Digital Twin technologies promise to transform business operations, enhance modeling capabilities, and improve safety and security. Human Digital Twins (HDTs) are physical representations and virtual models of humans to accurately track human motion, perception, and activities, but their application to ISI is still limited. This paper provides a review of developments in DTs and presents two cases of building and applying HDTs to social cybersecurity, intelligence monitoring and surveillance, and security informatics. Study findings, ongoing works, and future directions are discussed.

Data availability is one of the most important performance factors in cloud storage systems. To enhance data availability, replication is a common approach to handle the machine failures. However, previously proposed replication schemes cannot effectively handle both correlated and non-correlated machine failures, especially while increasing the data availability with limited resources. The schemes for correlated machine failures must create a constant number of replicas for each data object, which often neglects diverse data popularities and does not utilize the resource to maximize the expected data availability. Also, the previous schemes neglect the consistency maintenance cost and the storage cost caused by replication. It is critical for cloud providers to maximize data availability (hence minimize SLA violations) while minimizing costs caused by replication in order to maximize the revenue. In this paper, we build a nonlinear integer programming model to maximize data availability in both types of failures, and therefore minimize the cost caused by replication. Based on the model's solution for the replication degree of each data object, we propose a low-cost multi-failure (correlated and non-correlated machine failures) resilient replication scheme (MRR). MRR can effectively handle both correlated and non-correlated machine failures, considers data popularities to enhance data availability, and also tries to minimize consistency maintenance and storage cost. Extensive numerical results from trace parameters and experiments from real-world Amazon S3 demonstrate that MRR achieves high data availability, low data loss probability and low consistency maintenance and storage costs when compared to previous replication schemes.

As terrorists are losing against counter-terrorism efforts, they turn to manipulating cryptocurrency prices through online social communities to gain illicit profit to fund their operations. Modeling temporal online social networks (OSNs) of these communities can possibly help to provide useful intelligence about these malicious activities. However, existing techniques do not learn sufficiently from diverse features to enable prediction and simulation of online social behavior. Research on simulating temporal OSN behavior is not widely available. This research developed and validated a deep learning approach, named Temporal Network Model (TNM), to modeling the complex features and dynamic behavior exhibited in the temporal OSNs of online communities. Using extensive features extracted from fine-grained data, TNM consists of weighted time series models, user and link prediction models, and temporal dependency model that predict respectively the macroscopic behavior, microscopic user participation and events, and time stamps of the events. Evaluation was done in comparison with a benchmark approach to examine TNM's performance on predicting and simulating behavior of 42,627 users in 440,906 events on the Reddit cryptocurrency community during July-August of 2017. Results show that TNM outperformed the benchmark in 5 out of 8 simulation metrics. TNM achieved consistently better performance in user activity prediction, and performed generally better in structural (network-level) prediction. The research provides new findings on simulating temporal OSNs and new predictive analytics for understanding online social behavior.

The increasing popularity and diversity of online social networks (OSNs) have attracted more and more people to participate in multiple OSNs. Learning users' behavior and information diffusion across platforms is critical for cyber threat detection, but it is still a challenge due to the surge of users participating in multiple social platforms. Existing research on profile matching requires user identity information to be available, which may not be realistic. Little prior research payed attention to mapping behavioral patterns across platforms. We designed and implemented an efficient two-level probabilistic approach called CrossSimON to mapping user-group behavior across platforms. CrossSimON considers the activity level and network position at both individual user level and group level to correlate activities across social platforms. To evaluate the effectiveness of CrossSimON in modeling social activity across platforms, we conducted experiments on three online social platforms: GitHub, Reddit and Twitter. Our experimental results show that CrossSimON outperformed the Benchmark in 3 out of 5 simulation metrics. CrossSimON achieved better performance in user activity prediction. The research provides new strategy for cross-platform online social network simulation, and new findings on simulating OSNs and predictive analytics for understanding online social network behavior.

