Visible to the public USE: User Security Behavior (CMU/Berkeley/University of Pittsburgh Collaborative Proposal) - October 2015Conflict Detection Enabled

Submitted by Jamie Presken on Thu, 09/17/2015 - 7:24am

Public Audience
Purpose: To highlight progress. Information is generally at a higher level which is accessible to the interested public.

PI(s): A. Acquisti, L.F. Cranor, N. Christin, R. Telang
Researchers: Alain Forget (CMU), Serge Egelman (Berkeley), and Scott Beach (Univ of Pittsburgh)

1) HARD PROBLEM(S) ADDRESSED (with short descriptions)
This refers to Hard Problems, released November 2012.

5. Understanding and Accounting for Human Behavior

The Security Behavior Observatory addresses the hard problem of "Understanding and Accounting for Human Behavior" by collecting data directly from people's own home computers, thereby capturing people's computing behavior "in the wild". This data is the closest to the ground truth of the users' everyday security and privacy challenges that the research community has ever collected. We expect the insights discovered by analyzing this data will profoundly impact multiple research domains, including but not limited to behavioral sciences, computer security & privacy, economics, and human-computer interaction.

2) PUBLICATIONS
Report papers written as a results of this research. If accepted by or submitted to a journal, which journal. If presented at a conference, which conference.

A. Forget, S. Pearman, J. Thomas, A. Acquisti, N. Christin, L.F. Cranor, S. Egelman, M. Harbach, R. Telang. "'My Daughter Fixes All My Mistakes': A Qualitative Study on User Engagement and Computer Security Outcomes." Submitted for peer-review to ACM CHI 2016.

A. Forget, S. Komanduri, A. Acquisti, N. Christin, L.F. Cranor, R. Telang. "Security Behavior Observatory: Infrastructure for Long-term Monitoring of Client Machines." Carnegie Mellon University CyLab Technical Report CMU-CyLab-14-009. https://www.cylab.cmu.edu/research/techreports/2014/tr_cylab14009.html (accessed 2014-09-05)

A. Forget, S. Komanduri, A. Acquisti, N. Christin, L.F. Cranor, R. Telang (2014). Building the Security Behavior Observatory: An Infrastructure for Long-term Monitoring of Client Machines. Invited talk and poster at the IEEE Symposium and Bootcamp on the Science of Security (HotSoS) 2014.

By its very nature, this project has a long setup phase. Building an infrastructure to collect data this robust from home computers with a wide variety of configurations has been a challenge, and it took significant time to establish and test a reliable infrastructure and to begin building a participant sample and dataset large enough for meaningful analysis. Now that we have a greater number of higher-quality sensors and participants sending us data for at least a few consecutive months, our research and data analysis has begun to result in publication submissions.

We are happy to report that this quarter, we submitted a paper to the ACM CHI 2016 conference, the premier international human-computer interaction conference. This paper combined the quantitative data collected via this infrastructure with qualitative findings from interviews with our research participants. As we continue to build more secure, reliable, and robust infrastructure, we will acquire more and better data, resulting in more publications.

We are currently considering where to submit a paper to more thoroughly describe the SBO infrastructure and to showcase more of the results we have gathered so far. On-going work also includes performing data analysis on validating our UC Berkeley collaborator's Security Behavior Intentions Scale (SeBIS) with early data from the SBO. Finally, we also hope to compile the lessons learnt about building and launching such a large-scale field study into another publication.

3) KEY HIGHLIGHTS

  • We recently submitted a paper for peer-review to the ACM CHI 2016 conference, the premier international human-computer interaction conference, on the relationships between users' self-reported engagement securing their computers and the actual security states and outcomes on their machines.
  • We have successfully deployed not only version 2.0 but also version 3.0 of our client data collection sensor, which contains improvements to the event log sensor, the Internet Explorer and Firefox sensors, the registry sensor, the wireless network sensor, the Windows Management Interface sensor, and the addition of a client control service.
Groups: