Online Library

Online social networks have become a powerful venue for political activism. In many cases large, insular online communities form that have been shown to be powerful diffusion mechanisms of both misinformation and propaganda. In some cases, these groups users advocate actions or policies that could be construed as extreme along nearly any distribution of opinion and are thus called Online Extremist Communities (OECs). Although these communities appear increasingly common, little is known about how these groups form or the methods used to influence them. The work in this thesis provides researchers a methodological framework to study these groups by answering three critical research questions:
• How can we detect large dynamic online activist or extremist communities?
• What automated tools are used to build, isolate, and influence these communities?
• What methods can be used to gain novel insight into large online activist or extremist communities?
This group members social ties can be inferred based on the various affordances offered by OSNs for group curation. By developing heterogeneous, annotated graph representations of user behavior I can efficiently extract online activist discussion cores using an ensemble of unsupervised machine learning methods. I call this technique Ensemble Agreement Clustering. Through manual inspection, these discussion cores can then often be used as training data to detect the larger community. I present a novel supervised learning algorithm called Multiplex Vertex Classification for network bipartition on heterogeneous, annotated graphs. This methodological pipeline has also proven useful for social botnet detection, and a study of large, complex social botnets used for propaganda dissemination is provided as well. Throughout this thesis, I provide Twitter case studies including communities focused on the Islamic State of Iraq and al-Sham (ISIS), the ongoing Syrian Revolution, the Euromaidan Movement in Ukraine, as well as the alt-Right.

The ever-increasing use of the internet by terrorist groups as a platform for the dissemination of radical, violent ideologies is well documented. The internet has, in this way, become a breeding ground for potential lone-wolf terrorists; that is, individuals who commit acts of terror inspired by the ideological rhetoric emitted by terrorist organizations. These individuals are characterized by their lack of formal affiliation with terror organizations, making them difficult to intercept with traditional intelligence techniques. The radicalization of individuals on the internet poses a considerable threat to law enforcement and national security officials. This new medium of radicalization, however, also presents new opportunities for the interdiction of lone-wolf terrorism. This dissertation is an account of the development and evaluation of an information technology (IT) framework for detecting potentially radicalized individuals on social media sites and Web fora. Unifying Collective Action Framing Theory (CAFT) and a radicalization model of lone-wolf terrorism, this dissertation analyzes a corpus of propaganda documents produced by several, radically different, terror organizations. This analysis provides the building blocks to define a knowledge model of terrorist ideological framing that is implemented as a Semantic Web Ontology. Using several techniques for ontology guided information extraction, the resultant ontology can be accurately processed from textual data sources. This dissertation subsequently defines several techniques that leverage the populated ontological representation for automatically identifying individuals who are potentially radicalized to one or more terrorist ideologies based on their postings on social media and other Web fora. The dissertation also discusses how the ontology can be queried using intuitive structured query languages to infer triggering events in the news. The prototype system is evaluated in the context of classification and is shown to provide state of the art results. The main outputs of this research are (1) an ontological model of terrorist ideologies (2) an information extraction framework capable of identifying and extracting terrorist ideologies from text, (3) a classification methodology for classifying Web content as resonating the ideology of one or more terrorist groups and (4) a methodology for rapidly identifying news content of relevance to one or more terrorist groups.

Criminologists have generally agreed that the Internet is not only a tool or resource for right-wing extremists to disseminate ideas and products, but also a site of important identity work, accomplished interactively through the exchange of radical ideas. Online discussion forums, amongst other interactive corners of the Web, have become an essential conduit for the radical right to air their grievances and bond around their “common enemy.” Yet overlooked in this discussion has been a macro-level understanding of the radical discussions that contribute to the broader collective identity of the extreme right online, as well as what constitutes “radical posting behavior” within this context. Drawing from criminal career measures to facilitate this type of analysis, data was extracted from a sub-forum of the most notorious white supremacy forum online, Stormfront, which included 141,763 posts made by 7,014 authors over approximately 15 years. In study one of this dissertation, Sentiment-based Identification of Radical Authors (SIRA), a sentiment analysis-based algorithm that draws from traditional criminal career measures to evaluate authors’ opinions, was used to identify and, by extension, assess forum authors’ radical posting behaviors using a mixed-methods approach. Study two extended on study one by using SIRA to quantify authors’ group-level sentiment about their common enemies: Jews, Blacks, and LGBTQs. Study three further extended on studies one and two by analyzing authors’ radical posting trajectories with semi-parametric group-based modeling. Results highlighted the applicability of criminal career measures to study radical discussions online. Not only did this mixed-methods approach provide theoretical insight into what constitutes radical posting behavior in a white supremacy forum, but it also shed light on the communication patterns that contribute to the broader collective identity of the extreme right online.

