Table Of ContentSecurity Informatics
AnnalsofInformationSystems
Volume1:
ManagingintheInformationEconomy:CurrentResearchIssues
UdayApte,UdayKarmarkar,eds.
Volume2:
DecisionSupportforGlobalEnterprises
UdayKulkarni,DanielJ.PowerandRameshSharda,eds.
Volume3:
NewTrendsinDataWarehousingandDataAnalysis
StanislawKozielski,RobertWremble,eds.
Volume4:
KnowledgeManagementandOrganizationalLearning
WilliamR.King,ed.
Volume5:
InformationTechnologyandProductDevelopment
SatishNambisan,ed.
Volume6:
Web2.0&SemanticWeb
VladanDevedžic,DraganGaševic,eds.
Volume7:
Web-BasedApplicationsinHealthcareandBiomedicine
AthinaLazakidou,ed.
Volume8:
DataMining:SpecialIssueinAnnalsofInformationSystems
RobertStahlbock,SvenF.CroneandStefanLessmann,eds.
Volume9:
SecurityInformatics
ChristopherC.Yang,MichaelChiu-LungChau,Jau-HwangWang
andHsinchunChen,eds.
· ·
Christopher C. Yang Michael Chiu-Lung Chau
·
Jau-Hwang Wang Hsinchun Chen
Editors
Security Informatics
123
Editors
ChristopherC.Yang MichaelChiu-LungChau
CollegeofInformationScienceand SchoolofBusiness
Technology 7/F,MengWahComplex
DrexelUniversity TheUniversityofHongKong
3141ChestnutStreet PokfulamRoad
Philadelphia,PA19104 HongKongSAR
USA [email protected]
[email protected]
Jau-HwangWang HsinchunChen
DepartmentofInformation EllerCollegeofManagement
Management McClellandHall430
CentralPoliceUniversity 1130E.HelenSt.
Gueishan Tucson,AZ85721
Taoyuan33334 USA
TaiwanR.O.C [email protected]
[email protected]
ISSN1934-3221 e-ISSN1934-3213
ISBN978-1-4419-1324-1 e-ISBN978-1-4419-1325-8
DOI10.1007/978-1-4419-1325-8
SpringerNewYorkDordrechtHeidelbergLondon
LibraryofCongressControlNumber:2009938002
©SpringerScience+BusinessMedia,LLC2010
Allrightsreserved.Thisworkmaynotbetranslatedorcopiedinwholeorinpartwithoutthewritten
permission of the publisher (Springer Science+Business Media, LLC, 233 Spring Street, New York,
NY10013,USA),exceptforbriefexcerptsinconnectionwithreviewsorscholarlyanalysis.Usein
connectionwithanyformofinformationstorageandretrieval,electronicadaptation,computersoftware,
orbysimilarordissimilarmethodologynowknownorhereafterdevelopedisforbidden.
Theuseinthispublicationoftradenames,trademarks,servicemarks,andsimilarterms,eveniftheyare
notidentifiedassuch,isnottobetakenasanexpressionofopinionastowhetherornottheyaresubject
toproprietaryrights.
Printedonacid-freepaper
SpringerispartofSpringerScience+BusinessMedia(www.springer.com)
Preface
IntelligenceandSecurityInformatics(ISI)isthestudyofthedevelopmentanduse
of advanced information systems and technologies for national, international, and
societalsecurity-relatedapplications.ISItopicsincludeISIdatamanagement,data
and text mining for ISI applications, terrorism informatics, deception and intent
detection, terrorist and criminal social network analysis, public health and biose-
curity, crime analysis, cyber-infrastructure protection, transportation infrastructure
security,policystudiesandevaluation,andinformationassurance.Duetotheadvent
of terrorism attacks in recent years, ISI has gained increasingly more interest and
attention from academic researchers, law enforcement and intelligence experts,
informationtechnologyconsultants,andpractitioners.ThefirstIEEEInternational
Conference on ISI was held in 2003 and subsequent meetings were held annually.
