Command & Control: Understanding, Denying and Detecting - A review of malware C2 techniques, detection and defences

In this survey, we first briefly review the current state of cyber attacks, highlighting significant recent changes in how and why such attacks are performed. We then investigate the mechanics of malware command and control (C2) establishment: we provide a comprehensive review of the techniques used by attackers to set up such a channel and to hide its presence from the attacked parties and the security tools they use. We then switch to the defensive side of the problem, and review approaches that have been proposed for the detection and disruption of C2 channels. We also map such techniques to widely-adopted security controls, emphasizing gaps or limitations (and success stories) in current best practices.Comment: Work commissioned by CPNI, available at c2report.org. 38 pages. Listing abstract compressed from version appearing in repor

Demographic Inference and Representative Population Estimates from Multilingual Social Media Data

Social media provide access to behavioural data at an unprecedented scale and granularity. However, using these data to understand phenomena in a broader population is difficult due to their non-representativeness and the bias of statistical inference tools towards dominant languages and groups. While demographic attribute inference could be used to mitigate such bias, current techniques are almost entirely monolingual and fail to work in a global environment. We address these challenges by combining multilingual demographic inference with post-stratification to create a more representative population sample. To learn demographic attributes, we create a new multimodal deep neural architecture for joint classification of age, gender, and organization-status of social media users that operates in 32 languages. This method substantially outperforms current state of the art while also reducing algorithmic bias. To correct for sampling biases, we propose fully interpretable multilevel regression methods that estimate inclusion probabilities from inferred joint population counts and ground-truth population counts. In a large experiment over multilingual heterogeneous European regions, we show that our demographic inference and bias correction together allow for more accurate estimates of populations and make a significant step towards representative social sensing in downstream applications with multilingual social media.Comment: 12 pages, 10 figures, Proceedings of the 2019 World Wide Web Conference (WWW '19

Multiresolution Recurrent Neural Networks: An Application to Dialogue Response Generation

We introduce the multiresolution recurrent neural network, which extends the sequence-to-sequence framework to model natural language generation as two parallel discrete stochastic processes: a sequence of high-level coarse tokens, and a sequence of natural language tokens. There are many ways to estimate or learn the high-level coarse tokens, but we argue that a simple extraction procedure is sufficient to capture a wealth of high-level discourse semantics. Such procedure allows training the multiresolution recurrent neural network by maximizing the exact joint log-likelihood over both sequences. In contrast to the standard log- likelihood objective w.r.t. natural language tokens (word perplexity), optimizing the joint log-likelihood biases the model towards modeling high-level abstractions. We apply the proposed model to the task of dialogue response generation in two challenging domains: the Ubuntu technical support domain, and Twitter conversations. On Ubuntu, the model outperforms competing approaches by a substantial margin, achieving state-of-the-art results according to both automatic evaluation metrics and a human evaluation study. On Twitter, the model appears to generate more relevant and on-topic responses according to automatic evaluation metrics. Finally, our experiments demonstrate that the proposed model is more adept at overcoming the sparsity of natural language and is better able to capture long-term structure.Comment: 21 pages, 2 figures, 10 table

The art of bots: A practice-based study of the multiplicity, entanglements and figuration of sociocomputational assemblages

This thesis examines and analyses an emerging art practice known as artbots. Artbots are internet-based software applications that are imbued with character and configured to engage and entertain online audiences. This form of practice, and the community of practice leading it, was found to be underrepresented and misunderstood. I argue that this artform is original and warrants a more thorough understanding. This thesis develops a conceptual framework for understanding artbots that focuses on and enables questioning around pertinent aspects of the practice. A wide range of literature was reviewed to provide theoretical underpinnings towards this framework, including literature on algorithm studies, science and technology studies, and software architecture. The devised framework examines artbot case studies through the notions of multiplicity, entanglement, and figuration, having understood artbots as heterogenous sociocomputational assemblages comprised of software components and human intraactivity. The research followed a varied methodology that encompassed participant observation and my own practice-based experiments in producing artbots. The study resulted in several original works. In addition, a showcase titled Art of Bots brought together key proponents and artbots, further providing material that is analysed in this thesis. The study helped identify and discuss artbots with attention to how they utilise modular software components in novel arrangements, how normative human and nonhuman relations of interaction are being eschewed in favour of entangled interrelations, and how artbots challenge common narratives dictating technological constructs by inventing unique characters and figurations

Decentralized Learning Infrastructures for Community Knowledge Building

Learning in Communities of Practice (CoPs) makes up a significant portion of today's knowledge gain. However, only little technological support is tailored specifically towards CoPs and their particular strengths and challenges. Even worse, CoPs often do not possess the resources to host or develop a software ecosystem to support their activities. In this contribution, we describe a decentralized learning infrastructure for community knowledge building. It takes into account the constant change of these communities by providing a leightweight and scalable infrastructure, without the need for central coordination or facilitation. As a real use case, we implement a question-based dialog application for inquiry-based learning and ignorance modeling with our infrastructure. Additionally, we explore the possibility of using social bots to connect the services provided by the decentralized infrastructure to communication tools already present in most communities (e.g. chat platforms). Following a design science approach, we describe a multi-step evaluation of both the infrastructure and application, together with the improvements made to the resulting artifacts of each step. Our results indicate the relevance of our approach, that may serve as an example of how decentralized learning infrastructures for learning outside of formal settings can be applied by CoPs for knowledge building

