A temporal graph framework for intelligence extraction in social media networks

2023 | Information & Management | Citations: 0

Authors: Chung, Wingyan; Lai, Vincent S.

Abstract: Social media networks (SMNs) are increasingly used in professional management of ... Expand

Abstract: Social media networks (SMNs) are increasingly used in professional management of knowledge workers and related assets. However, the factors affecting behavioral trends and activity levels in these networks are not well understood. Although social and cognitive theories can help to explain human behavior in traditional social networks, their application to SMNs has not been validated. Traditional social network modeling techniques may not accurately predict real-world SMN activities. This research developed a temporal graph framework for in­ telligence extraction in SMNs. Theory-based, data-driven models (Conformity Model (COM), Recency-Primacy Model (REM), Trend Interaction Model (TIM), Periodic Interaction Model (PIM)) were developed based on the framework to capture various aspects of user behavior: conformity effect, recency, primacy, periodicity, and dynamic trend. The models capture the activity history and dynamically combine pricing information to enhance predictive accuracy. Using data of 83,536 GitHub software repositories on cryptocurrency, this article reports the results of experiments that compare the models’ performance in predicting SMN activities over time. Experi­ mental results show that the model (REM) that captures recency/primacy effects of human cognitive processing outperformed other models in 9 (out of 18) measures pertaining to engagement, contribution, influence, and popularity. Primacy plays a dominant role in predicting engagement, contribution, and popularity, whereas recency plays a key role in predicting influence. Short-term trend (modeled with TIM) was found to yield significantly better performance on predicting user contribution. The models also outperformed an integrated machine learning (IML) model by most measures. Overall, the effects modeled by REM and TIM were found to be more significant than the effects modeled by COM, PIM, and IML. The research contributes to enhancing un­ derstanding of SMN behavior, developing new models to simulate and predict SMN activities, and designing new artifacts for information systems practitioners to manage knowledge assets and to extract SMN intelligence. Collapse

Topics: cryptocurrency social network systems development situation awareness user behavior

Methods: experiment machine learning longitudinal research computational algorithm time series analysis

Theories: psychological theory social contagion theory social interactionist theory social impact theory social sciences theory

Clustering and Topological Data Analysis: Comparison and Application

2023 | HICSS | Citations: 0

Authors: Combs, K.; Bihl, T.

Abstract: Clustering is common technique used to demonstrate relationships between data a ... Expand

Abstract: Clustering is common technique used to demonstrate relationships between data and information. Of recent interest is topological data analysis (TDA), which can represent and cluster data through persistent homology. The TDA algorithms used include the Topological Mode Analysis Tool (ToMATo) algorithm, Garin and Tauzin's TDA Pipeline, and the Mapper algorithm. First, TDA is compared to ten other clustering algorithms on artificial 2D data where it ranked third overall. TDA had the second-highest performance in terms of average accuracy (97.9%); however, its computation-time performance ranked in the middle of the algorithms. TDA ranked fourth on the qualitative "visual trustworthiness" metric. On realworld data, TDA showed promising classification results (accuracy between 80-95%). Overall, this paper shows TDA is a competitive algorithm performancewise, though computationally expensive. When TDA is used for visualization, the Mapper algorithm allows for unique alternative views especially effective for visualizing highly dimensional data. Collapse

Topics: Python cloud computing missing data

Methods: computational algorithm cluster analysis DBSCAN agglomerative hierarchical clustering BIRCH

Cyber threat detection: Unsupervised hunting of anomalous commands (UHAC)

2023 | Decision Support Systems | Citations: 0

Authors: Kayhan, Varol O.; Agrawal, Manish; Shivendu, Shivendu

Abstract: The cyber security industry is rapidly adopting threat hunting as a proactive to ... Expand

Abstract: The cyber security industry is rapidly adopting threat hunting as a proactive tool for early and faster detection of suspected malicious actors. In this paper, we propose a machine learning-based method, Unsupervised Hunting of Anomalous Commands (UHAC), to detect text-based anomalous commands in security information and event management (SIEM) logs that are good candidates for threat hunting. A unique feature of the proposed method is that it first creates a feature set based on the augmentation of document-term and document-character matrices. Then, an autoencoder-based detector is trained on this feature set using a custom loss function. UHAC consis­ tently outperforms other feature sets and algorithms such as one-class support vector machine, density-based spatial clustering of applications with noise, and word-embedding based models such as word2vec. The UHAC detector identifies 84–89% of anomalies in the top 10% of the data. Findings have implications for cybersecurity analysts who perform threat hunting in SIEM logs for process auditing on endpoint devices. Collapse

Topics: IT security artificial intelligence Python decision support system email phishing

Methods: autoencoder data transformation DBSCAN anomaly detection machine learning

