40 likes | 233 Views
1 st International Workshop Social Computing, Behavioral Modeling & Prediction 2008. Attribution-based Anomaly Detection: Trustworthiness in an Online Community. Shuyuan Mary Ho i School, Syracuse University http://web.syr.edu/~smho/. Problem Statement. Insider Threats
E N D
1st International Workshop Social Computing, Behavioral Modeling & Prediction 2008 Attribution-based Anomaly Detection: Trustworthiness in an Online Community Shuyuan Mary Ho iSchool, Syracuse University http://web.syr.edu/~smho/
Problem Statement Insider Threats • refers to situations where a critical member of an organization behaves in a way that is against the interests of the organization, generally in an illegal and/or unethical manner. Org. communications Observation/attribution Organizational Norm Intention Social Network Information Behavior Trustworthiness meaning attribute (assign) B1 Borg But, the real problem lies in A’s integrity (characteristics) contaminated by either internal or external factors B2 A B3 B’s expectation of A’s ability/competence as a result of observing A’s behavior in org. communications over time Unknown A’s social network Bn Conceptual Framework Behavioral Anomaly Detection
What is Trustworthiness? • A quality, disposition or characteristics of a person, influenced by intention • Defined as: • the generalized expectancy, a subjective probability, toward a target employee’s degree of correspondence between communicated intentions and behavioral outcomes that are observed and evaluated over time (Rotter, 1980 & 1967). • In other words, the degree to which the relationship between the target’s words and actions remain reliable, ethical and consistent, and any fluctuation in this relationship does not exceed the observer’s expectations over time (Hardin, 1996: 28). • My question is: What changes of behaviors reflect a downward shift in the trustworthiness of a critical member which signals possible insider threats in a virtual organization? Behavioral Anomaly Detection
Method: The Leader’s Dilemma Game The target A’s behavioral change must be noticeable (distinctive) for others to perceive it. The consistency between the target’s words and actions was evaluated by these observers (Kelley, 1973) over time until a given set of tasks were completed. Consensus among B’s observation (perception) of target A must obtain. Behavioral Anomaly Detection