Detecting Insider Attacks Research Articles

THE ROLE OF BIG DATA IN SYSTEMS ENGINEERING: A REVIEW

This research review explores the transformative intersection of Big Data and Systems Engineering (SE), a convergence that leverages the vast capabilities of Big Data analytics to enhance the design, analysis, and management of complex systems. As the digital era ushers in unprecedented volumes of data, traditional systems engineering approaches are challenged to adapt, necessitating a paradigm shift towards integrating Big Data technologies. This review draws on recent scholarly contributions to highlight the implications, challenges, and innovative solutions emerging at this intersection. The integration of Big Data into Systems Engineering introduces significant opportunities for innovation. By processing and analyzing vast datasets, systems engineers can uncover hidden patterns and insights, leading to more efficient, reliable, and adaptable systems. However, this integration is not without its challenges. Information security emerges as a paramount concern, with the risk of insider attacks necessitating the development of new architectural solutions. Furthermore, the benchmarking and evaluation of Big Data systems present unique challenges due to the diversity of data and workloads involved. To address these challenges, this review examines several key contributions to the field. It discusses a formal framework for designing information systems that handle heterogeneous data, emphasizing the role of ontological models in separating system architecture from its implementation. The review also highlights the importance of security in Big Data systems, proposing a novel architecture for detecting insider attacks through data replication. Additionally, it explores the development of BigDataBench, a benchmark suite that facilitates the comprehensive evaluation of Big Data systems and architectures. Moreover, the review delves into the design of Big Data analytics architectures, focusing on goal-oriented modeling and the resolution of obstacles to quality goal achievement. It also introduces datar, a unified framework for Big Data Management Systems, showcasing a solution that manages Big Data in a pluggable, automatic, and intelligent manner. In conclusion, the intersection of Big Data and Systems Engineering heralds a new era of system design and management. By addressing the inherent challenges and leveraging innovative solutions, this convergence holds the potential to significantly enhance the capabilities of Systems Engineering, driving forward the development of complex, data-driven systems.
 Keywords: Big Data, Systems Engineering, Information Security, Data Management Systems, Benchmarking Big Data Systems.

Detect Insider Attacks in Industrial Cyber-physical Systems Using Multi-physical Features-based Fingerprinting

ICPS software and hardware suffer from low update frequency, making it easier for insiders to bypass external defenses and launch concealed destructive attacks. To address these concerns, we design a device fingerprinting method based on multi-physical features, augmenting current intrusion detection techniques in the ICPS environment. In this article, we use the sorting system as an example, demonstrating that the proposed device fingerprinting technology has generality in the intrusion detection of ICPS control flow. Specifically, we first formalize the physical model of the sorting system to analyze the critical device features. Then, we extract these physical features from the sensor data collected in a physical testbed. Utilizing featurized data, we train a classifier that generates fingerprints in real-time in the production environment. Moreover, we develop a differential detection model based on device fingerprints to discover stealthy insider attacks efficiently. We evaluate the proposed method in a real-world testbed. Experiment results show that the detecting performance of classifiers approaches 100% when the the number of component types is small.

A User and Entity Behavior Analysis for SIEM Systems: Preprocessing of The Computer Emergency and Response Team Dataset

A lot of work has been done to prevent attacks from external sources and a great deal of success has been achieved. However, studies to detect internal attacks aren’t sufficient today. One of the most important studies for the detection of insider attacks is User and Entity Behavior Analysis (UEBA). In this letter, UEBA studies in the literature were reviewed and The Computer Emergency and Response Team Dataset was analyzed (CERT). For this purpose, preprocessing and feature extraction steps were applied on CERT datasets. Several log files combined with respect to user and for each user the number of activities in the specified time interval were obtained. The python code of these preprocessing and feature extraction steps were shared as open source in GitHub platform. In the final phase, future analysis was described and UEBA system planned to be designed was explained.

