A DISARM-based semantic model for Disinformation Attack Attribution

Replication for the paper:

Cavaliere, D., Fenza, G., Furno, D., & Loia, V. (2024). A semantic model bridging DISARM framework and Situation Awareness for disinformation Attacks Attribution. 2024 IEEE Conference on Cognitive and Computational Aspects of Situation Management (CogSIMA), 55-62.

available at: https://www.semanticscholar.org/paper/A-semantic-model-bridging-DISARM-framework-and-for-Cavaliere-Fenza/a9ded365f3c9cb0c8c77e5792ec8f76c44d16338

contacts:

For any questions or contributions, please contact (mailto:dcavaliere@unisa.it), (mailto:gfenza@unisa.it), (mailto:dfurno@unisa.it).

Description

This article presents a knowledge-based approach that exploits the DISARM framework inheriting Cybersecurity principles alongside Situation Awareness concepts to provide analysts with a robust and exhaustive model to analyze and fight back disinformation attacks through the extraction of threat actors’ behaviors by reasoning on their attack patterns.

Dataset

The DISARM Ontology Dataset is a structured dataset designed for the analysis of disinformation incidents and campaigns using the DISARM framework. It captures attack patterns through the phases, tactics, and techniques employed by threat actors, providing crucial insights for disinformation risk assessment and research.

Contents

• Phases: Various stages of disinformation campaigns.
• Tactics: Methods used by threat actors during different phases.
• Techniques: Specific actions taken to implement tactics.

Key Features

• Structured Data: Organized to facilitate the analysis of disinformation incidents.
• DISARM Framework: Captures attack patterns in terms of phases, tactics, and techniques.
• Risk Assessment: Supports the evaluation of disinformation risk levels.
• Research Utility: Aids in understanding and mitigating disinformation threats.

Ontological Representation

The ontological representation to model disinformation incidents and campaigns includes:

• Entities and Relationships: Defining key entities such as phases, tactics, techniques, and the relationships between them.
• Hierarchy and Classification: Organizing attack patterns in a hierarchical structure for easy classification and analysis.
• Semantic Enrichment: Enhancing the dataset with semantic annotations to improve data interoperability and reasoning capabilities.

Applications

• Risk Assessment: Evaluate and prioritize disinformation threats.
• Threat Actor Analysis: Understand behaviors and strategies of threat actors.
• Academic Research: Support studies in cybersecurity and disinformation analysis.
• Policy Making: Inform strategies for countering disinformation campaigns.

Usage

1. Download the Dataset: Obtain the dataset from the repository.
2. Preprocessing: Clean and normalize the data as required.
3. Analysis: Apply various analytical techniques to extract insights.
4. Risk Evaluation: Use the dataset to assess the risk levels of different disinformation techniques.

Contributions

• Ontology-based Situational Awareness: Enables modeling of disinformation incidents for extraction of attack patterns.
• High-Risk Itemset Mining: Analyzes threat actor behaviors and assesses the risk levels of disinformation techniques.
• Case Studies: Illustrates the practical application and effectiveness of the framework.

Citation

If you use this dataset in your research or extend the model presented in the paper, please cite the following paper:

@article{Cavaliere2024ASM, title={A semantic model bridging DISARM framework and Situation Awareness for disinformation Attacks Attribution}, author={Danilo Cavaliere and Giuseppe Fenza and Domenico Furno and Vincenzo Loia}, journal={2024 IEEE Conference on Cognitive and Computational Aspects of Situation Management (CogSIMA)}, year={2024}, pages={55-62}, url={https://api.semanticscholar.org/CorpusID:270397452} }