Statistical profiling and visualization for detection of malicious insider attacks on computer networks

Abstract

The massive volume of intrusion detection system (IDS) alarms generated on large networks, and the resulting need for laborintensive security analysis of the text-based IDS alarm logs, has recently brought into question the cost-effectiveness of IDSs. In particular, when host-based IDSs are used to monitor an organization's internal networks, the majority of the resulting alarms represent legitimate, automated system administration. Because of the absence of ground truth about known attacks, we propose an unsupervised, anomaly-based method for automatically distinguishing alarms that are potentially generated by malicious insider attacks, from the repetitive and temporally structured legitimate system-administration alarms. The majority of previous work in this area has used heuristic and statistical filtering techniques to discard a relatively large proportion of alarms in the final presentation to the security analyst, which is a potentially dangerous practice. Instead, we demonstrate the use of a typicality measure to visualize the apparent risk associated with alarms, while retaining information about the temporal context of the entire alarm stream for the analyst to view. The relevance of the statistical method is examined by comparing the results to a set of analyst-curated alarms from an operational environment.

Cylindrical Coordinates Security Visualization for multiple domain command and control botnet detection

“…With the passage of time, too much information is displayed on the screen in various colors and sizes, and this can distract users, in turn leading to a decrease in detection efficiency Colombe and Stephens (2004); Samak et al (2008).…”

EEVi - framework for evaluating the effectiveness of visualization in cyber-security

“…It includes tools that visually detect anomalies and possible attacks through pattern matching [7] or by using machine learning to check for anomalous behavior [1]. Other tools establish acceptable action patterns to easily detect anomalous patterns [17].…”

“…Other tools establish acceptable action patterns to easily detect anomalous patterns [17]. These tools use visualizations like color maps [7] and different types of graphs like attack-pattern trees [1] or bipartite graphs [17].…”

Detecting a malicious insider in the cloud environment using sequential rule mining

“…KbM is an approach that has been widely used in addressing the problem of intruders [6], [7]. The process of detecting malicious insiders using the KbM is done by comparing activities that are performed by the user against predefined rules of the expected behavior.…”