The Economics of Covert Community Detection and Hiding
نویسنده
چکیده
We present a model of surveillance based on the detection of community structure in social networks. We examine the extent of network topology information an adversary is required to gather in order to obtain high quality intelligence about community membership. We show that selective surveillance strategies can improve the adversary’s resource efficiency. However, the use of counter-surveillance defence strategies can significantly reduce the adversary’s capability. We analyze two adversary models drawn from contemporary computer security literature, and explore the dynamics of community detection and hiding in these settings. Our results show that in the absence of counter-surveillance moves, placing a mere 8% of the network under surveillance can uncover the community membership of as much as 50% of the network. Uncovering all community information with targeted selection requires half the surveillance budget where parties use anonymous channels to communicate. Finally, the most determined covert community can escape detection by adopting decentralized counter-surveillance techniques even while facing an adversary with full topology knowledge by investing in a small counter-surveillance budget, a rebel group can induce a steep increase in the false negative ratio.
منابع مشابه
The Economics of Community Detection and Hiding
We present a model of surveillance based on the detection of community structure in social networks. We examine the extent of network topology information an adversary is required to gather in order to obtain high quality intelligence about community membership. We show that selective surveillance strategies can improve the adversary’s resource efficiency. However, the use of counter-surveillan...
متن کاملCovert Network Detection
Network analysis has been a major research area over the last ten years, driven by interest in biological networks, cyber attacks, social networks, and criminal or terrorist organizations. This range of applications is illustrated in Figure 1. Detection of a covert community is most likely to be effective if the community exhibits high levels of connection activity. However, the covert networks...
متن کاملCovert Channel Analysis and Detection using Reverse Proxy Servers
Data hiding methods can be used by intruders to communicate over open data channels (Wolf 1989; McHugh 1995; deVivo, deVivo et al. 1999), and can be used to overcome firewalls, and most other forms of network intrusion detection systems. In fact, most detection systems can detect hidden data in the payload, but struggle to cope with data hidden in the IP and TCP packet headers, or in the sessio...
متن کاملCovert Channel Analysis and Detection with Reverse Proxy Servers using Microsoft Windows
Data hiding methods can be used by intruders to communicate over open data channels (Wolf 1989; McHugh 1995; deVivo, deVivo et al. 1999), and can be used to overcome firewalls, and most other forms of network intrusion detection systems. In fact, most detection systems can detect hidden data in the payload, but struggle to cope with data hidden in the IP and TCP packet headers, or in the sessio...
متن کاملOn a dynamic topology of covert groups
The problem of detecting hidden communities in large-scale networks has a long history in traffic analysis from secret societies evading detection to spy agencies datamining call record information looking for criminals. Graph theoretic partitioning is a well studied topic in both computer science and sociology. However, these methods are based on discovering communities by the narrow intuition...
متن کاملذخیره در منابع من
با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید
عنوان ژورنال:
دوره شماره
صفحات -
تاریخ انتشار 2008