Automated Insider Threat Detection System Using User and Role-Based Profile Assessment

Abstract

Abstract-Organisations are experiencing an ever-growing concern of how to identify and defend against insider threats. Those who have authorised access to sensitive organisational data are placed in a position of power that could well be abused and could cause significant damage to an organisation. This could range from financial theft and intellectual property theft, through to the destruction of property and business reputation. Traditional intrusion detection systems are not designed, nor are capable, of identifying those who act maliciously within an organisation. In this paper, we describe an automated system that is capable of detecting insider threats within an organisation. We define a tree-structure profiling approach that incorporates the details of activities conducted by each user and each job role, and then use this to obtain a consistent representation of features that provide a rich description of the user's behaviour. Deviation can be assessed based on the amount of variance that each user exhibits across multiple attributes, compared against their peers. We have performed experimentation using 10 synthetic data-driven scenarios and found that the system can identify anomalous behaviour that may be indicative of a potential threat. We also show how our detection system can be combined with visual analytics tools to support further investigation by an analyst.

Distance Measurement Methods for Improved Insider Threat Detection

“…Traditionally, distance measurements have been applied to text analysis [1,2] and speech based matching [3,4]. Our work most closely matches classification techniques such as -NN and PCA as applied by [14] and [15], respectively. However, in the case of our distance measurement implementations, we only consider one set of prior data rather than attempt to classify 'normal' and 'anomalous' behaviour based on the whole range of available data.…”

“…Recent work in the application of data analytic techniques against the CERT dataset include [12][13][14][15]. The work of [13] focuses on the CERT r6.2 dataset and uses Deep Neural Networks (DNN) and Recurrent Neural Networks (RNN) to calculate an anomaly score of each individual user.…”

“…Their results show that -NN is generally more accurate and faster in comparison with -d tree. Additionally, the work of [15] uses both the CERT dataset and bespoke synthetic dataset generated to evaluate their approach which is based on grouping of users based on role and applying Principal Component Analysis (PCA) to detect outliers in user activity.…”

Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis

“…Previous studies have grouped the features associated with motives into four broad categories [14,17,25,34,[38][39][40]:…”

Abnormal Behavior Analysis in Office Automation System within Organizations

“…The topic of insider threat detection has received many attentions in the literature. Traditional intrusion detection system is neither designed for nor capable of identifying those who act maliciously within an organization [3]. Researchers have proposed a number of systems and approaches to detect or predict insider threat based on different types of activities.…”