Unsupervised Threat Hunting using Continuous Bag of Terms and Time (CBoTT)

2023 | International Conference on Information Systems | Citations: 0

Authors: Kayhan, Varol; Shivendu, Shivendu; Behnia, Rouzbeh; Daniel, Clinton; Agrawal, Manish

Abstract: Threat hunting is sifting through system logs to detect malicious activities th ... Expand

Abstract: Threat hunting is sifting through system logs to detect malicious activities that might have bypassed existing security measures. It can be performed in several ways, one of which is based on detecting anomalies. We propose an unsupervised framework, called continuous bag-of-terms-and-time (CBoTT), and publish its application programming interface (API) to help researchers and cybersecurity analysts perform anomaly-based threat hunting among SIEM logs geared toward process auditing on endpoint devices. Analyses show that our framework consistently outperforms benchmark approaches. When logs are sorted by likelihood of being an anomaly (from most likely to least), our approach identifies anomalies at higher percentiles (between 1.82-6.46) while benchmark approaches identify the same anomalies at lower percentiles (between 3.25-80.92). This framework can be used by other researchers to conduct benchmark analyses and cybersecurity analysts to find anomalies in SIEM logs. Collapse

Topics: IT security application programming interface Hadoop Distributed File System website web analytics

Methods: natural language processing artificial neural network support vector machine term frequency–inverse document frequency DBSCAN

User-Centered Visual Design of Alarms in Manufacturing Dashboards: Insights on Comprehensibility and Preferences

2023 | International Conference on Information Systems | Citations: 0

Authors: Stahmann, Philip; Gravemeier, Laura; Dittmer, Anke; Janiesch, Christian; Thomas, Oliver

Abstract: The digitization of the manufacturing domain results in an enormous amount of a ... Expand

Abstract: The digitization of the manufacturing domain results in an enormous amount of available data decision-makers are continuously exposed to. Consequently, critical alarm information must be easily comprehensible and suit decision-makers' preferences to facilitate timely reactions and thus prevent harm to production processes and employees. However, despite its importance, academia and practice show little consensus regarding alarm design in manufacturing dashboards. Against this background, the purpose of our study is twofold. First, we identified 5 factors for visual alarm design with overall 12 design options in a structured literature review. Second, we investigated the effect these design options have on users' comprehension and preferences in a conjoint study and a best-worst scaling approach with 98 participants with experience working in manufacturing. Our results show that alarm description and their visual integration are the most important factors for alarm design. In this regard, a cluster analysis reveals more nuanced and more stable preferences in more experienced users. Further, we find that color-coding-based content classification entails best performance in recognizing alarms. We contribute to academia and practice by providing actionable insights that may support improving alarm design in manufacturing. Collapse

Topics: digital dashboard usability user interface virtual reality tablet

Methods: cluster analysis machine learning structured literature research descriptive statistic factorial experiment

Towards a Better Characterization of IT Career Development Patterns

2023 | Americas Conference on Information Systems | Citations: 0

Authors: Wang, Yiwei; Meng, Qingxin; Chong, Alain; Zhu, Hengshu

Abstract: The career development patterns in the IT industry remain unrevealed, with exis ... Expand

Abstract: The career development patterns in the IT industry remain unrevealed, with existing research only focusing on the lateral job mobility and the job level changes were ignored. Revealing career development patterns necessitates the observation of a considerable number of individual career trajectories. However, data preparation is a demanding and expensive task, and the limited sample size results in coarse-grained career patterns. Digital professional platforms now allow for the accumulation of substantial amounts of realworld career trajectories, creating an unparalleled chance to uncover patterns. This paper develops a datadriven career pattern mining method: Density-Equilibrium Career Paths Pattern Mining (DECPPM), which overcomes the challenges of huge cardinality and job title imbalance that impede effective job title clustering and pattern mining. Using DECPPM, we uncover the career development patterns of IT professionals in terms of both job function and job level changes. Furthermore, we characterize the career patterns of IT individuals in different job levels from a multidimensional and temporal perspective, contributing to the literature on the relationship between career mobility and career success. Collapse

Topics: IT career IT workforce personality

Methods: cluster analysis statistical hypothesis test DBSCAN parametric test ANOVA

A Practical and Empirical Comparison of Three Topic Modeling Methods using a COVID-19 Corpus: LSA, LDA, and Top2Vec

2023 | HICSS | Citations: 0

Authors: Zengul, F.; Bulut, A.; Oner, N.; Ahmed, A.; Yadav, M.; Gray, H.; Ozaydin, B.

