Profiling Model. Chapter Introduction

Transcription

1 Chapter 4 Profiling Model This chapter discusses various aspects of profiling that include personality indicators, profile types and its generation methodology etc. The psychological and social sciences views about profiling have also been presented. An agent based profiling model has been developed on.net and recognized agent platform of JADE. Many problems have been identified and resolved during study and development. The major components of the profiling model suggested are Honeypot, software agents and profile attributes. The major focus in the model was on the problems of profile compatibility, profile publishing, profile matching and internet resource rating. The purpose of the model was to create a social community of the peoples having common interests and guard and guide the internet users. The model was tested and results have also been presented. 4.1 Introduction Profiling is the process of collecting information about a specific individual or category of individuals (Martin et al, 2003). The increasing usage of cyber resources like forums, chat groups, browsing, demands the modeling of a framework that may use an individual s personality profile for simulating actual personality in the cyberspace and acting as a guard and guide for the respective user by determining internet resource suitability. This also aims to monitor and analyze users social interactions with other users on the web. The purpose is not to develop a complete model but just a milestone towards profiling for network security. There are many other indicators that are used to know the actual personality or interests of the internet user that have been mentioned in Honeypot section. On the basis of interests in games, music, and other indicators the age, sex, ethnicity, country have been tried to detect. Though the more focus is on interests but parallel to that work has also been proposed for other attributes as well that are discussed in the proposed model. 43

2 The objective is to exploit some concepts of psychology and cognitive theories to present a model of an agent framework where agents, having social capability, will monitor the activities of internet users to build and update profiles to build socioculture community of the similar interests in the cyberspace. Framework also guides the users what is good and what is bad for them on the internet according to their profile. This model is the milestone towards a big task of the development of an agent framework to build profiles of the users to monitor activities against insider threat, discussed in the earlier chapter. 4.2 Justification and Background study In the cyberspace people hide their personality attributes such as age, ethnicity, culture, religion, interests, etc. Therefore a clear difference always remains there between interactions that occur in cyberspace and in real life. There is need to monitor internet user activities through various indicators. For example recording browsing history of an internet user will help to identify the interests of the user, to know the age and the gender some random questions may be asked and keep their track to know the actual personality (John Suler, 2005; Michael Pazzani and Daniel Billsus, 2004). The major steps to achieve the target are: Create, maintain and update the profile of Internet users to use it as control and guide the user s internet experience. Closely monitor and observe the internet usage pattern of users that will help to update users generated profiles. Provide decision support for profile compatibility with certain internet resources and other profiles. 4.3 Honeypot and personality indicators Honeypot is a tool that is used to collect information about a user passing through monitored area. Honeypot can log the activities of the monitored user or a hacker. Hacker could be fooled with the feeling about the access of a corporate network. Unlike firewalls or intrusion detection system, Honeypot does not solve a specific problem. The importance of Honeypot is in its ability to follow the movements (Lance 44

3 Spitzner, 2002). Using the concept of Honeypot, a website will be designed that will attract the users. It will track internet usage patterns of the users. The number and type of Honeypot website resources are not fixed. Five basic components, to be discussed later, have been selected that are commonly accessed by internet users. Honeypot administrator can change components at any time. Various researchers have identified many indicators to know actual personality of the internet users (J. Goecks and J. Shavlik, 2000). Few of them are discussed and implemented in the proposed model. Website access total time is a good predictor that signs that if a user stays more time on a webpage it shows level of interest of that user. It is usually known as the moment length from user s visit to leaving the website that is calculated in unit of time. The Honeypot website records all activities including webpage reading time etc. Many issues are identified that are to be addressed in the targeted framework. The second indicator is movement of the mouse that is calculated through x and y coordinates on the active Honeypot website. Mostly users take interest in movement of the mouse during window text reading or take interest to look at attractive objects on the webpage. Some users are interested in movement of the mouse only to click on appealing links. Here it is assumed that mouse movement has directly proportion to the interest of the user with webpage. The third indicator is the scrollbar movement, where it is assumed that distance of scrollbar movement has directly proportion to the interest of the users. Users do not access the contents regularly and they search the page for interesting links. Sometimes scrolling by just clicking on the scroll bar is used and sometimes clicking and dragging the scrollbar is opted. The distance is summated on Honeypot website when user scrolls horizontal and vertical scrollbars. The fourth indicator is the mouse clicks, where it is assumed that if number of clicks on mouse on the webpage is greater that reflects that a user is more interested in it. A variable that counts mouse clicks will be incremented by 1 whenever mouse button is pressed. Text highlighting is assumed when button of mouse is pressed at some position and released at different position on the webpage. The fifth indicator is highlighting the text, where it is assumed that the user highlights the text in the interesting webpage. 45

