Publications

Identifying Real-World Credible Experts in the Financial Domain
Teng-Chieh Huang, Razieh Nokhbeh Zaemm, Suzanne Barber, UT CID Report #21-11, December 2021

Show Abstract

Establishing a solid mechanism for finding credible and trustworthy people in online social networks is an important first step to avoid useless, misleading or even malicious information. There is a body of existing work studying trustworthiness of social media users and finding credible sources in specific target domains. However, most of the related work lack the connection between the credibility in the real-world and credibility on the Internet, which makes the formation of social media credibility and trustworthiness incomplete. In this paper, working in the financial domain, we identify attributes that can distinguish credible users on the Internet who are indeed trustworthy experts in the real-world. To ensure objectivity, we gather the list of credible financial experts from real-world financial authorities. We analyze the distribution of attributes of about 10K stock-related Twitter users and their 600K tweets over six months in 2015/2016, and over 2.6M typical Twitter users and their 4.8M tweets on November 2nd, 2015, comprising 1% of the entire Twitter in that time period. By using the random forest classifier, we find which attributes are related to real-world expertise. Our work sheds light on the properties of trustworthy users and paves the way for their automatic identification.

 

Access Publication: Download PDF of Report

Proactive Identity Knowledge and Mitigation System
Aditya Tiaga, Razieh Nokhbeh Zaeem, K. Suzanne Barber, UT CID Report #21-10, December 2021

Show AbstractWhile many organizations share threat intelligence, there is still a lack of actionable data for organizations to proactively and effectively respond to emerging identity threats to mitigate a wide range of crimes. There currently exists no solution for organizations to access current trends and intelligence to understand emerging threats and how to appropriately respond to them. This research project delivers I-WARN, to help bridge that gap. Using a wide range of open-source information, I-WARN gathers, analyzes, and reports on threats related to the theft, fraud, and abuse of Personally Identifiable Information (PII). Then maps those threats to the MITRE ATT&CK { a framework that helps understand lateral movement of an attack—to offer mitigation and risk reduction tactics. I-WARN aims to deliver actionable intelligence, offering early warning into threat behaviors, and mitigation responses. This paper discusses the technical details of I-WARN, current solutions for threat intelligence sharing with how they compare to I-WARN, and future work.

 

Access Publication: Download PDF of Report

Human and Privacy Rights
Razieh Nokhbeh Zaeem, K. Suzanne Barber, UT CID Report #21-09, November 2021

Show Abstract Privacy is important. Individuals should have the right to control the disclosure of personal data that describes them, identifies them and reveals information about them. Individuals should not be subjected to invasions of their privacy, family, home or correspondence, nor to assaults upon their reputation. These rights to privacy must be protected by law to guard against such interference, invasions or attacks.

 

Access Publication: Download PDF of Report

It Is an Equal Failing to Trust Everyone and to Trust Nobody: Stock Price Prediction Using Trust Filters and Enhanced User Sentiment on Twitter
Teng-Chieh Huang, Razieh Nokhbeh Zaeem, K. Suzanne Barber, UT CID Report #21-08, November 2021

Show AbstractSocial media are providing a huge amount of information, in scales never possible before. Sentiment analysis is a powerful tool that uses social media information to predict various target domains (e.g., the stock market). However, social media information may or may not come from trustworthy users. In order to utilize this information, a very first critical problem to solve is to filter credible and trustworthy information from contaminated data, advertisements or scams. We investigate different aspects of a social media user to score his/her trustworthiness and credibility. Furthermore, we provide suggestions on how to improve trustworthiness on social media by analyzing the contribution of each trust score. We apply trust scores to filter the tweets related to the stock market as an example target domain. While social media sentiment analysis has been on the rise over the past decade, our trust filters enhance conventional sentiment analysis methods and provide more accurate prediction of the target domain, here the stock market. We argue that while it is a failing to ignore the information social media provide, effectively trusting nobody, it is an equal failing to trust everybody on social media too: Our filters seek to identify whom to trust.