Simulation of human behaviour being an intrinsically difficult problem, no single algorithm or model can accurately simulate online social networks. One can obtain an optimal and reliable simulation only after combining several models focusing on diverse social aspects. Since all independent models focus on different social aspects, it is inherently difficult to combine and optimize their performance. Moreover blackbox nature of these predictive algorithm makes it difficult to integrate human-guided intelligence. Here we are presenting SimON-Feedback, an iterative ensemble algorithm to combine the prediction of several independent models into a significantly improved simulation of an online social network. To this end, we explore user posting and commenting behavior on Reddit, a large social networking platform comprised of many communities called as subreddits.

Task scheduling and preemption are two important functions in data-parallel clusters. Though directed acyclic graph task dependencies are common in data-parallel clusters, previous task scheduling and preemption methods do not fully utilize such task dependency to increase throughput since they simply schedule precedent tasks prior to their dependent tasks or neglect the dependency. We notice that in both scheduling and preemption, choosing a task with more dependent tasks to run allows more tasks to be runnable next, which facilitates to select a task that can more increase throughput. Accordingly, in this paper, we propose a Dependency-aware Scheduling and Preemption system (DSP) to achieve high throughput. First, we build an integer linear programming model to minimize the makespan (i.e., the time when all jobs finish execution) with the consideration of task dependency and deadline, and derive the target server and start time for each task, which can minimize the makespan. Second, we utilize task dependency to determine tasks' priorities for preemption. Finally, we propose a method to reduce the number of unnecessary preemptions that cause more overhead than the throughput gain. Extensive experimental results based on a real cluster and Amazon EC2 cloud service show that DSP achieves much higher throughput compared to existing strategies.

Social media are increasingly reflecting and influencing the behavior of human and financial market. Cognitive hacking leverages the influence of social media to spread deceptive information with an intent to gain abnormal profits illegally or to cause losses. Measuring the information content in financial social media can be useful for identifying these attacks. In this paper, we developed an approach to identifying social media features that correlate with abnormal returns of the stocks of companies vulnerable to be targets of cognitive hacking. To test the approach, we collected price data and 865,289 social media messages on four technology companies from July 2017 to June 2018, and extracted features that contributed to abnormal stock movements. Preliminary results show that terms that are simple, motivate actions, incite emotion, and uses exaggeration are ranked high in the features of messages associated with abnormal price movements. We also provide selected messages to illustrate the use of these features in potential cognitive hacking attacks.

In recent years, the spreading of malicious social media messages about financial stocks has threatened the security of financial market. Market Anomaly Attacks is an illegal practice in the stock or commodities markets that induces investors to make purchase or sale decisions based on false information. Identifying these threats from noisy social media datasets remains challenging because of the long time sequence in these social media postings, ambiguous textual context and the difficulties for traditional deep learning approaches to handle both temporal and text dependent data such as financial social media messages. This research developed a temporal recurrent neural network (TRNN) approach to capturing both time and text sequence dependencies for intelligent detection of market anomalies. We tested the approach by using financial social media of U.S. technology companies and their stock returns. Compared with traditional neural network approaches, TRNN was found to more efficiently and effectively classify abnormal returns.

Mobile crowdsensing serves as a critical building block for emerging Internet of Things (IoT) applications. However, the sensing devices continuously generate a large amount of data, which consumes much resources (e.g., bandwidth, energy, and storage) and may sacrifice the Quality-of-Service (QoS) of applications. Prior work has demonstrated that there is significant redundancy in the content of the sensed data. By judiciously reducing redundant data, data size and load can be significantly reduced, thereby reducing resource cost and facilitating the timely delivery of unique, probably critical information and enhancing QoS. This article presents a survey of existing works on mobile crowdsensing strategies with an emphasis on reducing resource cost and achieving high QoS. We start by introducing the motivation for this survey and present the necessary background of crowdsensing and IoT. We then present various mobile crowdsensing strategies and discuss their strengths and limitations. Finally, we discuss future research directions for mobile crowdsensing for IoT. The survey addresses a broad range of techniques, methods, models, systems, and applications related to mobile crowdsensing and IoT. Our goal is not only to analyze and compare the strategies proposed in prior works, but also to discuss their applicability toward the IoT and provide guidance on future research directions for mobile crowdsensing.

