ARI: Hello, I'm Ari. [CLAUDINE: And I'm Claudine] Welcome to Proving the Negative.
ARI: We're a podcast all about exploring the different sides of cybersecurity,
from political to computer science, international relations to mathematics.
Join us as we talk to our friends about the work they do.
SEAN: My elevator pitch starts with: trust and reputation are multifaceted concepts.
Our experience of them is psychological and human and social.
But there's a whole other perspective that we can take on [trust & reputation],
which is this more formal (or computational) one.
Rather than talking about them in terms of describing behaviour or how we feel,
which are, of course, very valid, important aspects,
we can talk about them in terms of more prescriptive, very precise models
which can use maths or simulations to describe trust or reputation behaviour.
Now, trying to describe human behaviour mathematically is a huge endeavour.
As a computer scientist with an interest in these concepts,
we find a happy medium in cybersecurity. My research talks less about individual
behaviour, though of course we try and account for that.
We talk more about the context in which humans and computers interact.
And this is why cybersecurity becomes very important, because an important
idea in trust and reputation, and in these sorts of social interactions,
is that of a network. A network is just this mesh of interconnected individuals,
which may be people or computers or... who knows?!
The point is that there are powerful mathematical and computational tools
for talking about networks.
We take these tools and use them to try and describe things like:
how information might move around a network connectivity.
E.g., person X might have a lot of connections and person Y very few...
Finally, how how can these sorts of behavioural aspects be exploited and
how can those exploitations be mitigated or prevented?
ARI: There's a lot to unpack here... What is a model? What do you use them for?
SEAN: It's almost like a toy. It's a way of describing some part of the world
without, of course, having to go and build that entire part of the world.
Physics is a really good example of a mathematical model - rather than
setting up every possible physical [experiment] (e.g., testing all pendulums...
... by building a pendulum and swinging it around),
We can instead come up with a linguistic description of them in this precise
language as to how [this pendulum] behaves.
Models don't have to be mathematical - even the way we talk about ourselves:
"I tend to be an optimistic person" or "I tend to prefer spicy food".
These are models, these are descriptions of ourselves that try and capture us.
CLAUDINE: You mentioned that you were trying to "account for behaviour"?
SEAN: The world is complicated, and humans are particularly complicated part.
Let's say you have a description of a network. You have a good description
of how, if A communicates to B then it takes this long, and happens in this way...
That's great. What really becomes important when we talk about
human behaviour, is the decision-making.
Why does A communicate to B? When do they choose to do so?
What do they choose to communicate?
That's where humans get really complicated. What we try and do
is define mathematical descriptions of a person's behaviour.
Let's say you're trying to describe the time it takes for A to tell B
about something new they found out.
There's lots of different mathematical functions describing,
as time passes, what's the likelihood they communicate?
Exponential distribution is (just to throw the term out there) a common model
that might be used to model someone who's trying to communicate as much as they can.
What this exponential model does is say, regardless of how much time has passed,
0 to 5 seconds, 5 to 10 seconds... that doesn't matter. All that matters is they're
likely to try and communicate sooner rather than later and as soon as possible.
ARI: Do I need to know what exponential distribution means?
SEAN: One gorgeous thing about the exponential distribution,
that really distinguishes it from other models,
(to give an example of why it's useful in this kind of research)
is that it's got this property called 'memorylessness'.
The easiest way to describe it is [that] the eagerness, if you like,
of someone to communicate doesn't change with time.
Whether 5 or 10 seconds have passed, the chances of you communicating
in the next five seconds is always the same.
The chance of you communicating between times 5-10 is the same as
the chance of you communicating between times 20-25
(if you haven't communicated yet). We are not trying to capture things like
"Do people communicate more at midday or lunch time?"
We are trying to capture this idea that people want to communicate
as soon as possible, and they don't care what time of day is.
They don't care if it's 10 or 5PM, they want to get the information out there.
And that's not always a perfect model, but when you're trying to describe big
networks where a lot of people are communicating throughout the day,
it can [realistically] capture the sheer level of conversation that happens.
