Exploring Emerging Hacker Assets and Key Hackers for Proactive Cyber Threat Intelligence

References

• Abbasi, A.; Li, W.; Benjamin, V.; Hu, S.; and Chen, H. Descriptive analytics: Investigating expert cybercriminals in web forums. In Proceedings of the IEEE Joint Intelligence and Security Informatics Conference. The Hague, The Netherlands: IEEE, 2014, pp. 55–63.
   Google Scholar
• Abbasi, A.; Zahedi, F.; Zeng, D.; Chen, Y.; Chen, H.; and Nunamaker, J.F. Enhancing predictive analytics for anti-phishing by exploiting website genre information. Journal of Management Information Systems, 31, 4 (2015), 109–157.
   Web of Science ®Google Scholar
• Ablon, L.; Libicki, M.C.; and Golay, A.A. Markets for cybercrime tools and stolen data: Hackers’ bazaar. Rand Corporation, 2014.
   Google Scholar
• Allamanis, M., and Sutton, C. Why, when, and what: Analyzing stack overflow questions by topic, type, and code. In Proceedings of the 10th Working Conference on Mining Software Repositories. San Francisco, CA: ACM, 2013, pp. 53–56.
   Google Scholar
• Bajaj, K.; Pattabiraman, K.; and Mesbah, A. Mining questions asked by web developers. In Proceedings of the 11th Working Conference on Mining Software Repositories. 112-121. Hyderabad, India: ACM, 2014, pp. 112–121.
   Google Scholar
• Baldi, P.F.; Lopes, C.V.; Linstead, E.J.; and Bajracharya, S.K. A theory of aspects as latent topics. ACM Sigplan Notices, 43, 10 (2008), 543–562.
   Google Scholar
• Barua, A.; Thomas, S.W.; and Hassan, A.E. What are developers talking about? An analysis of topics and trends in stack overflow. Empirical Software Engineering, 19, 3 (2014), 619–654.
   Web of Science ®Google Scholar
• Benjamin, V., and Chen, H. Securing cyberspace: Identifying key actors in cybercriminal communities. In Proceedings of the IEEE Joint Intelligence and Security Informatics Conference. Washington, DC: IEEE, 2012, pp. 24–29.
   Google Scholar
• Benjamin, V.; Zhang, B.; Nunamaker, J.F.; and Chen, H. Examining hacker participation length in cybercriminal Internet-relay-chat communities. Journal of Management Information Systems, 33, 2 (2016), 482–510.
   Web of Science ®Google Scholar
• Benjamin, V.; Li, W.; Holt, T.; and Chen, H. Exploring threats and vulnerabilities in hacker web: Forums, IRC and carding shops. In IEEE International Conference on Intelligence and Security Informatics. Baltimore, MD: IEEE, 2015, pp. 85–90.
   Google Scholar
• Blei, D.M.; Ng, A.Y.; and Jordan, M.I. Latent Dirichlet allocation. Journal of Machine Learning Research, 3, (2003), 993–1022.
   Web of Science ®Google Scholar
• Chen, H.; Chiang, R.H.; and Storey, V.C. Business intelligence and analytics: From big data to big impact. MIS Quarterly, 36, 4 (2012), 1165–1188.
   Web of Science ®Google Scholar
• Chen, T.H.; Thomas, S.W.; and Hassan, A.E. A survey on the use of topic models when mining software repositories. Empirical Software Engineering, 21, 5 (2015), 1–77.
   Google Scholar
• Chu, B.; Holt, T.; and Ahn, G. Examining the Creation, Distribution, and Function of Malware On-Line. Washington, DC: U.S. Department of Justice, National Criminal Justice Reference Service, 2010.
