Insider Threat Research Articles

Anomaly Detection Based on Discrete Wavelet Transformation for Insider Threat Classification

Unlike external attacks, insider threats arise from legitimate users who belong to the organization. These individuals may be a potential threat for hostile behavior depending on their motives. For insider detection, many intrusion detection systems learn and prevent known scenarios, but because malicious behavior has similar patterns to normal behavior, in reality, these systems can be evaded. Furthermore, because insider threats share a feature space similar to normal behavior, identifying them by detecting anomalies has limitations. This study proposes an improved anomaly detection methodology for insider threats that occur in cybersecurity in which a discrete wavelet transformation technique is applied to classify normal vs. malicious users. The discrete wavelet transformation technique easily discovers new patterns or decomposes synthesized data, making it possible to distinguish between shared characteristics. To verify the efficacy of the proposed methodology, experiments were conducted in which normal users and malicious users were classified based on insider threat scenarios provided in Carnegie Mellon University’s Computer Emergency Response Team (CERT) dataset. The experimental results indicate that the proposed methodology with discrete wavelet transformation reduced the false-positive rate by 82% to 98% compared to the case with no wavelet applied. Thus, the proposed methodology has high potential for application to similar feature spaces.

A High Accuracy and Adaptive Anomaly Detection Model With Dual-Domain Graph Convolutional Network for Insider Threat Detection

Insider threat is destructive and concealable, making addressing it a challenging task in cybersecurity. Most existing methods transform user behavior into sequential information and analyze user behavior while neglecting structural information among users, resulting in high false positives. To solve this problem, in this paper, we propose Dual-Domain Graph Convolutional Network (referred to as DD-GCN), a graph-based modularized method for high accuracy and adaptive insider threat detection. The central idea is to convert user features and structural information into heterogeneous graphs in the light of various relationships and take user behavior and relationship into account together. To this end, a weighted feature similarity mechanism is applied to balance the feature similarity of users and original linkages among them so as to generate the fused structure. Next, specific graph embeddings are extracted from the original topology structure and fused structure simultaneously, which convert behavior information into high-level representations. Furthermore, an attention mechanism is applied to learn the adaptive importance weights of the user’s features in the corresponding embedding. The combination and difference constraints are proposed to enhance the learned embeddings’ commonality and the ability to capture different information. Extensive experiments on two real-world datasets clearly show that our proposed DD-GCN extracts the most correlated information from structural topology and feature information substantially, and achieves improved accuracy with a clear margin.

Methodology for forecasting the probability of an insider attack based on the analysis of Bayesian networks

The danger of an insider threat is high enough for any enterprise. In order to predict possible insider attacks, it is necessary to know the structure of the enterprise, the roles of personnel and the security policies that are applied. Given the stochastic nature of the system, forecasting methods based on Bayesian estimation have become widely used. The article develops an insider threat forecasting model based on a Bayesian network, which includes a description of various states in the form of a graph of network attacks, as well as a derivation algorithm for calculating the probability of an insider threat risk. To form the methodology, the concepts of "elementary attack" are used, as the minimum set of operations necessary for an attacker to move from one resource to the next, and "proof of intrusion", as a collection of a series of actions recorded by an attacker from one resource to another resource and which can be monitored using a log - magazine. To measure the extent of an intrusion, "proof of intrusion confidence" is used, as the probability that a proof of intrusion determined over a set of operations covers an elementary attack. To verify the reliability of the proposed method of predicting an insider attack, a Monte Carlo simulation was carried out, where the variables were determined using a random number generator. According to the simulation results, it was established that with an increase in the number of tests and the initial probability of penetration to the resource (an individual node of the network), the total number of penetrations increases, and the total probability of penetration to the node also increases. However, the result is almost independent of the current trial step and the overall probability remains constant. The network structure of the insider threat, which is described by the Bayesian model, can be used to calculate the overall probability of insider attacks.

CYBERSECURITY IN HEALTHCARE: A REVIEW OF STRATEGIES AND CHALLENGES IN THE USA

The intersection of healthcare and technology in the United States has ushered in unprecedented advancements, enhancing patient care and operational efficiency. However, this digital transformation has also exposed the healthcare sector to escalating cybersecurity threats. This study provides a comprehensive analysis of the current state of cybersecurity in the USA healthcare system, examining both strategies employed and challenges faced. Drawing upon existing literature, case studies, and regulatory frameworks, the paper delves into the evolving landscape of cyber threats, including malware attacks, insider threats, and unauthorized access. It evaluates the effectiveness of existing cybersecurity strategies, the regulatory framework, and explores emerging technologies such as artificial intelligence and blockchain. The study aims to be a valuable resource for policymakers, healthcare professionals, and researchers, offering insights to fortify the cybersecurity posture of the USA healthcare system in the face of evolving and sophisticated cyber threats.