Abstract: This study was prepared as a practical guide for researchers interested in usin ... Expand

Abstract: This study was prepared as a practical guide for researchers interested in using topic modeling methodologies. This study is specially designed for those with difficulty determining which methodology to use. Many topic modeling methods have been developed \variation and combination of these techniques. For researchers from disciplines other than computer science may find it challenging to select a topic modeling methodology. We compared a recently developed topic modeling algorithm Top2Vec with two of the most conventional and frequently-used methodologiesLSA and LDA. As a study sample, we used a corpus of 65,292 COVID-19-focused abstracts. Among the 11 topics we identified in each methodology, we found high levels of correlation between LDA and Top2Vec results, followed by LSA and LDA and Top2Vec and LSA. We also provided information on computational resources we used to perform the analyses and provided practical guidelines and recommendations for researchers. Collapse

Topics: Python laptop computer cloud computing pandemic

Methods: topic model data transformation uniform manifold approximation and projection Gensim descriptive statistic

Transformer-Based Multi-Task Learning for Crisis Actionability Extraction

2023 | International Conference on Information Systems | Citations: 0

Authors: Zhang, Yuhao; Lo, Siaw Ling; Myint, Phyo Yi Win

Abstract: Social media has become a valuable information source for crisis informatics. W ... Expand

Abstract: Social media has become a valuable information source for crisis informatics. While various methods were proposed to extract relevant information during a crisis, their adoption by field practitioners remains low. In recent fieldwork, actionable information was identified as the primary information need for crisis responders and a key component in bridging the significant gap in existing crisis management tools. In this paper, we proposed a Crisis Actionability Extraction System for filtering, classification, phrase extraction, severity estimation, localization, and aggregation of actionable information altogether. We examined the effectiveness of transformer-based LSTM-CRF architecture in Twitter-related sequence tagging tasks and simultaneously extracted actionable information such as situational details and crisis impact via Multi-Task Learning. We demonstrated the system's practical value in a case study of a real-world crisis and showed its effectiveness in aiding crisis responders with making well-informed decisions, mitigating risks, and navigating the complexities of the crisis. Collapse

Topics: Twitter social media systems design hurricane knowledge base

Methods: BERT case study GloVe machine learning experiment

Trace Clustering for User Behavior Mining

2022 | European Conference On Information Systems | Citations: 0

Authors: Abb, Luka; Bormann, Carsten; Aa, Han van der; Rehse, Jana

Abstract: Business information systems support a large variety of business processes and ... Expand

Abstract: Business information systems support a large variety of business processes and tasks, yet organizations rarely understand how users interact with these systems. User Behavior Mining aims to address this by applying process mining techniques to UI logs, i.e., detailed records of interactions with a system's user interface. Insights gained from this type of data hold great potential for usability engineering and task automation, but the complexity of UI logs can make them challenging to analyze. In this paper, we explore trace clustering as a means to structure UI logs and reduce this complexity. In particular, we apply different trace clustering approaches to a real-life UI log and show that the cluster-level process models reveal useful information about user behavior. At the same time, we find configurations in which trace clustering fails to generate satisfactory partitions. Our results also demonstrate that recently proposed representation learning techniques for process traces can be effectively employed in a realistic setting. Collapse

Topics: user behavior enterprise resource planning usability Python source code

Methods: cluster analysis data transformation DBSCAN autoencoder business process modeling

A collaborative decision support system for multi-criteria automatic clustering

2022 | Decision Support Systems | Citations: 0

Authors: Jabbari, Mona; Sheikh, Shaya; Rabiee, Meysam; Oztekin, Asil

Abstract: Automatic clustering is a challenging problem, especially when the decision-make ... Expand

Abstract: Automatic clustering is a challenging problem, especially when the decision-maker has little or no information about the nature of the dataset and the criteria of interest. There is a lack of generalizability in the current validity indexes (VI) for automatic clustering algorithms, as each considers a limited number of objectives and mostly ignores the other aspects of clustering validation. The proposed framework benefits from collaboration among selected evolutionary algorithms. A mixed-integer non-linear programming model is developed, and a framework is proposed for a six-step decision support system to solve it. The decision-maker (DM) selects the quantitative (primary) VIs and the evolutionary algorithms. Given DM’s knowledge on the dataset and VIs, DM can incorporate qualitative (secondary) VIs. DM determines the quality threshold for each VI and runs the evolutionary algorithms separately. The DSS then saves the best obtained value of VIs in order to prepare the input necessary to construct the aggregated function. Based on the selected primary VIs, a new normalized aggregated function is developed and solved repeatedly using the randomly selected or predefined weights of importance. Eventually, DM employs a proper DEA model to define the final clustering output among all possible solutions. Given multiple efficient solutions, the best-worst method and a multi-criteria decision-making approach are applied to find the final output. The applicability of the proposed approach is illustrated on a synthetic and two secondary datasets, and the result at each step is discussed in detail. Collapse

Topics: decision support system information exchange decision support

Methods: computational algorithm cluster analysis mathematical model DBSCAN descriptive statistic