   Google Scholar
• Constantin, L. FBI bought exploit from hackers to access San Bernardino iPhone. Computerworld, 2016. Available at www.computerworld.com/article/3055486/security/fbi-bought-exploit-from-hackers-to-access-san-bernardino-iphone.html (accessed on May 17, 2016)
   Google Scholar
• Elkind, P. Sony Pictures: Inside the hack of the century. Fortune, 2015. Available at http://fortune.com/sony-hack-part-1/. (accessed on November 23, 2015)
   Google Scholar
• EY, Global Advisory Services. Cyber threat intelligence: How to get ahead of cybercrime. From the series: Insights on Governance, Risk, and Compliance. Ernst and Young, 2014. Available at www.ey.com/Publication/vwLUAssets/EY-cyber-threat-intelligence-how-to-get-ahead-of-cybercrime/$FILE/EY-cyber-threat-intelligence-how-to-get-ahead-of-cybercrime.pdf (accessed on March 17, 2016)
   Google Scholar
• Farnham, G. Tools and standards for cyber threat intelligence projects. SANS Institute, 2013. Available at www.sans.org/reading-room/whitepapers/warfare/tools-standards-cyber-threat-intelligence-projects-34375 (accessed on March 18, 2016)
   Google Scholar
• Faust, K. Centrality in affiliation networks. Social Networks, 19, 2 (1997), 157–191.
   Web of Science ®Google Scholar
• Goel, S. Cyberwarfare: Connecting the dots in cyber intelligence. Communications of the ACM, 54, 8 (2011), 132–140.
   Web of Science ®Google Scholar
• Grant, S.; Cordy, J.R.; and Skillicorn, D.B. Reverse engineering co-maintenance relationships using conceptual analysis of source code. In 18th Working Conference on Reverse Engineering. Limerick, Ireland: ACM, 2011, pp. 87–91.
   Google Scholar
• Granville, K. 9 Recent cyberattacks against big businesses. New York Times, February 5, 2015. Available at www.nytimes.com/interactive/2015/02/05/technology/recent-cyberattacks.html (accessed on March 15, 2016)
   Google Scholar
• HelpNetSecurity.com. January 2009 Threatscape: Keylogging and spam problems, surge in exploit activity. HelpNetSecurity.com, February 9, 2009. Available at www.helpnetsecurity.com/2009/02/09/january-2009-threatscape-keylogging-and-spam-problems-surge-in-exploit-activity/ (accessed on November 23, 2015)
   Google Scholar
• Higgins, K. SQL injection attacks haunt retailers. InformationWeek Dark Reading, 2014. Available at www.darkreading.com/sql-injection-attacks-haunt-retailers/d/d-id/1269576 (accessed on November 6, 2015)
   Google Scholar
• Holt, T.J.; Strumsky, D.; Smirnova, O.; and Kilger, M. Examining the social networks of malware writers and cybercriminals. International Journal of Cyber Criminology, 61, 1 (2012), 891–903.
   Google Scholar
• Holt, T.J. Examining the forces shaping cybercrime markets online. Social Science Computer Review, 31, 2 (2013), 165–177.
   Web of Science ®Google Scholar
• Keegan, B.; Gergle, D.; and Contractor, N. Do editors or articles drive collaboration? Multilevel statistical network analysis of Wikipedia coauthorship. In Proceedings of the ACM 2012 Conference on Computer Supported Cooperative Work. Seattle, WA: ACM, 2012, pp. 427–436.
   Google Scholar
• Kennedy, D.; O’Gorman, J.; Kearns, D.; and Aharoni, M. Metasploit: The Penetration Tester’s Guide. San Francisco, CA: No Starch Press, 2011.
   Google Scholar
• Kitten, T. Target malware: Exploring the origins. Bank Info Security, 2014. Available at www.bankinfosecurity.com/interviews/intelcrawler-i-2161 (accessed on December 1, 2014)
   Google Scholar
• Levine, M., and Date, J. 22 million affected by OPM hack, officials say. ABC, 2015. Available at http://abcnews.go.com/US/exclusive-25-million-affected-opm-hack-sources/story?id=32332731 (accessed on November 23, 2015)
   Google Scholar
• L’huillier, G.; Ríos, S.A.; Alvarez, H.; and Aguilera, F. Topic-based social network analysis for virtual communities of interests in the dark web. In ACM SIGKDD Workshop on Intelligence and Security Informatics. Beijing, China: ACM, 2010, p. 9.