Analysis and detection of insider attacks using behaviour rule based architecture in enterprise multitenancy

The enterprise level data security and privacy are one of the focal key challenges to the pr enterprise and security companies to prevent private data from outside and inside attacks. The insider threats and attacks can pretense a real defense risk to the various internal multi-tenants of various enterprises and companies. The data thievery by insiders of the companies is as a great deal the consequence of enterprises failing to execute the scheme and expertise to member of staff supervise activities and administrate the authenticated data-access to data as it the authentic spiteful activities of member of staff looking for economic benefits in multi-tenancy environment. This research composed with three major objectives: Description of insider attack causes with their impact factors; Implications of behavior rule-based architecture in enterprise multitenancy; Integration of behavior rules with prevention thresholds to control user accessibility for prevention of insider attacks and threats; This paper has described the efficient security scenario to avoid insider attaching complexities. This research is more helping the cyber security experts and network administrators to reduce the insider attacks by building the efficient monitoring intelligent system. The experimental scenarios built with125 authenticated, 29 non-authenticated internal users, and 62 authenticated, 18 non-authenticated external users of single enterprise level and avoided insider attacks and threats.

Securing Information Management in Collaborative Environments Using Machine Learning

Recently, there has been a significant increase in the use of collaborative environments for managing and sharing information. However, these environments often present significant security risks due to the potential for unauthorized access, data leakage, and other security breaches. To address these risks, machine learning (ML) techniques have been increasingly used to secure information management in collaborative environments. We propose a novel ML approach to be applied to detect and prevent security threats in collaborative environments. Our approach integrates temporal convolution to detect and prevent security threats by analyzing spatial-temporal patterns in data from various sources, such as network traffic, system logs, and user behavior. Furthermore, we present a case study demonstrating the effectiveness of our model in securing collaborative information management. The case study involves the development of our system for detecting insider threats in a collaborative environment. Extensive experimentation on this case study demonstrates the efficiency and effectiveness of the proposed system for securing information management and promoting further developments.

Insider threat detection and prevention using semantic score and dynamic multi-fuzzy classifier

Insider threat detection and prevention using semantic score and dynamic multi-fuzzy classifier

Fighting Insider Threats, with Zero-Trust in Microservice-based, Smart Grid OT Systems

Fighting Insider Threats, with Zero-Trust in Microservice-based, Smart Grid OT Systems

Identification of authorship and prevention of fraudulent transactions/cybercrime using efficient high performance machine learning techniques

Cyber safety is the best skill required among a group of employees in organisations. Many offenders hide behind anonymous masking, including dishonest purchases, brazen plagiarism of the work, breaching corporate safety and stealing private data. To understand and analyse the actual phenomenon encountered with data, requirements of scientific methods, machine learning techniques, processes are to be used. This paper aims to tackle these problems by providing a protection layer for users, where data is being gathered from cyber security sources, analytical complement with latest data-driven patterns provides effective security solutions. We then discuss machine learning, deep learning powered models for the detection of insider threats and identifying authorship identification of anonymised articles. The individual modules are trained on authorship attribution, mouse monitoring, keyboard monitoring and command tracing and reached promising results with good accuracies in the range of 65%-85% on average.

Data Privacy and Security in Cloud Computing Environments

The globe has adopted the cloud computing environment, which organizes data and manages space for data storage, processing, and access. This technical development has brought up questions regarding data security and privacy in cloud computing environments, though. The purpose of this abstract is to offer a thorough review of the issues, solutions, and future developments related to data privacy and security in cloud computing. Keeping data private and secure while it is being processed and stored in outside data centres is the main difficulty in cloud computing systems. The abstract discusses the dangers of insider threats, data breaches, and illegal access to sensitive information. It digs further into the legal and compliance criteria that businesses must follow in order to protect user data in the cloud. In result, data privacy and security in cloud computing environments remain critical concerns for organizations and individuals alike. In the survey the overview of how to use cloud storage globally and its challenges, solution and future innovation is well explained. It underscores the importance of robust encryption, access controls, user awareness, and emerging technologies in safeguarding data in the cloud. By addressing these concerns, organizations can leverage the power of cloud computing while maintaining the confidentiality, integrity, and availability of their data.

Applying One-Class Algorithms for Data Stream-Based Insider Threat Detection

Applying One-Class Algorithms for Data Stream-Based Insider Threat Detection

Assessing the Impact and Effectiveness of Cybersecurity Measures in e-Learning on Students and Educators: A Case Study

As e-learning has become increasingly prevalent, cyber security has become a major concern. e-Learning platforms collect and store large amounts of sensitive information, such as personal data and financial information, making them attractive targets for cybercriminals. To address these challenges and concerns, e-learning platforms must implement a comprehensive cyber security strategy that includes strong access controls, data encryption, regular software updates, and student training to help them identify and prevent insider threats. This research aims at investigating and determine how satisfied students are with e-learning security and privacy, as well as whether these concerns affect the overall standard of education. A sample study is presented to assess both the impact of the security framework on students' academic achievements and the student’s satisfaction with the security countermeasures in an e-learning system. Statistical analysis showed that the use of security and cyber security countermeasures had a significant effect on the frequent use and participation of students in the contents of the system. Furthermore, encouraging feedback and communication from students about their e-learning experience to share their concerns, questions, and suggestions can help in addressing any security issues or concerns, as well as increasing students’ participation in the e-learning content.