As cybercrimes and their data volumes proliferate, business professionals and public servants urgently need new knowledge and skills to address the growing threats. However, curricular materials, pedagogical research, and courses to address the data deluge in cybersecurity are not widely available. This research developed a contextual active learning approach to creating curricular modules for use in online informatics education. The approach emphasizes active and contextual learning in module design and deployment. Student participation, problem-based thinking, case study, and interactive question-answering and discussion are used. We implemented the approach in a new online course titled “Cybersecurity Informatics,” a cross-disciplinary subject that connects advanced information technologies, systems, algorithms, and databases with cybersecurity-related applications. Results from an expert evaluation indicate strongly positive comments and significant innovation on active learning. The research demonstrates a strong potential for using the approach to developing new cybersecurity informatics modules.

Cyber-trafficking is the illegal transport of humans, drugs, weapons, or goods by means of Internet-enabled electronic devices. Currently, there is a lack of surveillance and understanding of the rapidly growing social concern about cyber-trafficking (CT). This paper describes the Cyber-Trafficking Surveillance System (CyTraSS) and provides preliminary findings of using the system to monitor CT social media discussions. CyTraSS supports flexible collection, analysis, and visualization of social media content, user linkage, and temporal features. The CyTraSS database contains a focused collection of over 2,318,691 social media messages posted by over 740,070 users who discussed about trafficking crimes and issues. CyTraSS supports keyword search, sentiment analysis, message statistics summarization, and influential leader identification. Emotion expressed in social media messages is extracted and aggregated quantitatively to indicate community mood. We examined three use cases about a sex trafficker identified by a flight attendant, Federal use of private prisons, and trafficking cases related to Beijing. These time-sensitive incidents are highly-relevant to CT and were identified by using clues provided by CyTraSS. The results have strong implications for understanding CT concern on social media.

Support Vector Machines (SVM) is a widely used technique for classifying high-dimensional data, especially in security and intelligence categorization. However, the performance of SVM can be adversely affected by poorly selected parameter values. Current approaches to SVM parameter selection mainly rely on extensive cross validation or anecdotal information, which can be inefficient and ineffective. In this research, we propose an efficient algorithm called Percentile-SVM (P-SVM) for selecting the parameter pair, (γ, C), of SVM with Gaussian kernels on metric data. P-SVM searches only a handful of percentiles of the squared Euclidean distances of data points to select the best pair of parameter values. To validate the algorithm, we applied P-SVM to categorizing business intelligence factors extracted from 6,859 sentences of 231 online news articles about four major companies in the information technology sector. The results show that P-SVM achieved a significant improvement in precision, recall, F-measure, and AUC over the LibSVM package (with default parameter values) used in WEKA, a widely used data mining software. These findings provide useful implication for relevant research and security informatics applications.

Research is proposed for improving the human-interpretability of topic models; specifically, for topic models of small sequential documents. Experiments are proposed for evaluating the usefulness of topic modeling. The proposed experiments will model the topics of a diverse set of social media content and attempt to correlate the presence of topics related to terror attacks with actual attacks; additionally, correlations between terror attacks and other topics will be checked for.