 

Access Publication: Download PDF of Report

Blockchain-Based Self-Sovereign Identity: Survey, Requirements, Use- Cases, and Comparative Study
Razieh Nokhbeh Zaeem, K. Suzanne Barber, Razieh Nokhbeh Zaeem, Kai Chih Chang, Teng-Chieh Huang, David Liau, Wenting Song, Aditya Tyagi, Manah M. Khalil, Michael R. Lamison, Siddhartha Pandey, UT CID Report #21-06, August 2021

Show Abstract Identity is at the heart of digital transformation. Successful digi-tal transformation requires confidence in and protection of digital identities. On the Internet, however, there is no unique and stan-dard identity layer. Consequently, a variety of digital identities have emerged over years, leading to privacy risks, security vulnerabilities, risks for identity owners, and liability for identity issuers and those relying on digital identities to grant access to goods and services. Self-Sovereign Identity (SSI) and similar forms of identity management on the blockchain distributed ledger are novel technologies that recognize the need to keep user identity privately stored in user-owned devices, securely verified by identity issuers, and only revealed to verifiers as needed. There is limited academic literature defining the prerequisite SSI functional and non-functional requirements and comparing SSI technologies. Often those SSI technologies reviewed in the literature lack behind current advances. We present the first work that compiles a comprehensive list of functional and non-functional requirements of SSI and compares an extensive number of existing SSI/blockchain-based identity management solutions with respect to these requirements. Our work sheds light on the state-of-the-art SSI development and paves the way for future, more informed analysis and development of novel identity management and SSI solutions.

 

Access Publication: Download PDF of Report

Early Warning Identity Threat and Mitigation System
Aditya Tyagi, Razieh Nokhbeh Zaeem, K. Suzanne Barber, UT CID Report #21-05, August 2021

Show Abstract While many organizations share threat intelligence, there is still a lack of actionable data for organizations to proactively and effectively respond to emerging identity threats to mitigate a wide range of crimes. There currently exists no solution for organizations to access current trends and intelligence to understand emerging threats and how to appropriately respond to them. This research project delivers I-WARN to help bridge that gap. Using a wide range of open-source information, I-WARN gathers, analyzes, and reports on threats related to the theft, fraud, and abuse of Personally Identifiable Information (PII). I-WARN then maps those threats to the MITRE ATT&CK – a framework that helps understand lateral movement of an attack – to offer mitigation and risk reduction tactics. I-WARN aims to deliver actionable intelligence, offering early warning into threat behaviors, and mitigation responses. This paper discusses the technical details of I-WARN, current solutions for threat intelligence sharing with how they compare to I-WARN, and future work.

 

Access Publication: Download PDF of Report

Personal Data Early Warning System: Machine Learning Models Extract Identity Theft and Fraud Trends from News
Razieh Nokhbeh Zaeem, K. Suzanne Barber, Jessica Cruz-Nagoski, Luke Norrell, Michael Sullivan, Jonathan Walsh, Dylan Wolford, Yasira Younus, UT CID Report #21-04, August 2021

Show Abstract Each year, cyber attacks pose a greater and greater risk to consumer personal information stored by corporations and government agen-cies. Billions of consumer records are breached each year and data breaches compromise the personal data of hundreds of millions of citizens. These breaches are extremely costly–financially and in terms of privacy and reputation–to people (through identity theft and fraud) and to companies (through the abuse of their collected in-formation for which they are accountable). What is more, the theft of data often acts as a gateway in the complex and interdependent ecosystem of personal data. Personally Identifiable Information (PII) is breached to gain access and steal more PII in a chain of events and tactics. Therefore, there is a need to build tools to help people and businesses navigate the dangerous waters of identity theft and fraud. The cyber world, however, is an evolving landscape and trends change often. People and organizations need to have a current and accurate situational awareness understanding trends such as common breach threats and tactics, types of data most frequently attacked, and personal information most often exposed with the highest negative consequences. Enter the Personal Data Early Warning System (PDEWS), an online dashboard that tracks and displays the current cyber threat landscape and generates actionable insight into trends and pat-terns. PDEWS exists as an automated pipeline, collecting data each day about ongoing cyber threats. There are four major phases of PDEWS. First, PDEWS prowls through daily identity theft and fraud news stories and scrapes the body text. Then it formats the text into the representation required for a machine learning application and places that text in an Amazon Web Services cloud infrastructure. Next, PDEWS applies machine learning models trained on a private identity theft article corpus to extract relevant threat la-bels. Finally, PDEWS displays those trends on an online dashboard alongside recommendations researched to have the greatest mitigation capabilities against the current threat landscape.

