Insider Threat Analysis Using Information-Centric Modeling

Abstract

Capability acquisition graphs (CAGs) provide a powerful framework for modeling insider threats, network attacks and system vulnerabilities. However, CAG-based security modeling systems have yet to be deployed in practice. This paper demonstrates the feasibility of applying CAGs to insider threat analysis. In particular, it describes the design and operation of an information-centric, graphics-oriented tool called ICMAP. ICMAP enables an analyst without any theoretical background to apply CAGs to answer security questions about vulnerabilities and likely attack scenarios, as well as to monitor network nodes. This functionality makes the tool very useful for attack attribution and forensics.Keyv^ords: Insider threats, capability acquisition graphs, key challenge graphs IntroductionA comprehensive model is required for understanding, reducing and preventing enterprise network attacks, and for identifying and combating system vulnerabihties and insider threats. Attacks on enterprise networks are often complex, involving multiple sites, multiple stages and the exploitation of various vulnerabilities. As a consequence, security analysts must consider massive amounts of information about network topology, system configurations, software vulnerabilities, and even social information. Integrating and analyzing all this information is an overwhelming task.A security analyst has to determine how best to represent individual components and interactions when developing a model of a computing environment. Depending on the environment and task at hand, the analyst may deal with network traffic data [15]

System Dynamics Based Insider Threats Modeling

“…Butts extends the Schematic Protection Model to produce the first comprehensive security model capable of analyzing the safety of a system against the insider threat [13]. Ha et al demonstrate the feasibility of applying capability acquisition graphs to insider threat analysis [14]. Ali et al present an Agent-based User-Profiling model that monitors the behavior of the authorized users in an organization to avoid risk [15].…”

Multi-step attack modelling and simulation (MsAMS) framework based on mobile ambients

“…It means that the credential for a host h1 gives the attacker access to host h2 as well, if these two hosts trust each other. Therefore, the real-life situation that my password gives someone Ha, Chinchani et al [12,7] propose a type of graph which allows not only the modelling but also the simulation of an attacker searching through the graph. Nodes are associated with tokens and edges associated with minimum and maximum costs.…”

finding multi-step attacks in computer networks using heuristic search and mobile ambients

“…Chinchani et al [38,87], from Buffalo University, proposed a target-centric approach which allows not only the modelling but also the simulation of an attacker searching through the graph. Nodes are associated with tokens, e.g.…”

“…We neglect this aspect because, in our view, it is attackerspecific and difficult to generalize. Other researchers [87], mentioned in Section 2.2.3.4 on page 34, rely on complicated schemes to assign cost based on several attributes of vulnerabilities, attackers and attacks. Again, they do not scale, are stakeholder-specific and subjective.…”