Data-Mining Work Offers Insight into Detecting Multiple Hackers
Security efforts to combat hackers usually focus on one method of attack, but computer scientists at UT Dallas have developed a strategy more effective at tackling various types of attacks.
Dr. Murat Kantarcioglu, professor of computer science in the Erik Jonsson School of Engineering and Computer Science and director of the Data Security and Privacy Lab, and research scientist Dr. Yan Zhou have created a data-mining model that can identify various adversaries, or hackers.
Data mining, the process of analyzing big sets of data and organizing it into useful information, is used in all corners of industry, Kantarcioglu said.
“One area where adversaries commonly come into play is spam filtering,” he said. “In the early days, we would try to figure out whether an email was spam or legitimate by looking at the words contained within the body of the message. Adversaries, in this example, were anyone modifying emails to try and deceive the data-mining process.”
These adversaries come in an array of types. Some aim to send spam content to email users, while others want to clog networks by making the resource unavailable. Some spammers have the capability to modify spam and legitimate emails, while other have little to no access to such emails.
Kantarcioglu said it’s impossible to implement a filter that uses a single method to counter every possible type of spammer, motivating researchers to develop an “adversarial learning framework” that accounts for different types of hackers.
The team of researchers based its model on game theory principles, primarily for its resemblance to a two-player game. To tackle this particular challenge, they used a nested Stackelberg game framework, which is designed to handle both malicious data corruption and unknown types of adversaries.
He said that past work in the field has focused on developing data-mining models that are resilient against only one type of adversary. Computer scientists mimic adversarial behavior by looking at the end results, or the data extracted from a system. Researchers receive this input and determine whether they’re dealing with a malicious entity.
Kantarcioglu’s research presents a new, multitiered framework that simultaneously looks for adversarial data transformations and an optimal strategy to combat those changes. Zhou said these transformations are performed by the hacker to find the best way to modify data maliciously, allowing them to evade detection.
This mixed strategy is more reliable in situations when the data-mining applications are confronted by unknown adversaries.
Zhou said future applications of the research may expand the idea to include hackers working in tandem.
“In the current work, we assume the adversaries are independent of each other and their actions have no impact on each other’s decisions,” Zhou said. “In the future, we will consider problems where there are multiple collaborative adversaries.”
Their work received the Best Application Paper Award when it was presented last spring at the 20th Pacific Asia Conference on Knowledge Discovery and Data Mining. The research was recently published in the conference’s report, Advances in Knowledge Discovery and Data Mining
Source | UT Dallas News Center
Dr. Murat Kantarcioglu Discusses Cyber Security With Wallethub in a Recent Study About Which States are Most Vulnerable To Identity Theft And Fraud in 2016.
Via WalletHub.com – The holiday season is traditionally a time for celebration and togetherness. But it’s also an opportunity for identity thieves and hackers to prey on millions of innocent consumers. After all, the most high-profile data breaches, such as cases involving Target in 2013 and Home Depot the following year, tend to occur during periods of elevated shopping activity — the reason December was declared National Identity Theft Prevention and Awareness Month.
According to the Identity Theft Resource Center’s most recent Data Breach Report, 901 breaches with access to more than 34 million records have taken place thus far in 2016, and more are likely to be reported by the end of the year. Until 2015, identity theft was the top complaint received by the Federal Trade Commission for 15 consecutive years. And while more aggressive measures have been taken to improve the security of our personal information, criminal strategies constantly evolve and grow in sophistication, keeping consumers vulnerable to identity theft and fraud. Just howvulnerable, however, depends on the person’s state of residence.
In order to determine where Americans are most likely to be exposed to and affected by identity theft and fraud, WalletHub’s analysts compared the 50 states and the District of Columbia across six key indicators of susceptibility to such crimes, ranging from “identity-theft complaints per capita” to “average loss amount due to fraud.” Continue reading below for our findings, tips for protecting your personal information, expert commentary and a full description of our methodology.
Murat Kantarcioglu
Professor of Computer Science and Director of the Data Security and Privacy Lab at the University of Texas at Dallas
What can individuals do to guard against identity theft?
First of all, I would suggest limiting the information they disclose to third-party providers (i.e., check whether you really need to disclose the SSN for getting the service etc.) and only send this information in a secure manner (i.e., using encrypted https based services for online transactions).
In addition, some types of malware look for sensitive information such as tax forms stored on personal computers. To limit identity theft risk due to such malware, I suggest keeping such sensitive data on encrypted external hard drives (at least two copies for redundancy, and encryption for security if those hard drives are stolen as well).
Even after these precautions, the information can be still stolen (e.g., the health care insurance provider who has your info. can be hacked and your info can be stolen) and identity theft can occur. Therefore checking the credit report regularly to respond to identity theft situation immediately is important.
How should consumers choose among third-party providers offering services to protect their identity and personal data?
It is hard to distinguish between product and services. In my case, my credit card company provides FICO score info for free so I check that information regularly. In addition, I use annualcreditreport.com (free annual credit history check service) with different providers every couple of months to see whether anything is wrong in my credit report. For those who are the victims of an attack, services such as locking the credit check, etc. could be useful.
Should victims of identity theft be able to change their social security number? How can we make this number more difficult to steal and use (e.g., more digits, etc.)?
I think the main issue is that getting credit is too easy. I do not think adding more digits, etc. will help since longer digits could be easily copied as well. In addition, changing the social security number will destroy your past credit history. Instead, I believe that we should make it harder to misuse the social security information. For example, to get credit even in the online setting, we need to combine it with some offline processing (e.g., sending a copy of your application via mail and post office representative is checking an ID and photographing the applicant before application is mailed, etc.). Or sending mails to previous addresses of the applicant notifying them about the recent transactions.
Is the recent expansion of social media facilitating identity thefts?
Social media has lots of information about individuals and some information, such as birthdays, etc., required for identity theft could be easily gathered online. Therefore, I suggest individuals to put as little information about them online. For example, my birth date info on Facebook is wrong.
Should the Federal government intervene to establish a clear process for victims of identity theft looking to clear their name?
I had some friends who had gone through identity theft. It is really confusing and hard to clear your name. I think clear process should be established as soon as possible.
Continue reading the entire article complete with graphs and other expert profiles.
ABOUT THE UT DALLAS COMPUTER SCIENCE DEPARTMENT
The UT Dallas Computer Science program is one of the largest Computer Science departments in the United States with over 2,100 bachelor’s-degree students, more than 1,000 MS master’s students, 150 PhD students, and 86 faculty members, as of Fall 2016. With The University of Texas at Dallas’ unique history of starting as a graduate institution first, the CS Department is built on a legacy of valuing innovative research and providing advanced training for software engineers and computer scientists.