 

Access Publication: Download PDF of Report

PrivacyCheck v3: Empowering Users with Higher-Level Understanding of Privacy Policies
Razieh Nokhbeh Zaeem, K. Suzanne Barber, Ahmad Ahbab, Josh Bestor, Hussam H. Djadi, Sunny Kharel, Victor Lai, Nick Wang, UT CID Report #21-03, August 2021

Show Abstract Privacy policies are lengthy and hard to read, yet are profoundly important as they communicate the practices of an organization pertaining to user data privacy. Privacy Enhancing Technologies, or PETs, seek to inform users by summarizing these privacy policies. Efforts in the research and development of such PETs, however, have largely been limited to tools that recap the policy or visualize it. We present the next generation of our research and publicly available tool, PrivacyCheck v3, that utilizes machine learning to inform and empower users with respect to privacy policies. Privacy-Check v3 adds capabilities that are commonly absent from similar PETs. In particular, it adds the ability to (1) find the competitors of an organization with Alexa traffic analysis and compare policies across them, (2) follow privacy policies the user has agreed to and notify the user when policies change, (3) track policies over time and report how often policies change and their trends, (4) automat-ically find privacy policies in domains, and (5) provide a bird’s-eye view of privacy policies the user has agreed to. The new features of PrivacyCheck not only inform users about details of privacy policies, but also empower them to understand privacy policies at a higher level, make informed decisions, and even select competitors with better privacy policies.

 

Access Publication: Download PDF of Report

On the Usability of Self Sovereign Identity Solutions
Razieh Nokhbeh Zaeem, K. Suzanne Barber, Manah M. Khalil, Michael R. Lamison, Siddhartha Pandey, UT CID Report #21-02, August 2021

Show Abstract

In the absence of a unique identity layer on the Internet, many identity solutions have evolved over time—examples include standalone username and password pairs, Single Sign On, and Federated Identity Management. Privacy and security risks for identity owners and liability for identity issuers and verifiers, however, are still alarmingly present. Self-Sovereign Identity (SSI) solutions are new technologies that recognize the need to keep user identity privately stored in user-owned devices, securely verified by identity issuers, and only revealed to verifiers and relying parties as needed. Many commercial SSI solutions are already available to users, issuers, and verifiers. As other researchers have pointed out, usability remains a pressing unknown in the existing SSI solutions. We study five of the most commonly used SSI solutions: uPort, Connect.me, Trinsic, Jolocom, and ShoCard (now PingID) with respect to their usability. We identify some concrete usability problems and suggest ways to resolve them. Our work recognizes that identifying, prioritizing, and implementing the non-functional requirement of usability in SSI solutions is essential for their adoption.

 

Access Publication: Download PDF of Report

What Makes a Privacy Policy Need Automatic Summarization? Investigation of Readability, Length, and Category in Usage Patterns of Privacy Enhancing Technologies
Razieh Nokhbeh Zaeem, K. Suzanne Barber, UT CID Report #21-01, August 2021

Show Abstract A thriving field of research develops Privacy Enhancing Technologies (PET) that utilize a variety of machine learning, natural language processing, and crowd sourcing methods to automatically summarize long and hard-to-read online privacy policies. Very few researchers, however, have looked at how and why users actually run these PET tools. We present the first work to investigate the usage patterns of such tools to identify what features of a privacy policy make users interested in running PETs. We consider PrivacyCheck and Polisis, two well-known PET tools available as browser extensions. After collecting the privacy policies on which a PET tool is executed, we perform null hypothesis test-ing to see if there is a statistically significant difference between the readability, length, and category of the privacy policies of interest to PET users and a control group of 68K+ policies from the websites of the DMOZ project. We report the following findings: (1) In 20221, at least 16 years of education are required to understand an average privacy policy in the control group, which has an average length of over 2K words. (2) We observe no statistically significant difference between the read-ability or length of the policies in the control group and those on which PET tools are executed. (3) Users are keen on running PET tools on privacy policies that be-long to particular categories. Most notably, privacy polifcies of the Games websites were almost four times, and those from Computers, and Kids and Teens websites were more than three times more likely to be investigated with PET tools, compared to the control group. Our work motivates and guides the flourishing field of PET tools and enlightens privacy policy users, writers, and regulators alike.

 

Access Publication: Download PDF of Report