Research on Behavior Trust Based on Bayesian Inference in Trusted Computing Networks

Abstract

Recent years have seen explosive growth in information security problem. Trusted computing is increasingly used in the fields of information security. The basic idea of trusted computing is different from traditional security method. In other words, system abstracts normal behavior and compare with real-time behavior. Most of the current research focuses on static integrity metrics. However, it is not enough for dynamic measurement in trusted computing environment. In this paper, we present an efficient identification methodology of malicious insider user behavior. We focus on modeling insider user normal behavior in trusted computing networks. Our research methodology provides an approach to construct, assess, and optimize insider user normal behavior model. Our model framework derives from a dynamic Bayesian perspective. The experiment shows efficiency and robustness of our prototype model.

A Review of Insider Threat Detection: Classification, Machine Learning Techniques, Datasets, Open Challenges, and Recommendations

“…Many articles focused on the use of cyber activity behaviors, login events, or the combination of login events with other features [55][56][57][58][59][60] using many different techniques. Nikolai and Wang [55] proposed a solution for data theft in Infrastructure as a Service IAAS Clouds; the k-nearest neighbor (KNN) is used to detect data theft in Clouds.…”

“…Roberts et al [56] provided a detection mechanism to counter insider threats in critical networks. W. Liu et al's [58] used the Bayesian networks (BNs) and novel modeling approach for the performance of insider threat detection. Research methodology was proposed to provide an approach for the construction, assessment, and optimization of the insider user normal behavior model.…”

“…Expert disagreement may exist on the probability of a specific event or causality direction between two events. For example, certain experts might deem that A's behavior is normal, whereas the opposite is true for others [58].…”

“…Previous studies recommended that new insider datasets should be created with much larger data and stream sizes [102]. A long period is also essential to confirm whether the models can normally work with the daily updates, whereas normal user behaviors change over time [58]. The new dataset should include more malicious data, because the current datasets contain only a few malicious data, a few of which are becoming outdated.…”