Insider Threat Research Articles

Enhanced video-on-demand security in cloud computing against insider and outsider threats

Enhanced video-on-demand security in cloud computing against insider and outsider threats

Analysis of insider threat detection methods tested on CERT dataset

Applying artificial intelligence for insider threat detection faced a number of challenges: lack of data, user behavior modeling, etc. Meanwhile, there are open datasets for research and there are effective approaches of insider threat detection. This work considers studies that utilizes one of the popular datasets — CERT. A comparative analysis contains features used for user behavior modeling and insider threat detection methods.

Relational Deep Learning Detection with Multi-Sequence Representation for Insider Threats

Relational Deep Learning Detection with Multi-Sequence Representation for Insider Threats

Wrongdoing Monitor: A Graph-Based Behavioral Anomaly Detection in Cyber Security

The so-called <i>behavioral anomaly detection</i> (BAD) is expected to solve effectively a variety of security issues by detecting the deviances from normal behavioral patterns of protected agents. We propose a new graph-based behavioral modeling paradigm for BAD problem, named <i>behavioral identification graph</i> (BIG), which has distinct advantages over existing methods by mining deeply the <i>property-level</i> (as an enhancement to the <i>event-level</i>) associations in behavioral data. Under BIG, the behavioral properties and their co-occurrence associations in behavioral data are modeled as the entities and relationships of graph, respectively; furthermore, behavioral properties and events are both vectorized by a devised event-property composite model, and the behavioral patterns of agents are finally represented as a multidimensional spatial distribution of behavioral properties. Consequently, for a behavior, the intensity of its behavioral anomaly can be transformed into the spatial decentrality of its behavioral agent and properties which contain both fine-grained information between behavioral properties and coarse-grained information between behavioral events. To the best of our knowledge, this is the first work to improve behavioral modeling for anomaly detection by integrating <i>inter</i> (event-level) and <i>intra</i> (property-level) associations of behaviors into a unified graph and space. Our method is validated by four representative security issues, i.e., <i>fraud detection</i> in online payment services (by transaction behaviors), <i>intrusion detection</i> in network communication services (by traffic behaviors), <i>insider threat detection</i> in organizational information systems (by system behaviors), and <i>compromise detection</i> in social networking services (by trajectory behaviors).

A Federated and Explainable Approach for Insider Threat Detection in IoT

A Federated and Explainable Approach for Insider Threat Detection in IoT

Threats From Unintentional Insiders: An Assessment of an Organization’s Readiness Using Machine Learning

Today’s organisations are facing a number of challenges, one of the most significant of which is ensuring the safety of their digital data. This is as a result of the fact that they are frequently faced with internal and external threats that can put the data they have been entrusted with in jeopardy of being compromised. As a result of this, this study investigates the dimension of threats associated to unintentional internal user of an organisation and utilises NARX to model and test a detection scheme associated to the menace. In addition, this study aims to provide a better understanding of the current state of the threat landscape. The data adopted for this research is primarily a “user activity logs” dataset from CERT (release version r4.2). From the data, the study conceptualized “Access”, “Motivation”, and “Action” to be the key dimensions influencing “insider”, whereas “Intent”, “+Action”, “Method”, and “knowledge” are the key dimension influencing “threats”. Experimental analyses conducted by NARX within several numbers of partitions of the data point to a good detection capacity, with the greatest value of R <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> coming in at 0.97. This indicates that NARX was able to detect the crucial dimension that was formulated for by the research to be the detections parameter of an inadvertent insider threat when operating under the best partition. In light of these findings, organisations can use the proposed approach to assess their preparedness for Insider attacks.

Insider Threat Detection and Prevention using Semantic Score and Dynamic Multi Fuzzy Classifier

Insider Threat Detection and Prevention using Semantic Score and Dynamic Multi Fuzzy Classifier

