Detection of hacking behaviors and communication patterns on social media

摘要

Hackers make extensive use of online communities, sharing knowledge, tools, as well as performing coordination and recruitment activities. In order to detect such behaviors, this paper proposes a set of indicators which analyze online communication patterns, including technical discussions, expression of positive and negative sentiments and threats, recruitment activities, and user profiling. The indicators are processing streaming social media and search for online behaviors and communication patterns characteristic of hackers with different motivations and skills. Our initial evaluation of indicators using twitter data shows that there is a significant variation in indicator values across different types of hackers. For example, hackers with higher level skills tend to use technical topics in their conversation more often than hackers with lower skills, whereas hackers motivated by profit and ideology tend to express recruitment language more often than attackers motivated by revenge and prestige. These results support our hypothesis that detection of hacking behaviors on social media needs to take into account the differences in intentions, motivations, and skills of different types of hackers.