Social media provide opportunities for policy makers to gauge pubic opinion. However, the large volumes and variety of expressions on social media have challenged traditional policy analysis and public sentiment assessment. In this article, we describe a framework for social‐media‐based public policy informatics and a system called “iMood” that addresses the needs for sentiment and network analyses of U.S. immigration and border security. iMood collects related messages on Twitter, extracts user sentiment and emotion, and constructs networks of the Twitter users, helping policy makers to identify opinion leaders, influential users, and community activists. We evaluated the sentiment, emotion, and network characteristics found in 909,035 tweets posted by over 300,000 users during three phases between May and November 2013. Statistical analyses reveal significant differences in emotion and sentiment among the 3 phases. The Twitter networks of the 3 phases also had significantly different relationship counts, network densities, and total influence scores from those of other phases. This research should contribute to developing a new framework and a new system for social‐media‐based public policy informatics, providing new empirical findings and data sets of sentiment and network analyses of U.S. immigration and border security, and demonstrating a general applicability to different domains.

Emotion plays an important role in shaping public policy and business decisions. The growth of social media has allowed people to express their emotion publicly in an unprecedented manner. Textual content and user linkages fostered by social media networks can be used to examine emotion types, intensity, and contagion. However, research into how emotion evolves and entrains in social media that influence security issues is scarce. In this research, we developed an approach to analyzing emotion expressed in political social media. We compared two methods of emotion analysis to identify influential users and to trace their contagion effects on public emotion, and report preliminary findings of analyzing the emotion of 105,304 users who posted 189,012 tweets on the U.S. immigration and border security issues in November 2014. The results provide strong implication for understanding social actions and for collecting social intelligence for security informatics. This research should contribute to helping decision makers and security personnel to use public emotion effectively to develop appropriate strategies.

Intelligence and Security Informatics (ISI) is a cross-disciplinary field that connects advanced information technologies, systems, algorithms, and databases with international, national and homeland security related applications. Our NSF-funded project, titled Computing in Context, has a focus of developing new teaching modules and pedagogies for the ISI discipline at the undergraduate level. In this poster, we present five exemplar modules that we developed for the ISI discipline: database design for cybercrime investigation, securing private data on the Internet, data visualization for understanding privacy sentiment, security intelligence for healthcare mobility, and program design for digital forensics. Our materials are designed for inquiry-based learning and for active engagement of students through discussion, hands-on practices, and various exercises.

Analyzing authorship of online texts is an important analysis task in security-related areas such as cybercrime investigation and counter-terrorism, and in any field of endeavor in which authorship may be uncertain or obfuscated. This paper presents an automated approach for authorship analysis using machine learning methods, a robust stylometric feature set, and a series of visualizations designed to facilitate analysis at the feature, author, and message levels. A testbed consisting of 506,554 forum messages, in English and Arabic, from 14,901 authors was first constructed. A prototype portal system was then developed to support feasibility analysis of the approach. A preliminary evaluation to assess the efficacy of the text visualizations was conducted. The evaluation showed that task performance with the visualization functions was more accurate and more efficient than task performance without the visualizations.

As computing moves into its sixth decade as a formal field of study, a great deal of attention is focused on the breadth of relationships between computing and other disciplines. Descriptors of this relationship include computing in context, computing with a purpose, computing + X, computational X, interdisciplinary computing, multi-disciplinary computing, and trans-disciplinary computing. Regardless of the descriptor, the goals for exploring the relationship remain the same: students need to understand how the power of computing informs and shapes ideas throughout the academy and society. They need to learn appropriate concepts in computing and to see these applied to other areas of study. This learning will be most effective when approached through active participation of students, as they tackle questions and problems coming from society's ever-growing and ever-changing reliance on computing devices and modes of interaction. Our NSF-funded project, titled Computing in Context, fosters interdisciplinary computing education by creating exemplars of curricular materials, testing these materials in undergraduate computing courses, and disseminating the materials through computingportal.org. We focus our effort on four areas of applied computing: computational linguistics, computing and music intelligence and security informatics, and web science. Our materials will be designed for inquiry-based learning, whether this occurs in lecture as a brief conversation between pairs of students or in lab as loosely formulated problem or scenario or as a multi-week, team-based project.