An efficient pattern-based approach for insider threat classification using the image-based feature representation

Insider threats are expensive, difficult to detect, and sadly, on the rise. Despite significant research efforts, existing approaches are inadequate in accuracy and precision. They also suffer from a high false-positive rate in detecting insider attacks due to the heterogeneous nature of available insider threat data. Researchers have attempted an image-based approach for detecting insider threats to overcome the challenges from existing techniques. Most existing image-based approaches utilized Convolutional neural networks (CNN) to detect insider threats. Moreover, the CNN-based model lost the important user behavioral features due to the pooling operation. Also, they are often unsuitable for predictive modeling with features that lack spatial correlations. Aiming to address this issue, the Wavelet convolutional neural network (WCNN) is proposed. The WCNN model takes advantage of spectral and spatial analysis to classify insider threats using image-based feature representations. The proposed approach combines the scenario-specific single-day features from the user activity logs into a one-dimensional feature vector. It is then represented as images that reveal visual patterns effectively to identify malicious insiders using WCNN. In addition, the proposed approach adopts the SMOTEENN sampling technique to solve the class imbalance problem. The performance of the proposed approach is evaluated on the benchmark dataset. Experimental results show the improvement of the proposed approach over the current state-of-the-art techniques in terms of classification accuracy (97.19%), AUC (97.30%), and low false positives to identify malicious insiders.

Analysis and detection of insider attacks using behaviour rule based architecture in enterprise multitenancy

The enterprise level data security and privacy are one of the focal key challenges to the pr enterprise and security companies to prevent private data from outside and inside attacks. The insider threats and attacks can pretense a real defense risk to the various internal multi-tenants of various enterprises and companies. The data thievery by insiders of the companies is as a great deal the consequence of enterprises failing to execute the scheme and expertise to member of staff supervise activities and administrate the authenticated data-access to data as it the authentic spiteful activities of member of staff looking for economic benefits in multi-tenancy environment. This research composed with three major objectives: Description of insider attack causes with their impact factors; Implications of behavior rule-based architecture in enterprise multitenancy; Integration of behavior rules with prevention thresholds to control user accessibility for prevention of insider attacks and threats; This paper has described the efficient security scenario to avoid insider attaching complexities. This research is more helping the cyber security experts and network administrators to reduce the insider attacks by building the efficient monitoring intelligent system. The experimental scenarios built with125 authenticated, 29 non-authenticated internal users, and 62 authenticated, 18 non-authenticated external users of single enterprise level and avoided insider attacks and threats.

DeepMIA: An Integrated and Accelerated approach for Malicious Insider Attack Detection in IOT using Deep Learning

Abstract: The Internet of Things (IoT) are poised to transform our lives and are becoming increasingly popular in smart homes, smart industrial networks. IoT devices can be used for a variety of purposes, including healthcare. Always, IoT device security is an issue because they are in charge of creating and handling large amounts of sensitive data. A security breach has been found to have an influence on people and eventually, the entire planet. Artificial intelligence (AI) has a greater range of applications and is currently being investigated for use in IoT device security. A malicious insider attack is the most serious security concern associated with IoT devices. Although much IoT security research has focused on ways to prevent unauthorized and unlawful access to systems and information, the most severe malicious insider attacks, which are often the result of internal attack within an IoT network or environment, have gone unnoticed. Here we have proposed a model called ‘DeepMIA’, which uses Deep Learning to detect dangerous insider attacks in the IoT context. This in resource-constrained IoT contexts, the research proposes a lightweight technique for detecting insider assaults that can detect abnormalities arising from sensors data or device data that are connected in a IoT Environment. The DeepMIA model is evaluated with UNSW-NB15 Dataset and achieves a decent accuracy of 99% with deep learning models

Insider attack detection in database with deep metric neural network with Monte Carlo sampling

Abstract Role-based database management systems are most widely used for information storage and analysis but are known as vulnerable to insider attacks. The core of intrusion detection lies in an adaptive system, where an insider attack can be judged if it is different from the predicted role by performing classification on the user’s queries accessing the database and comparing it with the authorized role. In order to handle the high similarity of user queries for misclassified roles, this paper proposes a deep metric neural network with strategic sampling algorithm that properly extracts salient features and directly learns a quantitative measure of similarity. A strategic sampling method of heuristically generating and learning training pairs through Monte Carlo search is proposed to select a training pair that can represent the entire dataset. With the TPC-E–based benchmark data trained with 11,000 queries for 11 roles, the proposed model produces the classification accuracy of 95.41%, which is the highest compared with the previous models. The results are verified through comparison of quantitative and qualitative evaluations, and the feature space modelled in the neural network is analysed by t-SNE algorithm.