Pledging, Populism, and the Paris Agreement: The Paradox of a Management-Based Approach to Global Governance

For many observers, the Paris Agreement signaled a historic breakthrough in addressing the problem of global warming. In its basic design, however, the Agreement is far from novel. Its dependence on each nation’s self-determined pledge to reduce greenhouse gases mirrors the domestic policy strategy called management-based regulation—a flexible regulatory approach that has been used to address problems as varied as food safety and toxic air pollution. In this article, I connect insights from research on management-based regulation to the international governance of climate change. Unfortunately, management-based regulation’s track-record at the domestic level gives little reason to expect that the Paris Agreement will lead to major long-term behavioral change needed to reduce greenhouse gas emissions. Although a management-based regulatory strategy may have been the best option available for securing a widespread global climate agreement, this strategy seems to offer little assurance of forward momentum on climate policy due to an inherent paradox created by the Agreement’s management-based design: global progress will depend on domestic politics. Especially given the rise of nationalistic populism around the world, the Paris Agreement will succeed only if political efforts within individual countries push back the threat to global cooperation posed by populism and convince domestic leaders to support serious climate action

WORD BOMBS: THE USE OF STRATEGIC COMMUNICATIONS TO COUNTER DOMESTIC VIOLENT EXTREMISM

This thesis investigates how implementing strategic communications can counter domestic violent extremist (DVE) behavior in the United States. Strategic communications use counter-messaging based on research and intelligence of the group’s behaviors and perceptions. To develop strategic communications to counter violence, this thesis explores narratives, how they work, their persuasiveness, and how emotions play a role in influencing others. Extremists use social media to propagate images depicting violence and language promoting physical violence. This thesis explores inoculation strategies, nudge theory, psychological and social approaches, and counternarratives to counter DVEs. Reasoned action theory is used as a template for determining how background information, beliefs, and intentions form extremists’ behavior and action. Four case studies are presented using DVE group examples from anarchists, Proud Boys, Boogaloo Boys, and Atomwaffen. Each case study looks at the group’s ideology, violence, social media, demographics, and narratives to better understand the group’s themes. Next, using the reasoned action theory model as well as knowledge of the group and messaging theme, the thesis provides an example of how to craft a counternarrative. This thesis recommends that government and law enforcement invest in inoculation and nudge strategies as well as artificial intelligence, and create special strategic communication teams or units.Civilian, Washington County Sheriff's OfficeApproved for public release. Distribution is unlimited

Journey of Artificial Intelligence Frontier: A Comprehensive Overview

The field of Artificial Intelligence AI is a transformational force with limitless promise in the age of fast technological growth This paper sets out on a thorough tour through the frontiers of AI providing a detailed understanding of its complex environment Starting with a historical context followed by the development of AI seeing its beginnings and growth On this journey fundamental ideas are explored looking at things like Machine Learning Neural Networks and Natural Language Processing Taking center stage are ethical issues and societal repercussions emphasising the significance of responsible AI application This voyage comes to a close by looking ahead to AI s potential for human-AI collaboration ground-breaking discoveries and the difficult obstacles that lie ahead This provides with a well-informed view on AI s past present and the unexplored regions it promises to explore by thoroughly navigating this terrai

Mapping (Dis-)Information Flow about the MH17 Plane Crash

Digital media enables not only fast sharing of information, but also disinformation. One prominent case of an event leading to circulation of disinformation on social media is the MH17 plane crash. Studies analysing the spread of information about this event on Twitter have focused on small, manually annotated datasets, or used proxys for data annotation. In this work, we examine to what extent text classifiers can be used to label data for subsequent content analysis, in particular we focus on predicting pro-Russian and pro-Ukrainian Twitter content related to the MH17 plane crash. Even though we find that a neural classifier improves over a hashtag based baseline, labeling pro-Russian and pro-Ukrainian content with high precision remains a challenging problem. We provide an error analysis underlining the difficulty of the task and identify factors that might help improve classification in future work. Finally, we show how the classifier can facilitate the annotation task for human annotators

Learning Representations of Social Media Users

User representations are routinely used in recommendation systems by platform developers, targeted advertisements by marketers, and by public policy researchers to gauge public opinion across demographic groups. Computer scientists consider the problem of inferring user representations more abstractly; how does one extract a stable user representation - effective for many downstream tasks - from a medium as noisy and complicated as social media? The quality of a user representation is ultimately task-dependent (e.g. does it improve classifier performance, make more accurate recommendations in a recommendation system) but there are proxies that are less sensitive to the specific task. Is the representation predictive of latent properties such as a person's demographic features, socioeconomic class, or mental health state? Is it predictive of the user's future behavior? In this thesis, we begin by showing how user representations can be learned from multiple types of user behavior on social media. We apply several extensions of generalized canonical correlation analysis to learn these representations and evaluate them at three tasks: predicting future hashtag mentions, friending behavior, and demographic features. We then show how user features can be employed as distant supervision to improve topic model fit. Finally, we show how user features can be integrated into and improve existing classifiers in the multitask learning framework. We treat user representations - ground truth gender and mental health features - as auxiliary tasks to improve mental health state prediction. We also use distributed user representations learned in the first chapter to improve tweet-level stance classifiers, showing that distant user information can inform classification tasks at the granularity of a single message.Comment: PhD thesi