In many emergency incidents, multiple reports and information sources are often used to help intelligence and security personnel to understand the situation during a short time period. Proper categorization and analysis of this information could enhance the efficiency of handling this large amount of potentially conflicting information, thus contributing to saving lives. The study of categorization of temporal events in cyber security application is, however, not widely found. In this research, we developed an automated approach to categorizing temporal events described in textual documents. The approach consists of automatic indexing, term extraction, and automatic categorization. We conducted a case study of domestic terrorism where we analyzed 96 online news articles about a shooting tragedy that resulted in 6 deaths and 1 seriously injured. Analyses of different numbers of extracted textual features (from 20 to 100) used in the temporal categorization revealed a gradual improvement of classification accuracies across different algorithms used. Naïve Bayes and SVM classification provided stable improvement (from 47% to 68%), whereas Neural Network had the highest accuracy when 70 features were used. The results provide new insights for researchers and intelligence personnel to understand the relationship between textual features and emergency event evolution.

As the trend of domestic terrorism grows rapidly, using web collections to support online surveillance should help intelligence and security personnel track down the sinister activities on the web. In this research, we have developed a collection of U.S. domestic terrorism websites and have conducted preliminary analysis of the sites' content and usage. We developed a novel approach to extracting textual, hyperlink, and usage information from websites. Our ongoing works include discovering hidden patterns from a collection of U.S. domestic terrorism websites and uncovering interesting usage and content patterns. This work should contribute to the area of online security surveillance using website data.

Abstract While the Web has grown significantly in recent years, some portions of the Web remain largely underdeveloped, as shown in a lack of high‐quality content and functionality. An example is the Arabic Web, in which a lack of well‐structured Web directories limits users' ability to browse for Arabic resources. In this research, we proposed an approach to building Web directories for the underdeveloped Web and developed a proof‐of‐concept prototype called the Arabic Medical Web Directory (AMedDir) that supports browsing of over 5,000 Arabic medical Web sites and pages organized in a hierarchical structure. We conducted an experiment involving Arab participants and found that the AMedDir significantly outperformed two benchmark Arabic Web directories in terms of browsing effectiveness, efficiency, information quality, and user satisfaction. Participants expressed strong preference for the AMedDir and provided many positive comments. This research thus contributes to developing a useful Web directory for organizing the information in the Arabic medical domain and to a better understanding of how to support browsing on the underdeveloped Web.

Abstract As the Web is used increasingly to share and disseminate information, business analysts and managers are challenged to understand stakeholder relationships. Traditional stakeholder theories and frameworks employ a manual approach to analysis and do not scale up to accommodate the rapid growth of the Web. Unfortunately, existing business intelligence (BI) tools lack analysis capability, and research on BI systems is sparse. This research proposes a framework for designing BI systems to identify and to classify stakeholders on the Web, incorporating human knowledge and machine‐learned information from Web pages. Based on the framework, we have developed a prototype called Business Stakeholder Analyzer (BSA) that helps managers and analysts to identify and to classify their stakeholders on the Web. Results from our experiment involving algorithm comparison, feature comparison, and a user study showed that the system achieved better within‐class accuracies in widespread stakeholder types such as partner/sponsor/supplier and media/reviewer, and was more efficient than human classification. The student and practitioner subjects in our user study strongly agreed that such a system would save analysts' time and help to identify and classify stakeholders. This research contributes to a better understanding of how to integrate information technology with stakeholder theory, and enriches the knowledge base of BI system design.

Abstract While the Web has become a worldwide platform for communication, terrorists share their ideology and communicate with members on the “Dark Web”—the reverse side of the Web used by terrorists. Currently, the problems of information overload and difficulty to obtain a comprehensive picture of terrorist activities hinder effective and efficient analysis of terrorist information on the Web. To improve understanding of terrorist activities, we have developed a novel methodology for collecting and analyzing Dark Web information. The methodology incorporates information collection, analysis, and visualization techniques, and exploits various Web information sources. We applied it to collecting and analyzing information of 39 Jihad Web sites and developed visualization of their site contents, relationships, and activity levels. An expert evaluation showed that the methodology is very useful and promising, having a high potential to assist in investigation and understanding of terrorist activities by producing results that could potentially help guide both policymaking and intelligence research.