   Google Scholar
• Li, W.; Chen, H.; and Nunamaker, J.F. Identifying and profiling key sellers in cyber carding community: AZSecure text mining system. Journal of Management Information Systems, 33, 4 (2016), 1059–1086.
   Web of Science ®Google Scholar
• Linares-Vásquez, M.; McMillan, C.; Poshyvanyk, D.; and Grechanik, M. On using machine learning to automatically classify software applications into domain categories. Empirical Software Engineering, 19, 3 (2014), 582–618.
   Web of Science ®Google Scholar
• Linares-Vásquez, M.; McMillan, C.; Poshyvanyk, D.; and Grechanik, M. On using machine learning to automatically classify software applications into domain categories. Empirical Software Engineering, 19, 3 (2014), 582–618.
   Web of Science ®Google Scholar
• Linstead, E.; Lopes, C.; and Baldi, P. An application of latent Dirichlet allocation to analyzing software evolution. In Seventh International Conference on Machine Learning and Applications. San Diego, CA: IEEE, 2008, pp. 813–818.
   Google Scholar
• Mahmood, A.M.; Siponen, M.; Straub, D.; Rao, H.R.; and Raghu, T.S. Moving toward black hat research in information systems security: An editorial introduction to the special issue. MIS Quarterly, 34 3 (2010), 431–433.
   Web of Science ®Google Scholar
• Maskeri, G.; Sarkar, S.; and Heafield, K. Mining business topics in source code using latent Dirichlet allocation. In Proceedings of the 1st India Software Engineering Conference. Hyderabad, India: ACM, 2008, pp. 113–120.
   Google Scholar
• McMillan, C.; Linares-Vasquez, M.; Poshyvanyk, D.; and Grechanik, M. Categorizing software applications for maintenance. In 27th IEEE International Conference on Software Maintenance. Williamsburg, VA: IEEE, 2011, pp. 343–352.
   Google Scholar
• McMillan, R. How the boy next door accidentally built a Syrian spy tool. Wired, February 2012. Available at www.wired.com/2012/07/dark-comet-syrian-spy-tool/ (accessed on November 23, 2015)
   Google Scholar
• Motoyama, M.; McCoy, D.; Levchenko, K.; Savage, S.; and Voelker, G. M. An analysis of underground forums. In Proceedings of the ACM SIGCOMM Conference on Internet Measurement Conference. Berlin, Germany: ACM,, 2011, pp. 71–80.
   Google Scholar
• National Science and Technology Council (NSTC). Trustworthy cyberspace: Strategic plan for the Federal Cybersecurity Research and Development Program. Report of the National Science and Tehcnology Council, Executive Office of the President, 2011, pp. 1–19.
   Google Scholar
• Nunamaker Jr., J.F.; Chen, M.; and Purdin, T.D.M. Systems development in information systems research. Journal of Management Information Systems, 7, 3 (1990), 89–106.
   Google Scholar
• Nunamaker Jr., J.F.; Briggs, R.; Derrick, D.; and Schwabe, G. The last research mile: Achieving both rigor and relevance in information systems research. Journal of Management Information Systems, 32, 3 (2015), 10–47.
   Web of Science ®Google Scholar
• Nunamaker J.F.; Twyman, N., Giboney, J.; and Briggs, R. Creating high-value real-world impact through systematic programs of research. MIS Quarterly, 41, 2 (2017), 335–351.
   Web of Science ®Google Scholar
• Otto on WordPress. How to find a backdoor in a hacked WordPress, 2009. Available at http://ottopress.com/2009/hacked-wordpress-backdoors/ (accessed on November 23, 2015)
   Google Scholar
• Peffers, K.; Tuunanen, T.; Rothenberger, M.A.; and Chatterjee, S. A design science research methodology for information systems research. Journal of Management Information Systems, 24, 3 (2007), 45–77.
   Web of Science ®Google Scholar
• Prat, N.; Comyn-Wattiau, N.; and Akoka, J. A taxonomy of evaluation methods for information systems artifacts. Journal of Management Information Systems, 32, 3 (2015), 229–267.