This thesis examined the three core themes: the role of education in cyber security, the role of technology in cyber security, and the role of policy in cyber security, the areas in which the papers are published. The associated works are published in referred journals, peer reviewed book chapters, and conference proceedings. Research can be found in the following outlets: 1. Security Solutions for Hyperconnectivity and the Internet of Things; 2. Developing Next-Generation Countermeasures for Homeland Security Threat Prevention; 3. New Threats and Countermeasures in Digital Crime and Cyber Terrorism; 4. Internatoinal Journal of Business Continuity and Risk Management; 4. Handbook of Research on 3-D Virtual Environments and Hypermedia for Ubiquitous Learning; 6. Information Security in Diverse Computing Environments; 7. Technology, Innovation, and Enterprise Transformation; 8. Journal of Information Systems Technology and Planning; 9. Encylopedia of Information Science and Technology. The shortcomings and gaps in cyber security research is the research focus on hyperconnectivity of people and technology to include the policies that provide the standards for security hardened systems. Prior research on cyber and homeland security reviewed the three core themes separately rather than jointly. This study examined the research gaps within cyber security as it relates to core t hemes in an effort to develop stronger policies, education programs, and hardened technologies for cyber security use. This work illustrates how cyber security can be broken into these three core areas and used together to address issues such as developing training environments for teaching real cyber security events. It will further show the correlations between technologies and policies for system Certification & Accreditation (C & A). Finally, it will offer insights on  how cybersecurity can be used to maintain security for international and national security. The overall results of the study provide guidance on how to create an ubiquitous learning (U-Learning) environment to teach cyber security concepts, craft policies that affect computing, and examines the effects on national and international security. The overall research has been improving the role of cyber security in education, technology, and policy.

In this case study, I analyze the 2014 North Korean computer database hack of Sony Pictures Entertainment (SPE), a serious national security crisis of cyberterrorism. I utilize Normal Accidents theory as a lens, to help explain how the accident within one system (SPE) and later crisis lead to the interaction with a second system (U.S. Federal Government), the development of a new crisis, and the need for a crisis response from system two. The evolution of a single organization’s accident into a national security crisis does not occur without specific complex interactions that take place to connect the two systems together. To explain this interconnectedness between systems, I introduce two new constructs: 1) common denominator and 2) common goal, which expand Normal Accidents theory allowing it to account for the coupling between the two independent systems (SPE & United States Government) through non-linear interactions. Overall, this case study provides important insight for future crisis communication planning, response, and development regarding between-organization interaction during a crisis.

Since emerging in academic literature in the 1990s, definitions of ‘cyber war’ and cyber warfare’ have been notably inconsistent. There has been no research that examines these inconsistencies and whether they can be resolved. Using the methodology of discourse analysis, this thesis addresses this research need. Analysis has identified that the study of cyber war and cyber warfare is inherently interdisciplinary. The most prominent academic disciplines contributing definitions are Strategic Studies, Security Studies, Information and Communications Technology, Law, and Military Studies. Despite the apparent definitional uncertainty, most researchers do not offer formal definitions of cyber war or cyber warfare. Moreover, there is little evidentiary basis in literature to distinguish between cyber war and cyber warfare. Proximate analysis of definitions of cyber war and cyber warfare suggests a high level of inconsistency between dozens of definitions. However, through deeper analysis of both the relationships between definitions and their underlying structure, this thesis demonstrates that (a) the relationships between definitions can be represented hierarchically, through a discourse hierarchy of definitions; and (b) all definitions share a common underlying structure, accessible through the application of a structural definition model. Crucially, analysis of definitions via these constructs allows a foundational definition of cyber war and cyber warfare to be identified. Concomitantly, use of the model identifies the areas of greatest interdefinitional inconsistency and the implications thereof and contributes to the construction of a taxonomy of definitions of cyber war and cyber warfare. Considered holistically, these research outputs allow for significant resolution of the inconsistency between definitions. Moreover, these outputs provide a basis for the emergence of dominant functional definitions that may aid in the development of policy, strategy, and doctrine.