While knowing what an exponential distribution is is important if you want to
look at our specific model, it is not at all necessary to understand trust as a whole,
[this model] is just one aspect of how we're looking at [trust and reputation].
We try and model semi realistic pseudo people.
These aren't real human beings, this doesn't describe human beings perfectly.
It is a statistical average of human behaviour,
that we try and capture. That can come from psychological research...
We've looked at psychology papers and taken numbers from there, in terms of
who communicates and how often. For more mathematical or theoretical work,
we take the most reasonable behaviour we can, simpler to implement & describe.
CLAUDINE: You said you were looking at behaviours [drawn from] psychology.
What are the behaviours that you've been looking at?
SEAN: There are a lot of robust models for things like personality type [and]
how conscientious people are about sharing certain kinds of news
(that piece of work was very much about sharing news and sharing fake news),
how extroverted people are (how much they communicate/how many friends...).
The kind of research that gives a statistical average gloss
of human behaviour can be powerful for us because that means that rather than
trying to capture the nitty gritty of human behaviour (which is very hard to
describe mathematically), instead, we can capture generalities in human behaviour.
And say "if we were trying to capture an average human in a particular context..."
The paper we were looking at was was done in Italy.
Italian people might behave differently from people living in France or the UK.
Taking these papers, saying, "What do they say about human behaviour?"
and "How can we describe that mathematically?"...
But then also respecting limitations. ARI: Let's turn it around to you.
How have you approached the biggest challenge in your own research?
SEAN: Through a blend of my interests in computer science and psychology and
human behaviour and even personal experience... I have questions around how
people's personal experiences influence how and why they trust.
See, the thing about trust is that it really is about our expectations of other human
beings. Experiences with other human beings is what drives that behaviour.
You'll see in a lot of research around trust and reputation (online or offline),
the social backgrounds people have, the experiences they have,
gender or age or nationality, political perspective...
these influence who we trust and why we trust them
and what can break that trust and what can make that trust.
There is so much more to be learned about how an individual's experience,
both in terms of the world they grew up in and the people they interact with,
how that influences the decisions they then make in later life and
the kinds of people they trust and why they trust them.
If we want to understand why people behave the way they do,
understanding where people come from is the only way to get to the root of it.
CLAUDINE: Is there a big question that you would like to investigate,
if you had unlimited resources, be that time, money, person power?
SEAN: This idea of the biggest challenge is so interesting.
I was thinking to myself, is this from a methodology perspective in terms of
learning new things to code or learning new kinds of maths?
But there's also this personal aspect of doing the PhD.
The amount you have to learn, to deal with the unknown as a researcher...
Up until now, there's two things that you know for sure: 1) What you need to learn
(regardless of whether you learn it or not, on the first day of a new course they give
you the syllabus - 'this is important for the exams, and this might not be').
2) You also know that someone knows the answer. There is a marking scheme
and if you can't find the answer, someone can find it for you and help you get to it.
As a researcher, all of those things are gone. First of all, no one knows what the
answers to your questions are. No one knows what they even look like, whether
you should talk about them mathematically or psychologically...
[You're] left with this double problem of, first of all, asking yourself,
"How do I even begin trying to answer this question?"
And second of all, "How do I even know I'm right when I get there?"
"Is there a right answer?"
I dealt with this the way a lot of people do. I've been happy being part of CDT,
we've had so much interaction with researchers - PhD students a few years in
post-docs and professors and so many people who've gone through all of this.
Understand that, as a researcher, you're not really looking for the right answer.
A lot of the time, what you're looking for is to just add to human knowledge
to come up with new answers and sometimes better answers,
and sometimes just completely trying to give a new perspective.
Like, for example, trying to say, "Can we describe trust computationally?"
For me, that's been one of the biggest challenges for sure - the perspective shift.
ARI: How does trust link to reputation?
SEAN: There's a thesis known [as] one of the first in my area: computational trust.
A big part of [it] is just talking about how many different definitions of trust there are.
The way I define trust is asking yourself: "if I had to rely on this person...
(you don't have to rely on them, you don't have to depend on them)
...but if I were to depend on this person, would they do what's good for me?