4 The sixth indicator is the number of visits on a webpage, where it is assumed that user visits interesting webpage again and again. The seventh indicator is the recently visited webpage, where it is assumed that the user is more interested in the recently visited webpage. The score will always be higher than the other pages if a user recently visited the website. The eighth indicator is the use of buttons/ctrl key button, where it is assumed that operations of bookmarking, copy/paste, etc will be performed in the interesting webpage. Buttons with the combination of Ctrl presents interests of the users. Likewise, many other indicators have been explored by researchers to identify the actual activity of the internet users. Few of the indicators have been implemented in the model according to the need. 4.4 Profile Generation A user will be represented in cyberspace with a profile. Therefore the existence of profile is pre-requisite in digital persona (Silvia Schiaffinol and Analía Amandi, 2000). Psychologists and cognitive scientists accord to the fact that behaviors are related to individual s personality patterns that include age group, gender, education, personal interests etc. Age group, country, ethnicity, gender, and interests are identified as basic personality profile elements. The specification is not restrictive in terms of these elements. More personality profile elements can be employed when identified (Angleman, S., 2001; Malle, B. F. and Knobe, S., 1998) Types of Profiles Two different types of personality profiles are being maintained, each of which comprises of psychological factors identified above. Manual Profile: The information that user provides while registering with Honeypot is added to the knowledge base. The user is trusted one and the profile is manual. 46

5 Generated Profile: The profile is built through Honeypot website when a user performs certain activities. These activities include browsing, visiting chat rooms, news groups and playing games Profile Generation Methodology Mapping of the Honeypot resources with psychological factors must be maintained to identify the actual personality. For example, a user visiting a link which includes political news is quite possibly relating to a mature age group. The detailed indicators have been discussed earlier. 4.5 Software agent Framework Software agents are computational systems that live in a dynamic environment; sense and act independently to achieve the objective for which they are designed (P. Maes, 2004). Agent platforms provide supporting execution environment to the agents. JADE has been selected to employ the proposed model (Zhao and Zhiming, 2007). Honeypot website is linked with an agent framework as agent may play their part behind the scene. While implementation, it was identified that web servers do not support agent frameworks for the reason of their synchronous communication nature (figure 18). After a detailed survey and investigation, Java applets were considered to be appropriate web application interface. Figure 18: A typical synchronous model 47

6 4.6 Proposed Model As formerly pointed out, agent-oriented approach has been employed to address the problem. The specification includes three basic components: Honeypot website, Agents, and Profiles (figure 19). Following steps are needed to develop the model. A honeypot website is used to monitor user activities and provide them controlled internet access. The monitoring capability of the honeypot will be used to generate persistent user personality profiles. The personality profiles are then used to take decisions which include internet resource suitability and profile compatibility. A web monitor needed to track and record the internet usage pattern of the users. The complete browsing history of the users will be maintained. A rating system will offer evaluation for a web resource on certain parameters. Figure 19: Components of the proposed model JADE was chosen to incorporate the appropriate agent framework. Proxy agent at the web server will be generated for each request or session. The actual agent (social agent) resides in the JADE container. Whenever an http request of the user arrives to 48

7 the web server, the proxy agent sends a message to the social agent. Since each user is identified with the social agent. To ease the absolute routing of the message to the correct social agent the intermediate agent, Bridge agent, is developed that receives message from the proxy agent forwards to the concerned social agent. Because of this bridge agent resides in the main container and acts as a bridge between the social agent and the proxy agent (figure 20). When a new user registers and logs in the system, a social agent will be created. There will be a separate social agent for every registered user. Two proxy agents, ProxyCreatorAgent and ProxyMessageAgent, are used where ProxyCreatorAgent will send message to bridge agent to create a social agent for newly registered user, while ProxyMessageAgent will just pass message request to bridge agent for particular social agent. 49

