Understanding Insider Threat Attacks Using Natural Language Processing: Automatically Mapping Organic Narrative Reports to Existing Insider Threat Frameworks

Abstract

Traditionally cyber security has focused on defending against external threats, over the last decade we have seen an increasing awareness of the threat posed by internal actors. Current approaches to reducing this risk have been based upon technical controls, psychologically understanding the insider's decision-making processes or sociological approaches ensuring constructive workplace behaviour. However, it is clear that these controls are not enough to mitigate this threat with a 2019 report suggesting that 34% of breaches involved internal actors. There are a number of Insider threat frameworks that bridge the gap between these views, creating a holistic view of insider threat. These models can be difficult to contextualise within an organisation and hence developing actionable insight is challenging. An important task in understanding an insider attack is to gather a 360-degree understanding of the incident across multiple business areas: e.g. co-workers, HR, IT, etc. can be key to understanding the attack. We propose a new approach to gathering organic narratives of an insider threat incident that then uses a computational approach to map these narratives to an existing insider threat framework. Leveraging Natural Language Processing (NLP) we exploit a large collection of insider threat reporting to create an understanding of insider threat. This understanding is then applied to a set of reports of a single attack to generate a computational representation of the attack. This representation is then successfully mapped to an existing, manual insider threat framework.

Survey on Deep Learning Approaches for Detection of Email Security Threat

“…• • Study of permafrost distribution in Sikkim Himalayas using Sentinel-2 satellite images and logistic regression modeling [45] • The efficiency of artificial neural networks for glacier ice-thickness estimation: A case study in the western Himalayas, India [46] • Sentiment analysis using machine learning: Progress in the machine intelligence for data science [47] • Fine-tuned convolutional neural network for different cardiac view classifications [48] • Insider Threat Detection Based on Natural Language Processing Word Embedding and Machine Learning [49] • Classification of botnet attacks in Internet of Things Using a Convolution Neural Network [50] • A survey of Convolution Neural Network based Network intrusion detection [51], natural language processing [48], and speech recognition [52].…”

Integrating Cyber Deception Into Attribute-Based Access Control (ABAC) for Insider Threat Detection

“…Bowen et al [20] proposed a Decoy Document Distributor, D 3 , system which automatically generates and distributes decoy documents across a file system aimed at luring malicious users. The authors employed a rule-based approach to design the decoy documents.…”

“…The evaluation results indicated that the proposed approach successfully identified insiders in about 66.7% of all cases. More recently, Paxton et al [3] proposed a natural language processing framework to model incidents of insider attacks using written and recorded notes of an incident. Despite many years of research, the practical progress on this field is relatively slow due to the lack of data and limitations of the underling techniques.…”

“…We implemented ABAC-related components of the proposed framework using Py_ABAC 3 , an open-source attribute-based access control toolkit written in the Python programming language. The toolkit gives a fine-grained control on the definition of ABAC rules that For example, open access requires the least privileges, while edit access requires higher privileges and more trusted users.…”