Anomaly Detection for Insider Attacks From Untrusted Intelligent Electronic Devices in Substation Automation Systems

In recent decades, cyber security issues in IEC 61850-compliant substation automation systems (SASs) have become growing concerns. Many researchers have developed various strategies to detect malicious behaviours of SASs during the system operational stage, such as anomaly-based detection. However, most existing anomaly-based detection methods identify an abnormal behaviour by checking every single network packet without any association. These traditional methods cannot effectively detect “stealthy” attacks which modify legitimate messages slightly while imitating patterns of benign behaviours. In this paper, we present feature selection and extraction methods to generalise and summarise critical features when detecting insider attacks triggering from untrusted control devices within SASs. By applying a sliding window-based sequential classification mechanism, our detection method can detect anomalies across multiple devices without the need to learn datasets collected from all devices. Firstly, to generalise critical features and summarise systems’ behaviours so that it is unnecessary to collect all datasets, we selected and extracted six critical network features from generic object-oriented substation events (GOOSE) messages and seven summarised physical features based on the general architecture of the primary plant of distribution substations. After that, to improve detection accuracy and reduce computational costs, we applied sliding window algorithms to divide datasets into different overlapped window-based snippets. Then we applied a sequential classification model based on Bidirectional Long Short-Term Memory networks to train and test those datasets. As a result, our method can detect insider attacks across multiple devices accurately with a false-negative rate of less than 1%.

Detection of Insider Attacks in Distributed Projected Subgradient Algorithms

The gossip-based distributed projected subgradient algorithms (DPS) are widely used to solve decentralized optimization problems in various multi-agent applications, while they are generally vulnerable to data injection attacks by internal malicious agents as each agent locally estimates its descent direction without an authorized supervision. In this work, we explore the application of artificial intelligence (AI) technologies to detect internal attacks. We show that a general neural network is particularly suitable for detecting and localizing the malicious agents, as they can effectively explore nonlinear relationship underlying the collected data. Moreover, we propose to adopt one of the state-of-the-art approaches in decentralized federated learning, i.e., a gossip-based collaborative learning protocol, to facilitate training the neural network models by gossip exchanges. This advanced approach is expected to make our model more robust to challenges with insufficient training data, or mismatched test data. In our simulations, a least-squared problem is considered to verify the feasibility and effectiveness of AI-based methods. Simulation results demonstrate that the proposed AI-based methods are beneficial to improve performance of detecting and localizing malicious agents over score-based methods, and the peer-to-peer neural network model is indeed robust to target issues.

ICOPS: insider attack detection in distributed file systems

Distributed file system (DFS) has been widely used in many applications. Insider attacks in DFS is a potential target that can cause problems in many applications. A malicious insider or an outside...

ICOPS: insider attack detection in distributed file systems

iCOPS: insider attack detection in distributed file systems

IADF security: insider attack detection using fuzzy logic in wireless multimedia sensor networks

Wireless multimedia sensor networks (WMSNs) consist of spatially distributed, autonomous sensor nodes that monitor physical or environmental conditions. WMSN networks, in general, are prone to insider attacks like node replication attacks, where a malicious node replicates itself as an insider node, which may lead to a situation where a non-authentic node becomes a rightful part of the network. Insider attacks are not detectable with classic cryptographical techniques. Many WMSN applications require a dedicated on-demand algorithm to detect the insider attacker in the system without any prior knowledge of the system. This paper proposes a new security scheme, called the insider attack detection using fuzzy logic (IADF). This security scheme uses the fuzzification of six parameters present in a wireless multimedia sensor node categorized as network and physical parameters. Physical parameters used are received signal strength, transceiver range and residual energy. Network parameters used include packet delivery ratio, forwarding delay and transmission rate. The fuzzy approach makes the IADF algorithm flexible and scalable. Simulation results show that the IADF algorithm can predict malicious nodes with a higher prediction rate and higher detection accuracy.

