Joel Brynielsson

CYBER SITUATIONAL AWARENESS – A SYSTEMATIC REVIEW OF THE LITERATURE

Abstract Cyber situational awareness is attracting much attention. It features prominently in the national cyber strategies of many countries, and there is a considerable body of research dealing with it. However, until now, there has been no systematic and up-to-date review of the scientific literature on cyber situational awareness. This article presents a review of cyber situational awareness, based on systematic queries in four leading scientific databases. 102 articles were read, clustered, and are succinctly described in the paper. The findings are discussed from the perspective of both national cyber strategies and science, and some directions for future research are examined.

Harvesting and analysis of weak signals for detecting lone wolf terrorists

AbstractLone wolf terrorists pose a large threat to modern society. The current ability to identify and stop these kinds of terrorists before they commit a terror act is limited since they are hard to detect using traditional methods. However, these individuals often make use of Internet to spread their beliefs and opinions, and to obtain information and knowledge to plan an attack. Therefore there is a good possibility that they leave digital traces in the form of weak signals that can be gathered, fused, and analyzed.In this article we present an analysis method that can be used to analyze extremist forums to detect digital traces of possible lone wolf terrorists. This method is conceptually demonstrated using the FOI Impactorium fusion platform. We also present a number of different technologies which can be used to harvest and analyze pieces of information from Internet that may serve as weak digital traces that can be fused using the suggested analysis method in order to discover possible lone wolf terrorists.

Detecting Social Positions Using Simulation

Describing social positions and roles is an important topic within social network analysis. One approach is to compute a suitable equivalence relation on the nodes of the target network. One relation that is often used for this purpose is regular equivalence, or bisimulation, as it is known within the field of computer science. In this paper we consider a relation from computer science called simulation relation. Simulation creates a partial order on the set of actors in a network and we can use this order to identify actors that have characteristic properties. The simulation relation can also be used to compute simulation equivalence which is a less restrictive equivalence relation than regular equivalence but is still computable in polynomial time. This paper primarily considers weighted directed networks and we present definitions of both weighted simulation equivalence and weighted regular equivalence. Weighted networks can be used to model a number of network domains, including information flow, trust propagation, and communication channels. Many of these domains have applications within homeland security and in the military, where one wants to survey and elicit key roles within an organization. Identifying social positions can be difficult when the target organization lacks a formal structure or is partially hidden.

Estimating Citizen Alertness in Crises Using Social Media Monitoring and Analysis

The use of social media for communication and interaction is becoming more and more frequent, which is also the case during crises. To monitor social media may therefore be a useful capability from a crisis management perspective, both for detecting new or emergent crises, as well as for getting a better situation awareness of how people react to a particular crisis. The work presented in this paper is part of the EU research project Alert4All, having the overall goal of improving the effectiveness of alert and communication toward the population in crises.

Information awareness in command and control: precision, quality, utility

In current command and control system design, the concept of information plays a central role. In order to find architectures for situation and threat databases making full use of all dimensions of information, the concept of information awareness must be understood. We consider and define some information attributes: measures of precision, quality and usability, and suggest some uses of these concepts. The analysis is Bayesian. A critical point is where subjective Bayesian probabilities of decision makers meet the objective sensor related Bayesian assessments of the system. This interface must be designed to avoid credibility problems.

Analysis of Weak Signals for Detecting Lone Wolf Terrorists

Lone wolf terrorists pose a large threat to modern society. The current ability to identify and stop these kind of terrorists before they commit a terror act is limited since they are very hard to detect using traditional methods. However, these individuals often make use of Internet to spread their beliefs and opinions, and to obtain information and knowledge to plan an attack. Therefore, there is a good possibility that they leave digital traces in the form of weak signals that can be gathered, fused, and analyzed. In this work we present an analysis method that can be used to analyze extremist forums to profile possible lone wolf terrorists. This method is conceptually demonstrated using the FOI Impactorium fusion platform. We also present a number of different technologies that can be used to harvest and analyze information from Internet, serving as weak digital traces that can be fused using the suggested analysis method, in order to discover possible lone wolf terrorists.

Social positions and simulation relations

Describing social positions and roles is an important topic within the social network analysis. Identifying social positions can be difficult when the target organization lacks a formal structure or is partially hidden. One approach is to compute a suitable equivalence relation on the nodes of the target network. Several different equivalence relations can be used, all depending on what kind of social positions that are of interest.One relation that is often used for this purpose is regular equivalence, or bisimulation, as it is known within the field of computer science. In this paper we consider a relation from computer science called simulation relation. The simulation relation creates a partial order on the set of actors in a network and we can use this order to identify actors that have characteristic properties. The simulation relation can also be used to compute simulation equivalence which is a related but less restrictive equivalence relation than regular equivalence that is still computable in polynomial time.We tentatively term the equivalence classes determined by simulation equivalence social positions. Which equivalence relation that is interesting to consider depends on the problem at hand. We argue that it is necessary to consider several different equivalence relations for a given network, in order to understand it completely. This paper primarily considers weighted directed networks and we present definitions of both weighted simulation equivalence and weighted regular equivalence. Weighted networks can be used to model a number of network domains, including information flow, trust propagation, and communication channels. Many of these domains have applications within homeland security and in the military, where one wants to survey and elicit key roles within an organization. After social positions have been calculated, they can be used to produce abstractions of the network—smaller versions that retain some of the most important characteristics.

Information assurance education in two- and four-year institutions

The 2011 ITiCSE working group on information assurance (IA) education examined undergraduate curricula at the two- and four-year levels, both within and outside the United States (US). A broad set of two-year IA degree programs were examined in order to get a sense of similarities and differences between them. A broad set of four-year IA degree programs were also examined to explore their similarities and differences. A comparison between the two-year and fourfour-year degree programs revealed that the common challenge of articulation between two- and four-year programs exists in IA as well. The challenge of articulation was explored in some depth in order to understand what remedies might be available. Finally, a number of IA programs at international institutions were examined in order to gain insight into differences between US and non-US IA programs.

Learning to classify emotional content in crisis-related tweets

Social media is increasingly being used during crises. This makes it possible for crisis responders to collect and process crisis-related user generated content to allow for improved situational awareness. We describe a methodology for collecting a large number of relevant tweets and annotating them with emotional labels. This methodology has been used for creating a training data set consisting of manually annotated tweets from the Sandy hurricane. Those tweets have been utilized for building machine learning classifiers able to automatically classify new tweets. Results show that a support vector machine achieves the best results (60% accuracy on the multi-classification problem).

Emotion classification of social media posts for estimating people's reactions to communicated alert messages during crises

One of the key factors influencing how people react to and behave during a crisis is their digital or non-digital social network, and the information they receive through this network. Publicly available online social media sites make it possible for crisis management organizations to use some of these experiences as input for their decision-making. We describe a methodology for collecting a large number of relevant tweets and annotating them with emotional labels. This methodology has been used for creating a training dataset consisting of manually annotated tweets from the Sandy hurricane. Those tweets have been utilized for building machine learning classifiers able to automatically classify new tweets. Results show that a support vector machine achieves the best results with about 60% accuracy on the multi-classification problem. This classifier has been used as a basis for constructing a decision support tool where emotional trends are visualized. To evaluate the tool, it has been successfully integrated with a pan-European alerting system, and demonstrated as part of a crisis management concept during a public event involving relevant stakeholders.