Shuyuan Mary Ho iSchool, Syracuse University http://web.syr.edu/~smho/ 1st International Workshop Social Computing, Behavioral Modeling & Prediction 2008 Attribution-based Anomaly Detection: Trustworthiness in an Online Community Shuyuan Mary Ho iSchool, Syracuse University http://web.syr.edu/~smho/

Conceptual Framework Problem Statement Insider Threats refers to situations where a critical member of an organization behaves in a way that is against the interests of the organization, generally in an illegal and/or unethical manner. Problem Statement Information Behavior Organizational Norm attribute (assign) meaning Social Network Intention Trustworthiness Org. communications Observation/attribution B1 B2 B3 Bn A’s social network A Borg B’s expectation of A’s ability/competence as a result of observing A’s behavior in org. communications over time Unknown But, the real problem lies in A’s integrity (characteristics) contaminated by either internal or external factors 12/6/2018 Behavioral Anomaly Detection

What is Trustworthiness? A quality, disposition or characteristics of a person, influenced by intention Defined as: the generalized expectancy, a subjective probability, toward a target employee’s degree of correspondence between communicated intentions and behavioral outcomes that are observed and evaluated over time (Rotter, 1980 & 1967). In other words, the degree to which the relationship between the target’s words and actions remain reliable, ethical and consistent, and any fluctuation in this relationship does not exceed the observer’s expectations over time (Hardin, 1996: 28). My question is: What changes of behaviors reflect a downward shift in the trustworthiness of a critical member which signals possible insider threats in a virtual organization? 12/6/2018 Behavioral Anomaly Detection

Method: The Leader’s Dilemma Game The target A’s behavioral change must be noticeable (distinctive) for others to perceive it. The consistency between the target’s words and actions was evaluated by these observers (Kelley, 1973) over time until a given set of tasks were completed. Consensus among B’s observation (perception) of target A must obtain. 12/6/2018 Behavioral Anomaly Detection