Presented at
Black Hat Europe 2016,
Nov. 3, 2016, 12:30 p.m.
(30 minutes)
Cyber criminals, hacktivists, and the occasional state actor tend to congregate in underground forums and come in many forms - in clear, deep, and dark web, focused geographically and linguistically, and focused by areas - carding, reverse engineering, hacking, etc.<br> <br> In this presentation we analyze a very large corpus of forum posts from surface and deep web spanning more than 3 years - including forums originating in the United States, Russia, Palestine/Gaza, Ukraine, Iran, China (in local language), etc. Based on this corpus we establish a series of patterns of actor behavior that can be used for targeting illicit behavior and actors, establish research pivot points, and detect actor focus on products, technologies, and vulnerabilities.<br> <br> The analysis will lay out techniques for how to analyze forum and actor behavior based on meta data analysis, without detailed human analysis of individual messages/posts. We will demonstrate how we can use the below techniques to establish patterns both inside and across forums (tracking actor traversals of the web), and crossing boundaries of clear/deep/dark web.:<br><ul><li><span style="line-height: normal; font-size: 13.34px; background-color: initial;" data-mce-style="line-height: normal; font-size: 13.34px; background-color: initial;">Natural language processing</span><br></li><li><span style="line-height: normal; font-size: 13.34px; background-color: initial;" data-mce-style="line-height: normal; font-size: 13.34px; background-color: initial;">Temporal pattern analysis</span><br></li><li><span style="line-height: normal; font-size: 13.34px; background-color: initial;" data-mce-style="line-height: normal; font-size: 13.34px; background-color: initial;">Social network analysis, etc.</span><br></li></ul><br>
Presenters:
-
Christopher Ahlberg
- Co-Founder & CEO, Recorded Future
Dr. Christopher Ahlberg is the CEO and Co-founder of Recorded Future, Inc. and Chairman of Hult International Business School. Earlier, Dr. Ahlberg was President of the Spotfire Division of TIBCO. Dr. Ahlberg founded Spotfire based on his ground-breaking research on information visualization. It was acquired by TIBCO in 2007 for $195M. He has lectured, published and consulted for industry, military and intelligence communities on topics covering cyber security, computer science, psychology, linguistics, biology and chemistry. He holds 5 software patents with more pending. Dr. Ahlberg was named among World's Top 100 Young Innovators by MIT Technology Review in 2002. He has a doctorate from Chalmers University of Technology and is a member of the Royal Swedish Academy of Engineering Sciences.
Recent/selected conferences: TEDx Cambridge, Kaspersky Security Analyst Summit, MIT Enterprise Forum, and Citi CTO Summit.
Links:
Similar Presentations: