An Algorithm for Sensing Insider Threat Based on Cloud Model

Abstract

Using the access control relationship,the partial-order structures of subjects and objects in the system and their mapping relationship are defined,and a hierarchy-mapping based insider threat model is developed on these definitions.Then,this model is applied to build a cloud model which characterizes the states of insider threat in the system.Based on the proposed cloud model,an algorithm,which improves the accuracy and objectivity in evaluation,is also designed for sensing the insider threat in the system.Compared to the previous works,the algorithm could analyze threats of the system in various respects and makes decision qualitatively and quantitatively.As a result,the experiments show that the algorithm could effectively sense the insider threat in real-time.