As the US-Mexico border areas recently emerge as a hub for cyber-criminal activities, the El Paso (Texas) division of FBI processes voluminous cases on Internet crimes. Using data from the Internet Crime Complaint Center, this research project aims to develop and validate scalable methods and techniques for profiling and visualizing cyber-criminal activities. A general framework and potential contributions are discussed.

In this research, we proposed and validated an approach to using information visualization to augment search engines in supporting the analysis of business stakeholder information on the Web. We report in this paper findings from a preliminary evaluation comparing a visualization prototype with a traditional method of stakeholder analysis (Web browsing and searching). We found that the prototype achieved a higher perceived usefulness and perceived analysis effectiveness and was perceived favorably in expediting the subjects' decision making and in helping them understand the analysis results. Overall, the proposed approach was found to augment traditional methods of analyzing business stakeholders. We discuss implications to researchers and practitioners and future directions.

Abstract The rapid growth of the non‐English‐speaking Internet population has created a need for better searching and browsing capabilities in languages other than English. However, existing search engines may not serve the needs of many non‐English‐speaking Internet users. In this paper, we propose a generic and integrated approach to searching and browsing the Internet in a multilingual world. Based on this approach, we have developed the Chinese Business Intelligence Portal (CBizPort), a meta‐search engine that searches for business information of mainland China, Taiwan, and Hong Kong. Additional functions provided by CBizPort include encoding conversion (between Simplified Chinese and Traditional Chinese), summarization, and categorization. Experimental results of our user evaluation study show that the searching and browsing performance of CBizPort was comparable to that of regional Chinese search engines, and CBizPort could significantly augment these search engines. Subjects' verbal comments indicate that CBizPort performed best in terms of analysis functions, cross‐regional searching, and user‐friendliness, whereas regional search engines were more efficient and more popular. Subjects especially liked CBizPort's summarizer and categorizer, which helped in understanding search results. These encouraging results suggest a promising future of our approach to Internet searching and browsing in a multilingual world.

Abstract Information overload on the Web has created enormous challenges to customers selecting products for online purchases and to online businesses attempting to identify customers' preferences efficiently. Various recommender systems employing different data representations and recommendation methods are currently used to address these challenges. In this research, we developed a graph model that provides a generic data representation and can support different recommendation methods. To demonstrate its usefulness and flexibility, we developed three recommendation methods: direct retrieval, association mining, and high‐degree association retrieval. We used a data set from an online bookstore as our research test‐bed. Evaluation results showed that combining product content information and historical customer transaction information achieved more accurate predictions and relevant recommendations than using only collaborative information. However, comparisons among different methods showed that high‐degree association retrieval did not perform significantly better than the association mining method or the direct retrieval method in our test‐bed.

Abstract To make good decisions, businesses try to gather good intelligence information. Yet managing and processing a large amount of unstructured information and data stand in the way of greater business knowledge. An effective business intelligence tool must be able to access quality information from a variety of sources in a variety of forms, and it must support people as they search for and analyze that information. The EBizPort system was designed to address information needs for the business/IT community. EBizPort's collection‐building process is designed to acquire credible, timely, and relevant information. The user interface provides access to collected and metasearched resources using innovative tools for summarization, categorization, and visualization. The effectiveness, efficiency, usability, and information quality of the EBizPort system were measured. EBizPort significantly outperformed Brint, a business search portal, in search effectiveness, information quality, user satisfaction, and usability. Users particularly liked EBizPort's clean and user‐friendly interface. Results from our evaluation study suggest that the visualization function added value to the search and analysis process, that the generalizable collection‐building technique can be useful for domain‐specific information searching on the Web, and that the search interface was important for Web search and browse support.