8 Figure 20: Communication model 4.7 Identified problems and their solution These are the problems that were faced during implementation and their proposed solutions Profile Compatibility The issue of profile compatibility requires attention to determine the parameters of benevolence. Principle of maximum expected utility concept (Katia Sycara and Seth Widoff, 2002) is applied to address this issue. It works in the following way. Social agent A s utility maximizes upon interaction with social agent B, when the quantum of profile compatibility is high. By high means that utility of A must reach a utility-minimum when it interacts with B. 50

9 4.7.2 Publishing Profiles It is not feasible to continue the process of matching profiles at user request time. As result it would fall in unbearable response time. The proposed strategy is to maintain a list of matching profiles in the knowledge base. On the next stage, whenever compatibility is to be determined, the list can be consulted. Nevertheless, to put away the list from producing obsolete results, the matching list must be updated periodically. The list is needed to be continuously updated because the generated profiles are dynamic in nature. Since agent A is the only one having access to its profile, or for that matter, profile of the user with whom agent A has been associated, agent A periodically publishes a summary of its profile. That summary is received by each agent in the agent population and hence is used for updating the matching list Matching Profiles After obtaining one more agent s profile by a certain agent, the question at hand is that of making the decision of profile compatibility. As previously mentioned, the proposed methodology is maximum expected utility (Eric Jacquier, 2005). The concept of Decision Networks has been employed to answer this question. If personality profile of an agent is considered as a decision node and psychological factors as chance nodes, then all that required is an appropriate utility function to calculate the maximum expected utility. Figure 21 illustrates the concept. 51

10 Figure 21: Maximum Expected Utility Since probabilistic data is dealt with, therefore the most appropriate utility function, additive value function is implemented. The additive value function is as follows. The calculated utility will always remain between 0 and Internet Resource Ratings The existing rating systems have many limitations, such as limited attributes, hidden database of keywords, restricted to the culture of specific community, etc. To overcome all these limitations a rating system has been developed that is according to the culture, regional ethics, and the own defined attributes (MIR, 2006; ICRA, 2006). Detailed architecture and the tables are given as appendix. The rating system uses the growing database technique that follows the dynamic algorithm which is given as under. First time execution: Find all keywords Find respective category of keywords Rate the document on the basis of found category 52

11 Add remaining words in same category, with minimum weight Next time execution: Rate the document and get %age Increase the weight of all words according to that %age Weight should be in the range of Discussion An agent framework has been proposed that observes the activities especially browsing experience of a user in cyberspace. User signs up with basic information, manual profile, and signs-in to the Honeypot website to use the internet resources. The social agents working at backend will be generated or triggered to record user s activities. On the completion of the maturity period, users manual and generated profile will be matched and evaluated critically to identify actual profile of the user. The framework helps to create virtual social community in the cyberspace where users are guarded and guided to use internet resources according to their actual profiles and the interests. There are many limitations to the proposed model because the proposed model is just a milestone to the final objective. The first limitation of the model is that there are many psychological issues that have not been addressed. The other main problem of the model is that the proposed rating system does not provide ratings for all types of internet resources like forums, languages other than English, multimedia content sites etc. The social agents in the proposed model cannot immediately start producing results which can be said to reflect the preferences or personality profile attributes of the corresponding user. Initially the agent will be guided by only the manual profile of the user. The learning curve of the agent is dynamic and dependent upon the user s amount of interaction with it. 4.9 Summary The summary of the proposed models is shown in table 3 whereas results screenshots are given in appendices. Vulnerability Assessment (VA) model and profiling model have been implemented in two different ways. VA model and profiling model are implemented in agent framework (Jade and Aglets) and.net 53

12 framework. As this is qualitative research therefore their results cannot be compared quantitatively whereas qualitatively it can be concluded that standardized agent platform is appropriate approach to design agent based model. Table 3: Development of Models through different technology Hence it is concluded that.net framework supports many advanced tools and technologies therefore and agent platform on the top of the.net framework is proposed to develop agent based projects. 54