Insider Attack Detection Using Deep Belief Neural Network in Cloud Computing

Cloud computing is a high network infrastructure where users, owners, third users, authorized users, and customers can access and store their information quickly. The use of cloud computing has realized the rapid increase of information in every field and the need for a centralized location for processing efficiently. This cloud is nowadays highly affected by internal threats of the user. Sensitive applications such as banking, hospital, and business are more likely affected by real user threats. An intruder is presented as a user and set as a member of the network. After becoming an insider in the network, they will try to attack or steal sensitive data during information sharing or conversation. The major issue in today's technological development is identifying the insider threat in the cloud network. When data are lost, compromising cloud users is difficult. Privacy and security are not ensured, and then, the usage of the cloud is not trusted. Several solutions are available for the external security of the cloud network. However, insider or internal threats need to be addressed. In this research work, we focus on a solution for identifying an insider attack using the artificial intelligence technique. An insider attack is possible by using nodes of weak users’ systems. They will log in using a weak user id, connect to a network, and pretend to be a trusted node. Then, they can easily attack and hack information as an insider, and identifying them is very difficult. These types of attacks need intelligent solutions. A machine learning approach is widely used for security issues. To date, the existing lags can classify the attackers accurately. This information hijacking process is very absurd, which motivates young researchers to provide a solution for internal threats. In our proposed work, we track the attackers using a user interaction behavior pattern and deep learning technique. The usage of mouse movements and clicks and keystrokes of the real user is stored in a database. The deep belief neural network is designed using a restricted Boltzmann machine (RBM) so that the layer of RBM communicates with the previous and subsequent layers. The result is evaluated using a Cooja simulator based on the cloud environment. The accuracy and F-measure are highly improved compared with when using the existing long short-term memory and support vector machine.

Mitigating Against a Succession of Hidden Failure Accelerants Involved in an Insider Threat Sequential Topology Attack on a Smart Grid: Devising a Defensive Paradigm via a Bespoke Convolutional Adversarial Neural Network Module and Particle Swarm Optimization-based Enhanced Reinforcement Learning Component

Mitigating Against a Succession of Hidden Failure Accelerants Involved in an Insider Threat Sequential Topology Attack on a Smart Grid: Devising a Defensive Paradigm via a Bespoke Convolutional Adversarial Neural Network Module and Particle Swarm Optimization-based Enhanced Reinforcement Learning Component

Review of insider and insider threat detection in the organizations

Aim: One of the major threats in cyber security is the insider threat. Most of the organizations are unaware of the insider threats. The organizational insiders like employees, system administrators and third party contractors have secret information related to the organizations. Protecting such secret information is very crucial to safeguard the organizational financial and reputational losses. Most of the authorized employees have access to confidential data when it bypasses the security it may lead to huge loss to the organization. Identifying and preventing the insider threat is a major challenge in any organization to safeguard it from the malicious acts of the insiders. This research study is aim at identifying the insider threat involved in any organization and the ways to protect these threat.Methodology: This paper reviews the research done on the insider threat classifying the research into three categories, the first one is about the insiders - representing types of insiders, motivation, insider access, methods used by insiders, insider profiling and levels of insiders, the second one is about the threat detection methods - describing the methodology, techniques, the datasets used to implement the different insider threat detection techniques and the various analyzed behavior of the user, the third one is insider threat analysis representing various evaluation metrics used.Findings: In the current digital era, one of the dangerous threats to organizations is due to the insiders. Most of the organizations are facingissues with insider threats since the global changes in the business environment. Excessive use of cloud and BYOD concepts to work fromhome was one of the major reason to increase the insider threat since 2019.Implications/Novel Contribution: Some of the recommendations for upcoming research are to use the hybrid solution to develop theeffective models to detect the insider threats, to enhance threat detection methods, and evaluate the performance of the existing methods usingthe live dataset.

Security Analysis of Machine Learning-Based PUF Enrollment Protocols: A Review.

The demand for Internet of Things services is increasing exponentially, and consequently a large number of devices are being deployed. To efficiently authenticate these objects, the use of physical unclonable functions (PUFs) has been introduced as a promising solution for the resource-constrained nature of these devices. The use of machine learning PUF models has been recently proposed to authenticate the IoT objects while reducing the storage space requirement for each device. Nonetheless, the use of a mathematically clonable PUFs requires careful design of the enrollment process. Furthermore, the secrecy of the machine learning models used for PUFs and the scenario of leakage of sensitive information to an adversary due to an insider threat within the organization have not been discussed. In this paper, we review the state-of-the-art model-based PUF enrollment protocols. We identity two architectures of enrollment protocols based on the participating entities and the building blocks that are relevant to the security of the authentication procedure. In addition, we discuss their respective weaknesses with respect to insider and outsider threats. Our work serves as a comprehensive overview of the ML PUF-based methods and provides design guidelines for future enrollment protocol designers.