   Web of Science ®Google Scholar
• Radianti, J. A study of a social behavior inside the online black markets. In Proceedings of the International Conference on Emerging Security Information, Systems and Technologies. Nice, France: IEEE, 2010, pp. 88–92.
   Google Scholar
• Riley, M.; Elgin, B.; Lawrence, D.; and Matlack, C. Missed alarms and 40 million stolen credit card numbers: How Target blew it. Bloomberg, March 13, 2014. Available atwww.bloomberg.com/news/articles/2014-03-13/target-missed-warnings-in-epic-hack-of-credit-card-data (accessed on November 23, 2015)
   Google Scholar
• Rios, S.; Aguilera, F.; Bustos, F.; Omitola, T.; and Shadbolt, N. Leveraging social network analysis with topic models and the semantic web. In IEEE/WIC/ACM International Conference on Web Intelligence and Intelligent Agent Technology. 339-342. Lyon, France: IEEE, 2011, pp. 339–342.
   Google Scholar
• Samtani, S.; Chinn, R.; and Chen, H. Exploring hacker assets in underground forums. In IEEE International Conference on Intelligence and Security Informatics. Baltimore, MD: IEEE, 2015, pp. 31–36.
   Google Scholar
• Sandle, P., and Char, P. Cyber crime costs global economy $445 billion a year: Report. Reuters, June 9, 2014. Available at www.reuters.com/article/2014/06/09/us-cybersecurity-mcafee-csis idUSKBN0EK0SV20140609 (accessed on XXX)
   Google Scholar
• Savage, T.; Dit, B.; Gethers, M.; and Poshyvanyk, D. Topic XP: Exploring topics in source code using latent Dirichlet allocation. In IEEE International Conference on Software Maintenance. Timișoara, Romania: IEEE, 2010, pp. 1–6.
   Google Scholar
• Shackleford, D. Who’s using cyberthreat intelligence and how? SANS Institute, 2015. Available at www.sans.org/reading-room/whitepapers/analyst/cyberthreat-intelligence-how-35767. (accessed on March 18, 2016)
   Google Scholar
• Stewart, S.A., and Abidi, S.S.R. Applying social network analysis to understand the knowledge sharing behaviour of practitioners in a clinical online discussion forum. Journal of Medical Internet Research, 14, 6 (2012), e170.
   PubMed Web of Science ®Google Scholar
• Stuart, K. Lizard Squad is back: Group attacks Xbox Live and Daybreak Games. Guardian, February 16, 2015. Available at www.theguardian.com/technology/2015/feb/16/lizard-squad-attacks-xbox-live-daybreak-games (accessed on November 23, 2015)
   Google Scholar
• Symantec Corporation. Internet Security Threat Report, 2014.
   Google Scholar
• Tian, K.; Revelle, M.; and Poshyvanyk, D. Using latent Dirichlet allocation for automatic categorization of software. In 6th IEEE International Working Conference on Mining Software Repositories. Vancouver, Canada: IEEE,, 2009, pp. 163–166.
   Google Scholar
• Ugurel, S.; Krovetz, R.; and Giles, C.L. What’s the code? Automatic classification of source code archives. In Proceedings of the 8th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. Edmonton, July 23–25, 2002, pp. 632–638.
   Google Scholar
• Vijayan, J. New details of Home Depot attack reminiscent of Target’s breach. InformationWeek Dark Reading, 2014. Available atwww.darkreading.com/attacks- breaches/new-details-of-home-depot-attack-reminiscent-of-targets-breach/d/d-id/1317323 (accessed on November 23, 2015)
   Google Scholar
• Wang, T.; Wang, H.; Yin, G.; Ling, C.X.; Li, X.; and Zou, P. Mining software profile across multiple repositories for hierarchical categorization. In 29th IEEE International Conference on Software Maintenance. Eindhoven The Netherlands, 2013, pp. 240–249.
   Google Scholar
• Yip, M. An investigation into Chinese cybercrime and the applicability of social network analysis. In ACM Web Science Conference. Koblenz, Germany: IEEE, 2011, pp. 1–4.
   Google Scholar