Detecting Insider Attacks Using Non-negative Matrix Factorization

Abstract

Abstract-It is a fact that vast majority of attention is given to protecting against external threats, which are considered more dangerous. However, some industrial surveys have indicated they have had attacks reported internally. Insider Attacks are an unusual type of threat which are also serious and very common. Unlike an external intruder, in the case of internal attacks, the intruder is someone who has been entrusted with authorized access to the network. This paper presents a Non-negative Matrix Factorization approach to detect inside attacks. Comparisons with other established pattern recognition techniques reveal that the Non-negative Matrix Factorization approach could be also an ideal candidate to detect internal threats.

Detecting Insider Threats: Solutions and Trends

“…To address the challenge of large amounts of audit data that are generated which in turn make analysis tedious and difficult, some researchers have proposed the use of non-negative matrix factorization (Platos et al, 2009) to minimize the actual amount of data that needs to be processed to discover malicious insider activities. It is not clear, however, how the large amounts of logged data are partitioned into clusters that may have hidden patterns and those that do not.…”

Scaling IDS construction based on Non-negative Matrix factorization using GPU computing

“…To achieve decision making ability, another method must be used. In our previous works [16], [9], [20], we used the same and very simple technique. When the decomposition is processed, we take vectors of weights from matrix H and split them in two groups -clusters according their label, i.e.…”

Towards intrusion detection by information retrieval and genetic programming

“…Intrusion detection systems (IDS) were proposed to prevent security violations in computer systems and networks [2], [11]. They are intended to reinforce basic security measures such as authentication and access control and detect actions that aim to break security policies in protected computer system.…”