Detecting Insider Threat from Behavioral Logs Based on Ensemble and Self-Supervised Learning

Recent studies have highlighted that insider threats are more destructive than external network threats. Despite many research studies on this, the spatial heterogeneity and sample imbalance of input features still limit the effectiveness of existing machine learning-based detection methods. To solve this problem, we proposed a supervised insider threat detection method based on ensemble learning and self-supervised learning. Moreover, we propose an entity representation method based on TF-IDF to improve the detection effect. Experimental results show that the proposed method can effectively detect malicious sessions in CERT4.2 and CERT6.2 datasets, where the AUCs are 99.2% and 95.3% in the best case.

A new intelligent multilayer framework for insider threat detection

In several earlier studies, machine learning (ML) has been widely used for building insider threat detection systems. However, the selection of the most appropriate ML classification model for insider threats detection remains a challenge. Despite the prominence of ML in the domain of insider threat detection, none of the previous works have utilized ML techniques for building a hybrid solution that can take advantage of the misuse and anomaly insider threat detection. In this study, a new multilayer framework has been proposed for insider threat detection. The first layer of the framework is used for selecting the best insider threat detection classification model among many based on the multi-criteria decision making techniques. The selection procedure has been developed based on the integration of the entropy-VIKOR methods. For the second layer, a hybrid insider threat detection method has been proposed, where the Misuse Insider Threat Detection (MITD) model has been created using the random forest algorithm. Subsequently, using the K-Nearest Neighbors algorithm, an anomaly insider threat detection algorithm has been developed. The proposed multilayer framework for insider threat detection has been evaluated by using the CERT r4.2 dataset. Results of the experiment demonstrate that the validity of the results produced by the selection framework is proven by the validation procedure obtained from previous research. The proposed hybrid detection method is observed to exhibit an overall accuracy of 99% and a false positive rate of 0.29% for known insider threats, whereas it exhibits 97% accuracy and 2.88% false-positive rate for unknown insider threats.

The role risk-management plays in reducing insider threat’s in the federal Government

ABSTRACT Today, organizations face a growing cybersecurity threats to their IT infrastructure. The ever expanding remote-workforce has made the risk of insider-threats even more dangerous. How can organizations be better prepared to handle the risk of the next insider-threat? The Federal Government is no different, as one of the largest employer’s in the world, the growing risk of an insider-threat is always present. In a systematic review, the evidence will identify how Federal agencies can utilize risk-management to be better prepared to combat an insider-threat. Recommendations will be made to help Federal agencies be on the lookout for the next viable insider-threat.

Influencing factors identification in smart society for insider threat in law enforcement agency using a mixed method approach

Influencing factors identification in smart society for insider threat in law enforcement agency using a mixed method approach

CYBERSECURITY: THE ENDGAME – PART TWO

In Part One, the conversation between the sisters and the origin story of “controls” revealed how errors in assumptions, use of wrong math and method – compounded by complexity, and uncertainty created structural flaws in cybersecurity. Recall, a “structural flaw” is about design, whether a business process or a building. Better implementation/construction, maintenance or bandage solutions cannot fix a structural flaw. Part One analyzed the first of four structural flaws in cybersecurity – “controls.” These flaws churn cyber pros, CISOs and senior managers. These flaws are more dangerous in an era of cyberwarfare. Part One then described how to review controls to determine which to keep, fix or eliminate. The opportunity is to achieve more efficient and effective security – with less waste, distraction, and false sense of security. In Part Two, we diagnose three more structural flaws – “lines of defense,” frameworks and insider threats. The emphasis continues on structural flaws that cannot be fixed by better implementation, working longer hours or tweaking. Instead, cybersecurity improvements come from fixing the structural flaws and shifting to better approaches. Better approaches are drawn from proven and practical business management methods in simplification, psychology, systems thinking and design thinking. These can more easily achieve benefits through diverse, high-performing teams.

