Through his doctoral research, Mitch McCarthy, a retired U.S. Marine Corps colonel, explored the relationship between the propagation of media narratives and the level of cyber intrusions on U.S. networks in subsequent days, leading to a doctorate in information sciences in mid-2021. He now serves as a lecturer for NPS’ Defense Resources Management Institute (DRMI).
McCarthy’s dissertation, titled “Media Effects on Cyber Intrusion,” explored how national news narratives emanating from other countries about the U.S. on a given day resonate within their domestic populace leading to intrusions on U.S. networks on the following day.
"Dr. McCarthy's dissertation provides one of the first systematic investigations of the drivers of cyber intrusion activities," said Associate Professor Camber Warren, NPS Department of Defense Analysis and an advisor on the research. "His evidence shows that a key element in these dynamics are the narratives transmitted through the global online news media."
The question the dissertation set out to address is, “How do competing narratives, reported by news media sources, between the U.S. and other sovereign states, indicate the level of future cyber-intrusion activity targeting U.S.-based information technology networks?”
Through his research, McCarthy was able to discern that not only does media play a role in the chance for cyber intrusions, but also the country of origin of the media is a factor. The research was based on media from anocratic, autocratic and democratic states and data on cyber intrusions from an anonymous source.
The findings of this research rest upon more than 14 million intrusions captured by the open-source intrusion detection software known as SNORT, over a 302 day period. This intrusion data was then aligned with media events, electronically scraped by the Phoenix Event Data project over the same time period, representing yesterday’s foreign media narratives directed at the U.S.
McCarthy said that if you know negative media narratives are occurring today, you could increase defensive efforts against intrusions directed towards U.S. networks.
"Hypothetically, today’s negative media narratives about the United States, say specifically about the oil and gas industry, could result in tomorrow’s intrusions on those U.S. networks," explained McCarthy. "What would that allow people in oil and gas to do? They would be able to competently defend their information technology systems."
"Dr. McCarthy's research provides new scientific insights revealing, through the use of predictive modeling of cyber intrusion threats, that national narratives play a key role in shaping the behavior of hostile actors,” added Warren. “Simultaneously, this research points the way towards capabilities that will be crucial to the broader defense community, to anticipate emergent threats in the information environment, especially in a context of great power competition."
McCarthy found a direct correlation between today’s narratives originating from different sovereign states within anocratic, autocratic and democratic regime types, the manner in which the media narrative was presented, and the impact on intrusions tomorrow.
Although McCarthy is still conducting more research on media narratives affecting cyber intrusions, he is in the process of developing these findings into a potential cyber defense capability.
"I would like to see it automated,” noted McCarthy. “I want to work with the currently anonymous organization, who provided the intrusion data, and see if it could work for them in an automated fashion. I'm in discussions, presently, on how to make that a reality."
According to Warren, as we move forward, this line of research may provide predictive models of cyber intrusion threats that allow analysts and planners to anticipate the mobilization of hostile cyber actors, and thereby to shift from reactive to proactive force postures.