That's a big part of what trust is, it's about dealing with the unknown.
I take, at least in my research, a very particular view of what reputation is.
An idea of generalising trust to [a] more social aspect where you can say trust
comes from my interactions with you.
A simple way of looking at it is you and I interact and I build up trust that way.
Reputation becomes important because we have this idea of exchanging
information. Without having ever interacted with you,
I might have a friend tell me something about you.
I might have a friend say, "Ari is friendly...". That's what reputation is, it's
when we make trust-based decisions off of, not just our own experiences, but the
experiences of people around us: the kind of narratives that exist of a person,
or of a thing or of a company or of a new games console or whatever.
To me, that's what reputation is. It's that social aspect of trust,
that narrative aspect of trust where we're telling each other about things,
even though we haven't had those direct experiences.
You can have opinions passed from person to person to person, and none
of them but the first has interacted with the thing itself. That's interesting,
at the same time, risky. ARI: What's interesting about it? What are the risks?
SEAN: What's interesting is how powerful a mechanism it is for survival.
From person to person, from tribe to tribe, from friend group to friend group,
"stay away from that person or that place, it's not good for you".
The problem with that power, as is the case with [anything] involving language,
while it's useful for exchanging information and giving us eyes
that stretch to the other side of the world,
the danger there is [that] without direct experience, people can fake it.
You can say what you like about a person and
what you say about a person now might be not true of them later,
or it might not be true of them in a different context.
It's a bit of a dark perspective to take, but it's a realistic one.
A woman might have a good experience with another woman, but a man
might not have a good experience with that woman.
And similarly, a man might have a good experience with another man,
but a woman might not have a good experience of that second man.
That's why it's really important that not only can these things be faked, but they
can also be wrong. Sometimes we just don't know what we are talking about.
It's really important that we understand the context in which this information
is gathered and from whom and what biases they might have.
CLAUDINE: What does trust mean? How would you define trust?
SEAN: Making a model that you can make sense of [and is meaningful],
has to be computational, mathematical and well-defined. Sociology (discussing...
human behaviour and things like that) has been making fantastic steps with
network theory and the use of this kind of structure in describing interactions.
This is very important for trying to account for nuances.
Traditional epidemiological models assume that everyone is in contact with
everyone all the time, and they were very simple, mathematically.
They could be useful and they could say some meaningful things,
but a lot of the time they would fall short.
They have been made much more powerful with this network structure.
The reason why this is so good for capturing nuances of social interactions
is that it is trying to capture this idea that all relationships are made up of this
big, messy, interconnected mesh of individual relationships.
So person to person, computer to computer, person to computer...
Your relationship with the group is so much about your relationship with
the individuals of the group.
There are methods in networks theory to capture this aggregate,
That would be a bit more advanced. We use the model we do because it's about
respecting the concept of relationship as the fundamental social atom.
That, society and social interaction IS [all about] relationships.
ARI: Sean, when you say "we"...? SEAN: 80% of the time, me and my supervisor.
The other 20%, maybe us and some collaborators. When I say "we",
I'm talking about this community of people in diverse fields like
computational trust and analytical sociology...
People fascinated by formal models and formal methods, their backgrounds are
often in physics and computer science, who really care about these things too.
Some people love doing maths for the sake of maths,
and some people love studying people as they are. People like myself, who put
these two worlds together: perfect models that we make up in our heads
and this messy, complicated world that we actually live in.
Trying to find some way of describing the latter in terms of the former.
ARI: But Sean, social sciences are not real sciences. How could you do this?
SEAN: I don't think very many people use the word science
having ever attended a philosophy of science course or read a book on the
philosophy of science. There is a lot of nuance as to what science is. A big
aspect of it is just about trying to be humble to the experiences that we have.
This idea of social sciences not being a science - it's not a debate I understand.
CLAUDINE: I think it's good to hear that articulated because for those of us who
do a lot of inter/multidisciplinary work, you hear "social science isn't real science",
or "we shouldn't take this into account because they can't run an experiment".
SEAN: You can't say that someone's not a scientist because they can't run an experiment.