Startingfrom2006,thePacificAsiaWorkshoponISI(PAISI)wasalsoheldannu-
ally in Pacific Asia, with large numbers of contributors and participants from the
region. A European Workshop on ISI was started in Denmark in 2008. Given the
importanceofISI,weintroduceaspecialvolumeofsecurityinformaticsinAnnals
ofInformationSystems.
In this special volume, we include nine papers covering a wide range of active
research areas in security informatics. Chen et al. studied the international Falun
Gong movement through a cyber-archaeology approach. Link, web content, and
forum content analyses were employed to investigate the framing of social move-
mentidentity.SkillicornandLittleadoptedanempiricalmodelbasedonchangesin
frequenciesof88significantwordstodetectdeceptioninnon-emotionaltestimony.
ThemodelwasvalidatedwiththetestimonytotheGomeryCommission,aCanadian
investigation of misuse of government funds. Yang and Tang developed a new
sub-graph generalization approach for social network data sharing between orga-
nizationsandpreservingprivacyofsensitivedata.Theshareddatawasintegratedto
supportsocialnetworkanalysissuchascentralitymeasurement.
Qiao et al. proposed the Growing Window-based Constrained k-Closest Pairs
(GWCCP) algorithm to discover the closest pairs of objects within a constrained
spatialregionforspatialanalysisincrimedatabases.Leeetal.developedaframe-
workforwhat-ifemergencyresponsemanagementusingacompletesetoforder-k,
ordered order-k and kth nearest Voronoi diagram. Several scenarios had been
v
vi Preface
presented to demonstrate how it was useful in the four phases of emergency
response:mitigation,preparedness,response,andrecovery.
Glässer and Vajihollahi proposed a framework of identity management archi-
tecture for analyzing and reasoning about identity management concepts and
requirements.Chenetal.proposedaframeworkoftwo-stagedgametheoreticmod-
els for deploying intrusion detection agents. Su et al. presented the distributed
event-triggered knowledge network (ETKnet) for data and knowledge sharing. A
unified knowledge and process specification language was also developed. Cha et
al. proposed a risk management system RiskPatrol which integrated the business
continuitymanagementwiththeriskassessmentprocess.
Philadelphia,Pennsylvania ChristopherC.Yang
HongKong,SAR MichaelChau
Taiwan,ROC Jau-HwangWang
Tucson,Arizona HsinchunChen
Contents
Framing Social Movement Identity with Cyber-Artifacts:
ACaseStudyoftheInternationalFalunGongMovement . . . . . . . . 1
Yi-DaChen,AhmedAbbasi,andHsinchunChen
PatternsofWordUseforDeceptioninTestimony . . . . . . . . . . . . . 25
DavidB.SkillicornandAyronLittle
InformationIntegrationforTerroristorCriminalSocialNetworks . . . 41
ChristopherC.YangandXuningTang
ProcessingConstrainedk-ClosestPairsQueriesinCrimeDatabases . . 59
ShaojieQiao,ChangjieTang,HuidongJin,ShuchengDai,
XingshuChen,MichaelChau,andJianHu
EmergencyResponseThroughHigherOrderVoronoi
Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
IckjaiLee,ReecePershouse,PeterPhillips,KyungmiLee,
andChristopherTorpelund-Bruin
IdentityManagementArchitecture . . . . . . . . . . . . . . . . . . . . . 97
UweGlässerandMonaVajihollahi
AGameTheoreticFrameworkforMulti-agentDeployment
inIntrusionDetectionSystems . . . . . . . . . . . . . . . . . . . . . . . 117
Yi-MingChen,DachrahnWu,andCheng-KuangWu
ETKnet:ADistributedNetworkSystemforSharingEventData
andMulti-facetedKnowledgeinaCollaborationFederation . . . . . . 135
StanleyY.W.Su,HowardW.Beck,XuelianXiao,JeffDePree,
SeemaDegwekar,ChenZhou,MinsooLee,CarlaThomas,
AndrewCoggeshall,andRichardBostock
DuplicateWorkReductioninBusinessContinuityandRisk
ManagementProcesses . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
Shi-ChoCha,Pei-WenJuo,Li-TingLiu,andWei-NingChen
vii
Framing Social Movement Identity
with Cyber-Artifacts: A Case Study
of the International Falun Gong Movement
Yi-DaChen,AhmedAbbasi,andHsinchunChen
Abstract Framing a collective identity is an essential process in a social move-
