1. Shuyuan Mary Ho iSchool, Syracuse University http://web.syr.edu/~smho/
1st International Workshop
Social Computing, Behavioral Modeling & Prediction 2008
Attribution-based Anomaly Detection: Trustworthiness in an Online Community
Shuyuan Mary Ho
iSchool, Syracuse University

2. Conceptual Framework Problem Statement Insider Threats
refers to situations where a critical member of an organization behaves in a way that is against the interests of the organization, generally in an illegal and/or unethical manner.
Problem Statement
Information
Behavior
Organizational
Norm
attribute (assign)
meaning
Social Network
Intention
Trustworthiness
Org. communications
Observation/attribution B1 B2 B3 Bn
A’s social network A
Borg
B’s expectation of
A’s ability/competence
as a result of observing A’s behavior
in org. communications
over time
Unknown
But, the real problem lies in A’s integrity (characteristics) contaminated by either internal or external factors
12/6/2018
Behavioral Anomaly Detection

3. What is Trustworthiness?
A quality, disposition or characteristics of a person, influenced by intention
Defined as:
the generalized expectancy, a subjective probability, toward a target employee’s degree of correspondence between communicated intentions and behavioral outcomes that are observed and evaluated over time (Rotter, 1980 & 1967).
In other words, the degree to which the relationship between the target’s words and actions remain reliable, ethical and consistent, and any fluctuation in this relationship does not exceed the observer’s expectations over time (Hardin, 1996: 28).
My question is: What changes of behaviors reflect a downward shift in the trustworthiness of a critical member which signals possible insider threats in a virtual organization?
12/6/2018
Behavioral Anomaly Detection

4. Method: The Leader’s Dilemma Game
The target A’s behavioral change must be noticeable (distinctive) for others to perceive it.
The consistency between the target’s words and actions was evaluated by these observers (Kelley, 1973) over time until a given set of tasks were completed.
Consensus among B’s observation (perception) of target A must obtain.
12/6/2018
Behavioral Anomaly Detection