Generative Adversarial Network Based Approach towards Synthetically Generating Insider Threat Scenarios

Generative Adversarial Network Based Approach towards Synthetically Generating Insider Threat Scenarios

DTITD: An Intelligent Insider Threat Detection Framework Based on Digital Twin and Self-Attention Based Deep Learning Models

DTITD: An Intelligent Insider Threat Detection Framework Based on Digital Twin and Self-Attention Based Deep Learning Models

Securing Cloud using Biometric Cryptographic Techniques

One of the best on-demand network access services to a significant shared pool of computer resources in the modern world is cloud computing. Many well-known economic advantages of cloud computing exist. Without having to own the underlying hardware, cloud computing enables users to take advantage of the combined benefits of three computing models for storage (Infrastructure as a Service), operating system (Platform as a Service), and software (Software as a Service) at their own premises. In spite of these financial advantages, public clouds are still not widely used, particularly by businesses. In terms of virtualized, geographically dispersed data centers, private clouds are now used by the majority of large enterprises, but they rarely serve as the primary source of resources. The main cause of this is the security risks associated with the current cloud infrastructures, which include server setup errors, software defects, power outages, hardware failures, malware, and insider threats. The goal of the research is to compare several biometric cryptography approaches for cloud security based on a variety of different criteria.

Detecting and Rectifying the Non-Malicious Insider Threat in a Healthcare Setting

This paper aims to apply habit-based research to the domain of information security. It proposes a new training paradigm in which a user “automatically” does the right thing without being an expert in the area of information security. The authors used a multiphased approach in which a new security training program was created and assessed for three groups: administrators (mostly managers), medical professionals (included physicians, physician assistants etc.) and staff (appointment coordinators, billing specialists etc.). The authors were able to find strong correlations between habit creation and security threats such as phishing, unauthorized cloud computing use, and password sharing. The authors were also able to ascertain that traditional security training and awareness programs need to move away from the “one-size” fits all technique to custom models that need to look at employee groups. This study supports the idea of training programs that are focused on changing habits, which is an area that has not yet been extensively researched in this context.

Faux Insider Hazard Investigation on Non-Public Cloud Computing by Using ADAM’s Technique

Cloud computing is a service system mechanism that businesses and organizations use to perform computerized and integrated transactions over computer networks. The service system must, of course, be”matched”with a”certain amount”of security. It is applied to” forecast the probability of cybercrime. A Cloud Service Provider (CSP) often offers cloud-based services with a basic level of security. Typically, CSPs are set up to offer their services on the open internet. Data security-focused organizations strive to shield their systems from a wide range of attackers. One of the alternatives is to construct a private cloud computing system. The issue is the potential for Man in the Cloud (MITC) assaults, which compromise and modify identities and are identified in cloud systems as phony insider threats. Based on the ISO 27032 standard research, the goal of this work is to undertake a threat analysis of MITC attack methodologies against private cloud computing services. With regards to risks to cloud services in a private cloud computing environment, it is intended that reporting and documenting the study' findings would lead to suggestions for more research and cybersecurity management procedures.

Risk Assessment of Insider Threats Based on IHFACS-BN

Insider threats, as one of the pressing challenges that threaten an organization’s information assets, usually result in considerable losses to the business. It is necessary to explore the key human factors that enterprise information security management should focus on preventing to reduce the probability of insider threats effectively. This paper first puts forward the improved Human Factors Analysis and Classification System (IHFACS) based on actual enterprise management. Then, the enterprise internal threat risk assessment model is constructed using the Bayesian network, expert evaluation, and fuzzy set theory. Forty-three classic insider threat cases from China, the United States, and Israel during 2009–2021 are selected as samples. Then, reasoning and sensitivity analysis recognizes the top 10 most critical human factors of the accident and the most likely causal chain of unsafe acts. The result shows that the most unsafe behavior was not assessing employees’ familiarity with the company’s internal security policies. In addition, improving the organizational impact of information security can effectively reduce internal threats and promote the sustainable development of enterprises.

Deep Learning Approaches to Cloud Security in the Indian Retail Sector

Cloud security in India's retail sector has become a significant concern as the industry adopts cloud-based solutions for data management and customer engagement. This paper examines how deep learning techniques such as Convolutional Neural Networks (CNN) and Autoencoders can be applied to detect anomalies and mitigate cyber threats in cloud-based retail environments. The study focuses on identifying and addressing security vulnerabilities such as data breaches, insider threats, and account takeovers. By presenting case studies from leading Indian retail companies, the paper highlights the potential of deep learning to enhance security and operational efficiency in cloud infrastructures.

Random resampling algorithms for addressing the imbalanced dataset classes in insider threat detection

Random resampling algorithms for addressing the imbalanced dataset classes in insider threat detection