ment. The identity defines the orientation of public actions to take and establishes
aninformalinteractionnetworkforcirculatingimportantinformationandmaterial
resources.Whiledomesticsocialmovementsemphasizethecoherenceofidentityin
alliance,globalorcyber-activismisnowflexibleinitscollectiveidentitygiventhe
riseoftheInternet.Acampaignmayincludediversesocialmovementorganizations
(SMOs) with different social agendas. This flexible identity framing encourages
personalinvolvementindirectaction.Ontheotherhand,itmaydamagesolidarity
withinSMOsandmakecampaignsdifficulttocontrol.Toassessthesustainability
ofanSMO,itisimportanttounderstanditscollectiveidentityandthesocialcodes
embeddedwithinitsassociatedcyber-societiesandcyber-artifacts.Inthisstudy,we
took a cyber-archeology approach and used the international Falun Gong (FLG)
movement as a case study to investigate this identity-framing issue. We employed
social network analysis and Writeprint to analyze FLG’s cyber-artifacts from the
perspectives of links, web content, and forum content. In the link analysis, FLG’s
websites linked closely to Chinese democracy and human rights SMOs, reflecting
FLG’shistoricalconflictswiththeChinesegovernmentaftertheofficialbanin1999.
Inthewebcontentanalysis,weusedWriteprinttoanalyzethewritingsofHongzhi
Liandofhiseditors,andfoundthatHongzhiLi’swritingscenteraroundtheideo-
logicalteachingofFalunDafawhiletheeditorspostspecificprogramstorealizeLi’s
teaching. In the forum content analysis, FLG comprehensively organizes several
differentconceptsonacontinuum:fromFLGideologytolifephilosophyandmys-
terious phenomena, and from mysterious phenomena to anti-Chinese Communist
Yi-DaChen,HsinchunChen∗
Artificial Intelligence Lab, Department of Management Information Systems, University of
Arizona,Tucson,AZ85721,USA
e-mail:[email protected]; ∗[email protected]
AhmedAbbasi
SheldonB.LubarSchoolBusiness,UniversityofWisconsin-Milwaukee,Milwaukee,WI53201,
USA
e-mail:[email protected]
C.C.Yangetal.(eds.),SecurityInformatics,AnnalsofInformationSystems9, 1
DOI10.1007/978-1-4419-1325-8_1,(cid:3)C SpringerScience+BusinessMedia,LLC2010
2 Yi-DaChen,AhmedAbbasi,andHsinchunChen
Party and persecution by conceptualizing the Chinese government as the Evil. By
deploying those cyber-artifacts, FLG seamlessly connects different ideologies and
establishesitsidentityasaQi-Gong,religious,andactivistgroup.
Keywords Social movement · Collective identity · Falun Gong · Internet · Social
networkanalysis·Writeprints
1 Introduction
TheInternetnowadaysisnotmerelyadigitalplatformforexchangingdataorinfor-
mationbutisalsoacommunicationchannelforindividualstoshareandpromulgate
their beliefs and ideas. People discuss topics of interest in forums or create their
own blogs for posting experiences and opinions. Through hyperlinks, individuals
can link their own posts to other web pages for citing the comments with which
theyagreeoroppose.Gradually,“ideologicalnetworks”areformedontheInternet
in which websites with similar ideas are connected together via hyperlinks. One
may find a number of relevant websites of her/his interests by just following the
hyperlinksofafewseedwebsites.
TheInternethasalsochangedhowsocialmovementorganizations(SMOs)advo-
cate their ideology and mobilize their resources. They are no longer restricted by
timeorspace.Theirwebsitesholdpermanentcampaignsappealingtoaglobalaudi-
ence [6, 7, 17]. The low cost of communication makes them more easily align
together for large public actions [6, 7, 25]. For example, a demonstration against
the war in Iraq in Washington, D.C., 2003, gathered around 100,000 people with
differentprotestpositions[7].Furthermore,activistgroupscanincreaseindividual
participationbyhyperlinkinganinclusiveideologicalnetworkwhichprovidesmul-
tipleentrypointsforpotentialsupporterstojoinin[6].Theanti-Microsoftnetwork,
for instance, involves a great diversity of interest groups, including corporations,
consumerprotectionorganizations,andlaboralliances[6].