Malicious Insider Attack Detection in IoTs Using Data Analytics

Internet of Things (IoTs) are set to revolutionize our lives and are widely being adopted nowadays. The IoT devices have a range of applications including smart homes, smart industrial networks and healthcare. Since these devices are responsible for generating and handling large amounts of sensitive data, the security of the IoT devices always poses a challenge. It is observed that a security breach could effect individuals and eventually the world at large. Artificial intelligence (AI), on the other hand, has found many applications and is widely being explored in providing security specifically for IoT devices. Malicious insider attack is the biggest security challenge associated with the IoT devices. Although, most of the research in IoT security has pondered on the means of preventing illegal and unauthorized access to systems and information; unfortunately, the most destructive malicious insider attacks that are usually a consequence of internal exploitation within an IoT network remains unaddressed. Therefore, the focus of this research is to detect malicious insider attacks in the IoT environment using AI. This research presents a lightweight approach for detecting insider attacks and has the capability of detecting anomalies originating from incoming data sensors in resource constrained IoT environments. The results and comparison show that the proposed approach achieves better accuracy as compared to the state of the art in terms of: a) improved attack detection accuracy; b) minimizing false positives; and c) reducing the computational overhead.

Neural Networks-Aided Insider Attack Detection for the Average Consensus Algorithm

To support the big-data processing needs of large-scale deployments of smart devices, there is significant interest in moving from cloud-computing to multi-agent (fog-computing) models, given these algorithms scalability and self-healing properties with respect to nodes and link failures. However, these algorithms are often based on the average consensus primitive, which is, unfortunately, vulnerable to data injection attacks. Recognizing this challenge, this work proposes three novel methods for detecting and localizing adversarial nodes using neural network (NN) models. The methods proposed are based on fully distributed algorithms, wherein each node locally updates its local states by exchanging information with its neighbors without supervision. Compared to the state-of-the-art, the proposed approach leverages the automatic learning characteristics of NN to reduce the dependence on pre-designed models and human expertise in complex internal attack scenarios. Simulation results show that the NN-based methods can significantly improve the attacker detection and localization performance.

Detecting malicious nodes via gradient descent and support vector machine in Internet of Things

IoT devices have become much popular in our daily lives, while attackers often invade network nodes to launch various attacks. In this work, we focus on the detection of insider attacks in IoT networks. Most existing algorithms calculate the reputation of all nodes based on the routing path. However, they rely heavily on the assumption that different nodes in the same routing path have equal reputation, which may be not invalid in practice and cause inaccurate detection results. To solve this issue, we formulate it as a multivariate multiple linear regression problem and use the K-means classification algorithm to detect malicious nodes. Further, we optimize the routing path and design an enhanced detection scheme. Our results indicate that our proposed methods could achieve a detection accuracy rate of 90% or above in a common case, and the enhanced scheme could reach an even lower false detection rate, i.e., below 5%.

ADRCN: A Framework to Detect and Mitigate Malicious Insider Attacks in Cloud-Based Environment on IaaS

Security is a critical factor for any of the computing platforms. Cloud computing is a new computing environment but still, its basic technology is the Internet. Thus, Cloud computing environment not only has the threats of its own but it is also prone to security issues of its underlying technology i.e. Internet. In this paper, the authors are proposing a secure routing framework viz. Authenticated Dynamic Routing in Cloud Networks (ADRCN) to mitigate the malicious insider attacks while maintaining the path integrity in the Clouds. Symmetric cryptography with hashing is used to maintain the integrity of the path between the source and destination. The purpose of ADRCN is to maintain the integrity of the path between the client and data center. If malicious insider tries to perform an attack between the client and the data center then it will be detected. This work aims to give a solution for detection and prevention of malicious insider attacks in Cloud-based environments.

A System Architecture for the Detection of Insider Attacks in Big Data Systems

In big data systems, the infrastructure is such that large amounts of data are hosted away from the users. In such a system information security is considered as a major challenge. From a customer perspective, one of the big risks in adopting big data systems is in trusting the provider who designs and owns the infrastructure from accessing user data. Yet there does not exist much in the literature on detection of insider attacks. In this work, we propose a new system architecture in which insider attacks can be detected by utilizing the replication of data on various nodes in the system. The proposed system uses a two-step attack detection algorithm and a secure communication protocol to analyze processes executing in the system. The first step involves the construction of control instruction sequences for each process in the system. The second step involves the matching of these instruction sequences among the replica nodes. Initial experiments on real-world hadoop and spark tests show that the proposed system needs to consider only 20 percent of the code to analyze a program and incurs 3.28 percent time overhead. The proposed security system can be implemented and built for any big data system due to its extrinsic workflow.

Detecting insider attacks in medical cyber–physical networks based on behavioral profiling

Cyber–physical systems (CPS) have been widely used in medical domains to provide high-quality patient treatment in complex clinical scenarios. With more medical devices being connected in industry, the security of medical cyber–physical systems has received much attention. Medical smartphones are one of the widely adopted facilities in the healthcare industry aiming to improve the quality of service for both patients and healthcare personnel. These devices construct an emerging CPS network architecture, called medical smartphone networks (MSNs). Similar to other distributed networks, MSNs also suffer from insider attacks, where the intruders have authorized access to the network resources, resulting in the leakage of patient information. In this work, we focus on the detection of malicious devices in MSNs and design a trust-based intrusion detection approach based on behavioral profiling. A node’s reputation can be judged by identifying the difference in Euclidean distance between two behavioral profiles. In the evaluation, we evaluate our approach in a real MSN environment by collaborating with a practical healthcare center. Experimental results demonstrate that our approach can identify malicious MSN nodes faster than other similar approaches.

Misbehavior Detection in Industrial Wireless Networks: Challenges and Directions

In communications, there has been a paradigm shift toward the widespread adoption of wireless technologies in recent years. This evolution to—often ad-hoc—wireless communication has led to significant benefits in terms of flexibility and mobility. However, alongside these benefits, arise new attack vectors, which cannot be mitigated by traditional security measures. Especially in scenarios where traditional, proactive cryptographic techniques cannot be deployed or have been compromised, reactive mechanisms are necessary to detect intrusions. In this paper, we discuss new directions and future challenges in detecting insider attacks for the exemplary application domain of industrial wireless networks, an enabling technology for current smart factory trends. First, we review existing work on intrusion detection in mobile ad-hoc networks with a focus on physical-layer-based detection mechanisms. Second, we conduct a proof-of-concept study of insider detection in industrial wireless networks using real-world measurements from an industrial facility. Based on the study, we point out new directions for future research.

Enhancing Trust Management for Wireless Intrusion Detection via Traffic Sampling in the Era of Big Data

Internet of Things (IoT) has been widely used in our daily life, which enables various objects to be interconnected for data exchange, including physical devices, vehicles, and other items embedded with network connectivity. Wireless sensor network (WSN) is a vital application of IoT, providing many kinds of information among sensors, whereas such network is vulnerable to a wide range of attacks, especially insider attacks, due to its natural environment and inherent unreliable transmission. To safeguard its security, intrusion detection systems (IDSs) are widely adopted in a WSN to defend against insider attacks through implementing proper trust-based mechanisms. However, in the era of big data, sensors may generate excessive information and data, which could degrade the effectiveness of trust computation. In this paper, we focus on this challenge and propose a way of combining Bayesian-based trust management with traffic sampling for wireless intrusion detection under a hierarchical structure. In the evaluation, we investigate the performance of our approach in both a simulated and a real network environment. Experimental results demonstrate that packet-based trust management would become ineffective in a heavy traffic environment, and that our approach can help lighten the burden of IDSs in handling traffic, while maintaining the detection of insider attacks.