Invited Talk Anomaly Detection and Social Interactions: A Social Informatics approach for Insider Threats － Abstract: Social informatics is the study of information and communication tools under different cultural and community contexts and how people interact with each other using those tools in computer-mediated environments. It concerns the design, uses and consequences of information technologies that take into account their interaction with different social contexts. These new forms of communication enable our social interactions being digitally analyzed real-time at a large scale, which poses both new challenges/concerns and opportunities to the community of cyber security. One potential area of development under social informatics is anomaly detection on social behavioral models for online users. For instance, social exchange theories developed in cultural anthropology, neoclassical economics, communication and psychology can be applied to analyze how power relations shape interaction between individuals, and ways to achieve balance in these relations. Various forms of social capitals, derived from social networks, might be considered as quantitative measures regarding common set of expectations, shared values, and a sense of trust among people connected in these networks. In this talk, a model of social interactive networks will be presented and, more importantly, we will discuss how this new model can be potentially applied to the context of anomaly detection for insider threats. - 4 - － Speaker: Prof. Shyhtsun Felix Wu (UC Davis, USA) Prof. S. Felix Wu has been doing “experimental” system research, i.e., building prototype systems to justify and validate novel architectural concepts. Since 1995, he and his students/postdocs have built many experimental systems in the areas of fault tolerant network, IPSec/VPN security policy, attack source tracing, wireless network security, intrusion detection and response, visual information analytics, and, more recently, future Internet design. An article titled "Networking: Four ways to reinvent the Internet" published in Nature 463 (February 3rd, 2010, by Katharine Gammon) provided a brief but very nice cover about his primary thought on a Social-network-based future Internet architecture (much more comprehensible than if he were to write it, actually). During the past couple years, he has been pretending (and hoping) to know a little bit more about humanity science so he can claim that he is working on multidisciplinary research. And, he strongly believes that thoroughly considering the factor of human relationships is necessary for any IT innovation. Therefore, his primary research objective, before he retires, is to help and contribute to the information technology advancement that would truly help our human society. As an initial step, he recently released the SINCERE (Social Interactive Networking and Conversation Entropy Ranking Engine, sponsored by NSF) search engine under http://www.sincere.se, which is trying to help our Internet society to discover "interesting/unusual" discussions. Felix received his BS from Tunghai University, Taiwan, in 1985, both MS and PhD from Columbia University in 1989 and 1995, all in Computer Science. He has about 110+ academic publications, which means that he should probably focus much more on the depth and quality. He is currently a Professor with the Computer Science department at UC Davis. - 5 - Panel Discussion Chairs and Panelists Panel Discussion Chair: Dr. William R. Claycomb (Carnegie Mellon University, USA) William R. Claycomb is the Lead Research Scientist for the CERT Enterprise Threat and Vulnerability Management program at Carnegie Mellon University’s Software Engineering Institute. His primary research topic is the insider threat; current work includes discovery of insider threat behavioral patterns and corresponding sociotechnical countermeasures. Dr. Claycomb is also involved in other efforts at CERT exploring cloud computing, incident response, systems modeling, and vulnerability analysis. Prior to joining CMU, he was a Member of Technical Staff at Sandia National Laboratories, focusing on enterprise systems security research, including insider threats, malware detection, and data protection. Bill is currently an adjunct faculty member at CMU’s Heinz College, teaching in the School of Information Systems and Management. Panelist: Prof. S. Felix Wu (UC Davis, USA) Prof. S. Felix Wu's short biography is given above. Panelist: Dr. Christian W. Probst (Technical University of Denmark) Dr. Christian W. Probst is an Associate Professor in the Department of Applied Mathematics and Computer Science at the Technical University of Denmark, where he works in the section for Language-Based Technologies. The motivation