In particular, the present paper incorporates: a task abstraction for detecting a specific financial fraud pattern – ATO; two models for the visualisation of ATO; and a multiscale timeline to enable an overview of the data. We also validate our tool through user testing, with experts in fraud detection and experts from other fields of data science. Based on the feedback provided by the analysts, we could conclude that ATOVis is an efficient and effective tool in detecting specific patterns of fraud which can improve the analysts’ work.

Apparatuses of Denunciation, Neoliberal Governmental Rationality, and the Potential for a Fascist Turn

Abstract This article explores the sociopolitical causes behind the proliferation of the apparatuses of denunciation in Turkey in the 2010s, and the escalation in the number of citizens denouncing their fellow citizens. These developments have taken place within an international context marked with the initiation of similar campaigns in core capitalist countries (e.g., the United States, United Kingdom) in the post-9/11 period mobilizing citizens to watch for suspicious behaviors that potentially signify “terrorist” activities. In Turkey, the Communication Center for the Office of the President, police hotlines/websites, community policing networks, neighborhood heads, the night-guard system, and legal statutes enabling denunciation are parts of these apparatuses. The article argues that the mechanisms of denunciation surfaced as part of the “security states” that emerged in the late 1990s under the dominance of neoliberal governmental rationality that encompasses components creating a fertile sociopolitical fabric both for the materialization of fascist tendencies and a preference for denunciation as a governmental technology. Accordingly, the apparatuses of denunciation in Turkey emerged at a point where the “security state” constructed by the Justice and Development Party government in its second term (2007–11) delivered a fascist turn within the context of the 2008 global financial crisis.

EICIDS-Elastic and Internal Cloud-based Intrusion Detection System

The elasticity and abundant availability of computational resources are attractive to intruders exploit vulnerabilities of the cloud, thus being able to launch attacks against legitimate users to gain access to private and privileged information. The Intrusion Detection Systems are presented as a possible solution for protection; however, to effectively protect cloud users, it must have the ability to expand, rapidly increased or decreased the amount of sensors, according to the provisioning resources, and isolate the access to infrastructure and system levels. Protection against internal threats should also be planned, as most of the protection systems do not identify them properly. In order to solve these problems, we present the EICIDS - Elastic and Internal Cloud-based Intrusion Detection System, which monitors the internal environment of the cloud, entering sensor data capture in the local network of user´s VMs, thus being able to detect suspicious behavior of users. For this, the EICIDS uses the characteristics of virtual machines (such as fast boot, quick recovery, stop, migrate between different hosts and execution across multiple platforms) in order to monitor and protect the environment of cloud computing, with the growth or reduction of the cloud in order to save resources.

A Secure Communication and Access Control Scheme for Native Libraries of Android Applications

The Android system cannot perform fine-grained permission management for TPLs (third-party libraries) in applications. TPLs can use all permissions of the host application, which poses a threat to users and system security. In order to solve this problem, this paper studies the underlying principles of multiple modules in the framework and kernel layers of the Android system. We construct a fine-grained access control scheme for native libraries through technologies such as isolation environment creation, remote function call, and dynamic permission management. We also implement the prototype system. The experimental results show that our proposed scheme can effectively assist developers in managing the permissions of the native libraries in a fine-grained manner and curb the suspicious privileged behaviors of the native libraries. Meanwhile, our proposed scheme is adaptable for high-version Android systems with reasonable overhead, and it will not break the current Android security mechanisms.

Studying while Muslim: anti-discrimination law, countering violent extremism, and suspect youth

ABSTRACT As part of the global War on Terror, governments, including in Australia, have increasingly encouraged teachers to spot students ‘at risk’ of radicalisation, thereby turning schools into sites of surveillance. Despite their important intended goal, these programs have been criticised for leading to over-reporting, misinterpretation, and the stigmatisation of Muslim students who have been disproportionately affected by such surveillance practices. In a climate of Islamophobic suspicion that constructs Muslims as ‘potential terrorists’, such outcomes are not surprising, leaving young Muslims vulnerable to discrimination and stereotyping. This article provides a critical reading of Complainant 201822 v Australian Capital Territory (Represented by the Education Directorate) concerning a young Muslim student who was wrongly reported by his school to public authorities due to his supposedly suspicious behaviour. Using the decision as a case study, the article discusses how young Australian Muslims have been caught in a vicious cycle in which anti-terror laws, policing, and surveillance foster their stereotyping as ‘potential terrorists’. At the same time, the decision illustrates how the law offers little protection against the significant harms caused by this manifestation of systemic Islamophobia.

“Reason to know” in the international law of command responsibility

AbstractA recent report by the Australian Defence Force arrived at a conclusion that further investigation was not warranted of commanders regarding their responsibility for failing to investigate suspicious behaviour of subordinates in Afghanistan, who were accused of violations of international humanitarian law. This troubling conclusion calls for a better analysis and understanding of command responsibility in international law and gaps in the law of command responsibility. This article identifies the conflicting precedents and scholarship regarding the law of command responsibility, which create uncertainty, and proposes a clarification of that law, with a special focus on the “reason to know” standard that triggers responsibility for failing to prevent or punish war crimes. It refutes the popular claim that commanders must act wilfully, and it rejects the common dichotomy between a commander who orders or otherwise directly participates in the war crimes of subordinates and one who unwittingly fails to prevent or punish such crimes. Using the empirical psychological literature, the article further explains how commanders can insidiously signal toleration of war crimes without giving direct orders. Finally, the article argues that international law, by absolving commanders who fail to properly train their subordinates to respect the law of armed conflict, misses a rare opportunity to deter war crimes, and offers some suggestions to fill this gap in the law.