1 / 11

Coral J Dando ( Wolverhampton University) Alexandra L Sandham

Detecting deception: Computer mediated triage interviews to detect persons of interest following an insider attack. Coral J Dando ( Wolverhampton University) Alexandra L Sandham Thomas C Ormerod (Lancaster University). iIIRG 2013, Maastricht. Insider Attack Scenario.

vine
Télécharger la présentation

Coral J Dando ( Wolverhampton University) Alexandra L Sandham

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Detecting deception: Computer mediated triage interviews to detect persons of interest following an insider attack Coral J Dando (Wolverhampton University) Alexandra L Sandham Thomas C Ormerod (Lancaster University) iIIRG 2013, Maastricht

  2. Insider Attack Scenario • Immersive Game mimicking an office environment • 3 teams of 4 • Laptops and mobile phones provided • Solving crime puzzles • Differing levels of access to databases • 7 hour period (1 hour break for lunch) • 4 phases of play (insiders recruited for phases 2-4) iIIRG 2013, Maastricht

  3. Challenges of an insider attack • Expeditiously illicit information from large numbers of employees simultaneously • Secure evidence in a timely manner • Non experts involved in immediate post-hoc investigations iIIRG 2013, Maastricht

  4. Post-event Veracity Assessment (PVA) • On-line survey tool • 27 questions – dichotomous yes/no, open ended and category • Questions provided one at a time – No free movement • Covertly monitored whilst completing PVA • 120 adults (20- 45 years) paid £60 plus insider £20 iIIRG 2013, Maastricht

  5. PVA Rationale Electronic Behaviour PLUS Physical Movement data EQUALS Unique Behavioural Footprint Check answers to PVA against known footprint to highlight “persons of interest” iIIRG 2013, Maastricht

  6. Hypotheses • PVA format more cognitively demanding for deceivers than truth tellers • Deceivers will exhibit different linguistic behaviours than truth tellers • Absence of an investigator will result in different patterns of behaviours emerging for deceivers and truth tellers iIIRG 2013, Maastricht

  7. Results • Cognitive Demand Insiders (deceivers) (M = 4.27, SD = 1.51) reported having found the PVA more difficult/demanding than truth tellers (M = 3.26, SD = 1.40), p = .001, η2.64. iIIRG 2013, Maastricht

  8. Results • Linguistic Behaviour Significant differences emerged for: • the number of words written in response to the open questions, p = .001, > deceivers • the number of information items in response to the open questions, p = .0128, < deceivers • overall PVA duration, p < .001, > deceivers iIIRG 2013, Maastricht

  9. Results • Physical Behaviour while completing PVA Deceivers: • self-adapted more (M = 11.12, SD = 3.27) than truth tellers (M = 6.9, SD = 2.57), p = .004, η2.21 • blinked less (M = 13.92, SD = 6.27) than truth tellers (M = 31.32, SD = 16.27), p < .001, η2.39. iIIRG 2013, Maastricht

  10. Summary • The information provided by liars was inconsistent with the behaviouralfootprint • Liars produced more words, but revealed very little Information (vacuous) • Liars took twice as long to complete the PVA • Liars found the PVA more cognitively demanding • Liars revealed behaviours indicative of deception (captured by covert monitoring) – behaviours that were NOT revealed by truth tellers iIIRG 2013, Maastricht

  11. Conclusion The PVA is a practical and effective forensic tool for collecting information, expeditiously and simultaneously, to highlight persons of interest following an insider attack occurrence Questions? iIIRG 2013, Maastricht

More Related