Understanding factors that influence unintentional insider threat: a framework to counteract unintentional risks

The exploitation of so-called insiders is increasingly recognised as a common vector for cyberattacks. Emerging work in this area has considered the phenomenon from various perspectives including the technological, the psychological and the sociotechnical. We extend this work by specifically examining unintentional forms of insider threat and report the outcomes of a series of detailed Critical Decision Method (CDM) led interviews with those who have experienced various forms of unwitting cybersecurity breaches. We also articulate factors likely to contribute firmly in the context of everyday work-as-done. CDM’s probing questions were used to elicit expert knowledge around how decision making occurred prior, during and post an unintentional cyber breach whilst participants were engaged in the delivery of cognitive tasks. Through the application of grounded theory to data, emerging results included themes of decision making, task factors, accidents and organisational factors. These results are utilised to inform an Epidemiological Triangle to represent the dynamic relationship between three vectors of exploit, user and the work environment that can in turn affect the resilience of cyber defences. We conclude by presenting a simple framework, which for the purposes of this work is a set of recommendations applicable in specific scenarios to reduce negative impact for understanding unintentional insider threats. We also suggest practical means to counteract such threats rooted in the lived experience of those who have fallen prey to them.

Insiders Dissected: New Foundations and a Systematisation of the Research on Insiders

The insider threat is often cited as one of the most challenging threats for security practitioners. Even though this topic is receiving considerable attention, two main problems remain unsolved. First, research on insider threats is focusing on many different insiders without being able to actually identify and consistently entitle the key aspects of the insiders. As a result, this research can neither be identified by practitioners as being relevant for their real-world insider problems, nor can it be compared with other research targeting the same insider aspects. Second, a clear understanding of insiders is vital for analysing, which insider properties are responsible for the peculiarity of insider threats . In this article, a systematic approach to dissect the defining aspects of insiders is proposed, which includes specific allocatable insider characteristics. Additionally, the insider characteristics are extended toward insider types, which establish universal and unambiguous names for different insiders and which are related with each other to form a new and simple insider taxonomy . The new foundations on insiders allow the comparison of different insider research in a structured manner. Furthermore, the new approach facilitates the identification of specific features of insider threats in future work.

Using Dirichlet Marked Hawkes Processes for Insider Threat Detection

Malicious insiders cause significant loss to organizations. Due to an extremely small number of malicious activities from insiders, insider threat is hard to detect. In this article, we present a Dirichlet Marked Hawkes Process (DMHP) to detect malicious activities from insiders in real-time. DMHP combines the Dirichlet process and marked Hawkes processes to model the sequence of user activities. The Dirichlet process is capable of detecting unbounded user modes (patterns) of infinite user activities, while, for each detected user mode, one set of marked Hawkes processes is adopted to model user activities from time and activity type (e.g., WWW visit or send email) information so that different user modes are modeled by different sets of marked Hawkes processes. To achieve real-time malicious insider activity detection, the likelihood of the most recent activity calculated by DMHP is adopted as a score to measure the maliciousness of the activity. Since the majority of user activities are benign, those activities with low likelihoods are labeled as malicious activities. Experimental results on two datasets show the effectiveness of DMHP.

Results From Invoking Artificial Neural Networks to Measure Insider Threat Detection &amp; Mitigation

Advances on differentiating between malicious intent and natural “organizational evolution” to explain observed anomalies in operational workplace patterns suggest benefit from evaluating collective behaviors observed in the facilities to improve insider threat detection and mitigation (ITDM). Advances in artificial neural networks (ANN) provide more robust pathways for capturing, analyzing, and collating disparate data signals into quantitative descriptions of operational workplace patterns. In response, a joint study by Sandia National Laboratories and the University of Texas at Austin explored the effectiveness of commercial artificial neural network (ANN) software to improve ITDM. This research demonstrates the benefit of learning patterns of organizational behaviors, detecting off-normal (or anomalous) deviations from these patterns, and alerting when certain types, frequencies, or quantities of deviations emerge for improving ITDM. Evaluating nearly 33,000 access control data points and over 1,600 intrusion sensor data points collected over a nearly twelve-month period, this study's results demonstrated the ANN could recognize operational patterns at the Nuclear Engineering Teaching Laboratory (NETL) and detect off-normal behaviors—suggesting that ANNs can be used to support a data-analytic approach to ITDM. Several representative experiments were conducted to further evaluate these conclusions, with the resultant insights supporting collective behavior-based analytical approaches to quantitatively describe insider threat detection and mitigation.