A Survey of Insider Attack Detection Research

Salem, Malek Ben; Hershkop, Shlomo; Stolfo, Salvatore J.

doi:10.1007/978-0-387-77322-3_5

Cited by 214 publications

(116 citation statements)

References 17 publications

Supporting

Mentioning

114

Contrasting

Unclassified

Order By: Relevance

“…Some augment this basic approach by introducing decoys onto the network to entrap adversarial insiders [16], [17]. A survey of much of this work is here, [18]. In addition, various models of adversarial insiders have been developed.…”

Section: Related Workmentioning

confidence: 99%

Proactive Insider Threat Detection through Graph Learning and Psychological Context

Brdiczka

Liu

Price

et al. 2012

2012 IEEE Symposium on Security and Privacy Workshops

View full text Add to dashboard Cite

Abstract-The annual incidence of insider attacks continues to grow, and there are indications this trend will continue. While there are a number of existing tools that can accurately identify known attacks, these are reactive (as opposed to proactive) in their enforcement, and may be eluded by previously unseen, adversarial behaviors. This paper proposes an approach that combines Structural Anomaly Detection (SA) from social and information networks and Psychological Profiling (PP) of individuals. SA uses technologies including graph analysis, dynamic tracking, and machine learning to detect structural anomalies in large-scale information network data, while PP constructs dynamic psychological profiles from behavioral patterns. Threats are finally identified through a fusion and ranking of outcomes from SA and PP.The proposed approach is illustrated by applying it to a large data set from a massively multi-player online game, World of Warcraft (WoW). The data set contains behavior traces from over 350,000 characters observed over a period of 6 months. SA is used to predict if and when characters quit their guild (a player association with similarities to a club or workgroup in nongaming contexts), possibly causing damage to these social groups. PP serves to estimate the five-factor personality model for all characters. Both threads show good results on the gaming data set and thus validate the proposed approach.

show abstract

Section: Related Workmentioning

confidence: 99%

Proactive Insider Threat Detection through Graph Learning and Psychological Context

Brdiczka

Liu

Price

et al. 2012

2012 IEEE Symposium on Security and Privacy Workshops

View full text Add to dashboard Cite

show abstract

“…It has been found that attackers using identity theft to masquerade as valid users often exhibit abnormal behavior (Salem, 2008). This would be a possible method for use in the detection of masquerades on the network.…”

Section: The Insider Threatmentioning

confidence: 99%

Cyber Security Countermeasures to Combat Cyber Terrorism

MacKinnon¹,

Bacon²,

Gan³

et al. 2013

Strategic Intelligence Management

View full text Add to dashboard Cite

“…Even most recent studies estimate that no mechanism exists to prevent insider abuse [11]. According to [12], there seems to be little design and technology available to address the insider threat problem. However, many forms of attack have been reported:…”

Section: Risks Related With Treatment Process and Data Analysis: The mentioning

confidence: 99%

Reduce Threats in Competitive Intelligence System: A Generic Information Fusion Access Control Model

Haddadi

Hatim

Dousset³

et al. 2011

IJDMS

View full text Add to dashboard Cite

Information fusion is a cornerstone of competitive intelligence activity that aims at supporting decision making by collecting, analyzing and disseminating information. This information comes from heterogeneous data sources. In this paper we present an approach of access control. This approach is focused both on the information that must be bring to decision-makers and the privacy of individuals whose data is used to extract this information. This model is based on the standard "Role Based Access Control" (RBAC) and is implemented within the entire life cycle of Xplor Every Where (Web service of Tetralogie), it follows methodologies tailored to design privacy-aware systems to be compliant with data protection regulations.

show abstract

A Survey of Insider Attack Detection Research

Cited by 214 publications

References 17 publications

Proactive Insider Threat Detection through Graph Learning and Psychological Context

Proactive Insider Threat Detection through Graph Learning and Psychological Context

Cyber Security Countermeasures to Combat Cyber Terrorism

Reduce Threats in Competitive Intelligence System: A Generic Information Fusion Access Control Model

Contact Info

Product

Resources

About