Simulated User Bots: Real Time Testing of Insider Threat Detection Systems

Abstract

The insider threat is one of the most serious security problems faced by modern organizations. High profile cases demonstrate the serious consequences of successful attacks. The problem has been studied for many years leading to a number of technologies and products that have been widely deployed in government and commercial enterprises. A fundamental question is how well do these systems work? How may they be tested and how computationally expensive a widely deployed monitoring infrastructure cost? Measuring real systems that are dynamic in nature, encounter unknown configuration bugs and have sensitivities to the vagaries of human nature and adversarial behavior require a formal means to continuously test and evaluate deployed detection systems. We present a framework to deploy in situ simulated user bots (SUBs) that can emulate the actions of real users. By creating a user account and running a host in the enterprise network, a SUB can be introduced into an enterprise system that runs at a realistic pace and does not interfere with normal operations. Infusing malicious behavior into the SUB should be detected by the insider threat monitoring infrastructure. The SUB framework can be controlled to explore the limits of deployed systems and to test the effectiveness of insider evasion tactics, especially low and slow behaviors. We demonstrate our framework by generating user data to test the detection of malicious users and our ability to produce variable ground truths through intrusion detection testing using several commonly used machine learning techniques.

Privacy and Synthetic Datasets

“…In other words, our synthetic data, for all but privacy infractions, was the same. 143 What is more, even beyond our case study, similar research concurs in our results: Synthetic data is a valid alternative to original data. 144 A budding body of research has found that when comparing analysis using original data to analysis using synthetic data, for the most part, the results are indistinguishable, even by domain experts.…”

A Structured Approach to Insider Threat Monitoring for Offensive Security Teams

“…This research aims to catalog human as well as technical factors associated with insider threat risks to inform the development of more proactive approaches to insider threat assessment. In [12], the detection of the insider is based on a real-time testing simulation of real users, generating user data to test the detection of malicious users. We found other updated and relevant resources in [13] which is one of the latest surveys that summarized techniques for insider threat identification and detection.…”

Sequence Preserving Network Traffic Generation

“…Yet, all of the abovementioned methods mainly preserve statistics of various traffic characteristics but lack the ability to preserve common sequences within the traffic. Dutta et al [4] present a framework for simulating user bots by imitating the actions of real users and demonstrate its successful implementation for intrusion detection. While their work is based on predefined rules, we will approach a similar task with machine learning techniques that will allow an automated extraction of real user behavior.…”

“…The "usefulness" of synthetic data has been validated by studies like [1][2][3][4]. In this study we examine the use of synthetic data on another type of data, network traffic data.…”