Physicists can't always run experiments. Simulations have become so important.
In the past we could get a pendulum, or particles and shoot them at each other.
To me, science is about this constant interplay between these narratives
and models and little toys we make up on our heads to
describe the world we live in and the actual experiences that we have.
If someone is trying to respect both of those and is trying to find some crazy,
beautiful link between the two, that's really what a scientist is.
CLAUDINE: What was your most notable failure, how did you overcome it?
SEAN: I'd say one of my biggest failures was trying to come up with this perfect
model at the beginning, which didn't exist. Spending a lot of time worrying
and not getting things done when in fact, sometimes all you can really do
is dive into those kinds of observations and experiences and see what happens.
The reason this is hard to answer isn't because I'm completely free of failure,
but rather, as a researcher, you're just wading through the unknown.
And there are so many things that can change at a moment's notice,
A failure in my approach tied into - what am I actually trying to do?
At the beginning - having no idea what I was doing, for one. Getting lost in this
tornado of theoretical perspectives and practical perspectives, and people
gathering datasets and running statistics and making up very deep
theoretical models of how human brains do logic and all this kind of stuff.
I spent so much time at the beginning trying to come up with this perfect,
multi-disciplinary approach that accounted for sociology and psychology
and logic and maths and networks and all these things, spending a lot of time
just muddling through and not really being able to get started on anything.
Doing multi-disciplinary research, there's so much that you have to learn.
As my supervisor often says, you have to just start with something.
It's often in the mistakes that you learn how your model can be better.
There is no methodology to find the answer with these things, you know.
It really is about people trying all kinds of things to learn more about the world.
All of those things are valid and important and some of them
may have more practical use sooner than later and some may not.
And that really isn't what we're doing as researchers. We're not trying to solve
problems quite as much as we're trying to answer questions.
ARI: What is cyber security [to you]?
SEAN: Cyber security has to revolve around information technology.
What most of us are talking about is computers. Whether you want to
introduce books and things into that notion, I think you can.
Cyber security is more than just computer security or computer science.
It's about taking a step back and looking at the bigger picture.
Zoom-bombing: people joining Zoom calls and displaying unpleasant images.
I remember a conversation I had with someone - they said that they didn't
believe it was a security problem because if you put a password on your
Zoom call then then no one can get into it.
And I find that fascinating because to me, when we're talking about security,
we are, of course, trying to secure computers.
We're securing these computers because they mean something to us.
How can these new technologies be used to do bad things?
How do we prevent these bad things being done? What are bad things?
That goes into complex areas, like secure devices being used inappropriately.
It might be a good thing that you can put, tracking on your phone if it's to
keep your child safe. But at the same time, in an abusive relationship it can be
dangerous. It can be used as a tool for bad. That's why cyber security is
absolutely inseparable from social and psychological aspects because ultimately
it's human beings who value and use these devices.
We have to learn - not just about human behaviour and not just about
device behaviour, but the interaction between the two, to get
Anything meaningful done. Otherwise you are just encrypting data on a box
and putting it in that box and you're putting that box in a safe and no one's
touching that box. Great. That's a very safe box. It is also a useless box and it's
also a meaningless box.
ARI: Yeah! If it's not helpful to anyone, what's the point?
CLAUDINE: Sean, I think that that's probably the best answer we've gotten...
ARI: Do you have any tips for keeping up to speed with cyber security?
SEAN: For me, reading papers, looking at direct results that have been found
for someone more technical that might be looking at bug reports.
Talking about reputation - blog posts and community. If something is not
your area of expertise, engage with the community. Follow someone who seems
to know what they're talking about, ask people questions or read forums.
Anything like that. Watch lectures or talks online.
CLAUDINE: Join us next week for another fascinating conversation.
In the meantime, you can tweet at us @HelloPTNPod
You can subscribe on Apple Podcasts or wherever you listen to podcasts.
The title there is PTNPod. See you next week. [ARI: Bye!].
CLAUDINE: This has been a podcast from the Centre for Doctoral Training in Cybersecurity, University of Oxford.
Funded by the Engineering and Physical Sciences Research Council.