Introduction

In this chapter, we describe the unique challenges to the important problem of sociocultural modeling of cyber threat actors and why they necessitate further advances in artificial intelligence—particularly with regard to interdisciplinary efforts with the social sciences.

Cybersecurity is often referred to as “offense dominant” alluding to the notion that the domain generally favors the attacker [67]. The reasoning behind this is simple: a successful defense requires total control over all pathways to a system while a successful attack requires only one. As a result, any given cyber-defense based on the hardening of systems will fall prey to a cyberattack as perpetrators gain knowledge and resources. Solutions have ranged from sophisticated adaptive defense strategies to offensive cyber-operations directed against malicious hackers. However, these methods have various technical shortcomings—which range from the technical immaturity of adaptive defenses to consequences of aggressive cyber-counteroperations. This process can lead to undesirable effects such as preemptive and preventative cyber war.

More and more, the cybersecurity industry has been moving toward the threat intelligence that we have been highlighting throughout the book, with the end goal being to preempt cyber-attacks before they occur. Discussed thoroughly in Chapter 3, a key source of cyber threat intelligence lies in the digital communities of malicious hackers—consisting of sites, markets, chat-rooms, and social media channels where information is shared, hackers are recruited, and the latest malware and exploits are bought and sold. Artificial intelligence and machine-learning techniques for analyzing communities on the Internet are long-established across specialty areas such as data-mining, information retrieval, and web science. However, we argue that the study of hacker communities combined with the goal of automating the collection and analysis of information about the activity of cyber threat actors, produces some very unique challenges. In this chapter, we describe some unique characteristics of cyber threat sociocultural environments and several challenging modeling problems for which various artificial intelligence techniques can be used to help solve.

Environmental Characteristics

When introducing hacker communities in Chapter 3, we studied them from a qualitative standpoint. We noted several unique characteristics in the online sociocultural environments frequented by malicious hackers that make these communities distinct from other groups. Some of these characteristics include the following.