behind Christian’s research is to realize systems with guaranteed properties. An important aspect of his work are questions related to safety and security properties, most notably insider threats. He is the creator of ExASyM, the extendable, analysable system model, which supports the identification of insider threats in organisations. Christian has co-organized cross-disciplinary workshops on insider threats and has co-edited a book on the topic. - 6 - Panelist: Dr. Dongwan Shin (New Mexico Tech, USA) Dr. Dongwan Shin is an Associate Professor in the Computer Science and Engineering Department at New Mexico Tech. His research focuses on information and system security. He is the founding director of the Secure Computing Laboratory and faculty researcher at the Institute of Complex Additive Systems Analysis (ICASA) at New Mexico Tech. His research at Tech has been supported by NSF, DoD, Sandia Labs, Los Alamos Lab, Intel, VirtualBridge, and CAaNES. Dr. Shin received his Ph.D. in Information Technology from the University of North Carolina at Charlotte in 2004. - 7 - Program Overview Time October 24 (Thursday) Time October 25 (Friday) 09:00 ~ 17:00 Registration 09:00 ~ 16:00 Registration 09:00 ~ 10:30 MIST1: 4 presentations 09:00 ~ 10:30 MIST6: 4 presentations 10:30 ~ 10:50 Coffee Break 10:30 ~ 11:00 Coffee Break MIST2: 1 tutorial, 2 10:50 ~ 12:00 11:00 ~ 12:00 MIST7: 3 presentations presentations 12:00 ~ 13:30 Lunch 12:00 ~ 13:20 Lunch 13:30 ~ 14:30 MIST3: Invited Talk 13:20 ~ 15:00 MIST8: 5 presentations 14:30 ~ 15:00 Coffee Break 15:00 ~ 15:30 Coffee Break 15:00 ~ 16:30 MIST4: 4 presentations 15:30 ~ 17:30 MIST9: 6 presentations 16:30 ~ 17:00 Coffee Break 17:00 ~ 18:40 MIST5: Panel Discussion 19:00 ~ Banquet - 8 - MIST 2013 Program October 24th Thursday, 2013 09:00-17:30 Registration Desk Open 09:00-10:30 MIST1 - Managing Insider Threats 1 Session Chair: Dr. Ilsun You (Korean Bible Univ., Republic of Korea) Towards a Conceptual Model and Reasoning Structure for Insider Threat Detection P.A. Legg, N. Moffat, J.R.C. Nurse, J. Happa, I. Agrafiotis, M. Goldsmith, and S. Creese University of Oxford, UK Guidelines for the Prevention of Internal Improprieties in Japanese Organization Shigeyoshi Shima1 and Ayako Komatsu2 1NEC Corporation, Japan, and 2Information-Technology Promotion Agency, Japan Externalizing Behaviour for Analysing System Models Marieta Georgieva Ivanova1, Christian W. Probst1, René Rydhof Hansen2, and Florian Kammüller3 1Technical University of Denmark, and 2Aalborg University, Denmark 3Middlesex University, UK Towards Cognitive Cryptography Lidia Ogiela and Marek Ogiela AGH University of Science and Technology, Poland 10:30-10:50 Coffee Break 10:50-12:00 MIST2 - Managing Insider Threats 2 Session Chair: Prof. Kyung Hyune Rhee (Pukyong National Univ., Republic of Korea) A Brief Tutorial on Managing Insider Threats Dr. William Claycomb CERT® Insider Threat Center, Carnegie Mellon University, USA A Method For Characterizing Sociotechnical Events Related to Insider Threat William Claycomb and Carly Huth CERT® Insider Threat Center, Carnegie Mellon University, USA Reachability-based Impact as a Measure for Insiderness Christian W. Probst1 and René Rydhof Hansen2 1Technical University of Denmark and 2Aalborg University, Denmark 12:00-13:30 Lunch Break - 9 - 13:30-14:30 MIST3 - Invited Talk Session Chair: Prof. Fang-Yie Leu (Tunghai University, Taiwan) Anomaly Detection and Social Interactions:A Social Informatics approach for Insider Threats Prof. Felix Wu (UC Davis, USA) 14:30~15:00 Coffee Break 15:00-16:30 MIST4 - Related Technologies 1 Session Chair: Dr. Kangbin Yim (Soonchunhyang University, Republic of Korea) A Secure ECC-based Electronic Medical Record SystemKun-Lin Tsai, Kun-Lin Tsai, Fang-Yie Leu, Tien-Han Wu, Shin-shiuan Chiou, Yu-Wei Liu, and Han-Yun Liu Tunghai University, Taiwan Detection and prevention of LeNa Malware on Android Hwan-Taek Lee1, Minkyu Park2 and Seong-Je Cho1 1Dankook University, and 2Konkuk University, Republic of Korea Detecting of Web based DDoS Attack using MapReduce operations in Cloud Computing Environment Jun Ho Choi, Chang Choi, Byeong Kyu Ko, Dongjin Choi, and Pan Koo Kim Chosun University, Republic of Korea A New Logging-based IP Traceback Approach using Data Mining Techniques Ho-Seok Kang and Sung-Ryul Kim Konkuk University, South Korea 16:30-17:00 Coffee Break 17:00-18:40 MIST5 - Panel Discussion “Key Challenges in Defending Against Insider Threats” Session Chair: William R. Claycomb (Carnegie Mellon University, USA) Panelists: Prof. S. Felix Wu (UC Davis, USA) Dr. Christian W. Probst (Technical University of Denmark) Dr. Dongwan Shin (New Mexico Tech, USA) 19:00- MIST 2013 Banquet - 10 - October 25th Friday, 2013 09:00-16:00 Registration Desk Open 09:00-10:30