Inthetraditionalsocialmovementtheory,framingacoherentidentityisacrucial
processforanSMOtoestablishitselfinsocialmovements[19].Thecollectiveiden-
tityhelpsparticipantstodevelopatrustrelationshipwiththeirmembersandcreates
an informal interaction network for circulating important information and mate-
rialresources[29].Thefailuretoachievecommonframingcancreatetensionand
fragmentation within coordinated SMOs [7]. Global or cyberactivism, conversely,
isflexibleinidentityframing[7].Itsadvocatenetworkmaycontaindiversesocial
justice agendas, rich in personal appeal but thin in ideology [6, 7]. The ease of
individuals joining and leaving a given network damages solidarity in SMOs and
makescampaignsdifficulttocontrol[6].ToassessthesustainabilityofanSMOin
theInternetera,itisimportanttounderstandhowtheSMOconstructsidentityand
socialcodeswithinitsassociatedcyber-societies[7].
In this study, we took a cyber-archaeology approach to investigate the framing
ofcollectiveidentityontheInternetandusedtheInternationalFalunGong(FLG)
FramingSocialMovementIdentitywithCyber-Artifacts 3
movement as a case study. The cyber-archaeology approach adapts methods from
archaeology and anthropology to analyze a community’s cultural cyber-artifacts
[16, 27]. In applying the cyber-archaeology approach to the study of SMOs, the
approach involves (1) the identification of their associated cyber-societies, (2)
collection of cyber-artifacts with automated procedures, and (3) analysis of cyber-
artifactsfromtheperspectiveofthesocialmovementtheory.TheFLGwaschosen
as our case study because it involves various identities, including Qi-Gong exer-
cises, new religion, and activism [28, 30, 34, 21], and heavily uses the Internet
as a vehicle for information dissemination [5]. Our goal was to investigate how
FLG comprehensively maintains these three identities simultaneously within its
cyber-societies.
Theremainderofthestudyisorganizedasfollows.Wefirstreviewsocialmove-
ment theory and cyber-archaeology, and introduce two analytical tools used for
examiningcyber-artifacts:socialnetworkanalysis(SNA)andWriteprint.Thenwe
describe our research design which was based on the cyber-archaeology research
framework, covering link, web content, and forum content analyses. Finally, we
presentourresultsandconclusions.
2 LiteratureReview
2.1 SocialMovementTheory
Social movements are often recognized as irrational and disorganized activities
working against social injustices. Unlike official political participation or lobby-
ing,activistsorganizeabroadrangeofindividualsandseektobuildaradicallynew
social order through public protest [11]. However, the study of social movements
reveals that they have much deeper organizational and psychological foundations
thanwouldappear.Activistsdonotjustblindlydeployprotestactions:theycalcu-
latethecostsandbenefitsoftheactionswithpresentresourcesbeforeinitiation[29].
Peoplearenotirrationallysupportingasocialmovement:theyseekanidentityand
shareasenseofbelongingthroughtheirparticipation[29].
Collective action and resource mobilization are two intellectual currents which
dominated the early development of social movement theory [19, 29]. Collective
action is based on the idea that social movements are triggered by an overly rapid
social transformation.In thisschool of thought, a society consisted of several bal-
anced sub-systems and a movement reflective of the failure of social institutions
or control mechanisms to rebalance them after a dramatic change [29]. In such a
moment,theexistingnormsnolongerprovideasufficientrationaleforsocialaction,
andagroupofindividualsseesthesituationasinjusticeandreactstoitbydevelop-
ingsharedbeliefsandnewnormsforbehavior.TheAmericanCivilWarandCivil
RightsMovementaresignificantexamplesillustratingthispointofview[29].The
framing of collective identity is an essential process for collective action [19, 29,
20].Forparticipants,theidentityhelpsestablishatrustrelationshipwithothersin
thesamegroupandexcludesthosewhomtheyoppose[19,29].Forthemovement,
