Malicious Insider Attacks Research Articles

DeepMIA: An Integrated and Accelerated approach for Malicious Insider Attack Detection in IOT using Deep Learning

Abstract: The Internet of Things (IoT) are poised to transform our lives and are becoming increasingly popular in smart homes, smart industrial networks. IoT devices can be used for a variety of purposes, including healthcare. Always, IoT device security is an issue because they are in charge of creating and handling large amounts of sensitive data. A security breach has been found to have an influence on people and eventually, the entire planet. Artificial intelligence (AI) has a greater range of applications and is currently being investigated for use in IoT device security. A malicious insider attack is the most serious security concern associated with IoT devices. Although much IoT security research has focused on ways to prevent unauthorized and unlawful access to systems and information, the most severe malicious insider attacks, which are often the result of internal attack within an IoT network or environment, have gone unnoticed. Here we have proposed a model called ‘DeepMIA’, which uses Deep Learning to detect dangerous insider attacks in the IoT context. This in resource-constrained IoT contexts, the research proposes a lightweight technique for detecting insider assaults that can detect abnormalities arising from sensors data or device data that are connected in a IoT Environment. The DeepMIA model is evaluated with UNSW-NB15 Dataset and achieves a decent accuracy of 99% with deep learning models

Honeyboost: Boosting honeypot performance with data fusion and anomaly detection

With insider attacks becoming more common and costing organizations more every year, it has never been more crucial to be able to predict when an insider attack may happen. Network Anomaly Detection Systems (NADS) have the ability to identify unusual behavior making them useful in predicting cyberattacks, but often suffer from high false positive rates. Honeypots used in conjunction with NADS can help with learning attack behaviors and enable better prediction. However both honeypots and legacy NADS are generally deployed at the gateway to a network.In this paper, we introduce a novel framework called Honeyboost, deployed in the LAN, rather than at the perimeter, focusing on internal-LAN traffic to predict, for example, a malicious insider attack. Honeyboost incorporates an NADS, as well as a honeypot, within an internal network. The anomaly detection technique incorporated into Honeyboost is Lookout, a new method built on extreme value theory that makes it possible to achieve highly desirable low false positive rates. Using data from the LAN Security Monitoring Project, Honeyboost identifies most anomalous nodes before they access the honeypot, thus aiding early detection and prediction.Honeyboost is an unsupervised method comprising of two approaches: horizontal and vertical. The horizontal approach constructs a time series from the communications, via ARP, TCP or UDP, of each node, with node-level features encapsulating the node’s behavior over time. The vertical approach finds anomalies in each protocol (ARP, TCP, UDP) space. Using a window-based model, typical in online scenarios, the horizontal and vertical approaches are combined to identify anomalies and gain useful insights. Experimental results indicate the efficacy of our framework in identifying suspicious activities of nodes.

Mitigating Malicious Insider Attacks in the Internet of Things using Supervised Machine Learning Techniques

The interconnection of large number of smart devices and sensors for critical information gathering and analysis over the internet has given rise to the Internet of Things (IoT) network. In recent times, IoT has emerged as a prime field for solving diverse real-life problems by providing a smart and affordable solutions. The IoT network has various constraints like: limited computational capacity of sensors, heterogeneity of devices, limited energy resource and bandwidth etc. These constraints restrict the use of high-end security mechanisms, thus making these type of networks more vulnerable to various security attacks including malicious insider attacks. Also, it is very difficult to detect such malicious insiders in the network due to their unpredictable behaviour and the ubiquitous nature of IoT network makes the task more difficult. To solve such problems machine learning techniques can be used as they have the ability to learn the behaviour of the system and predict the particular anomaly in the system. So, in this paper we have discussed various security requirements and challenges in the IoT network. We have also applied various supervised machine learning techniques on available IoT dataset to deduce which among them is best suited to detect the malicious insider attacks in the IoT network.

Secure Health Fog: A Novel Framework for Personalized Recommendations Based on Adaptive Model Tuning

The emergence of smart technology has equipped humans with wearables and sensors that collect relevant data related to individuals and their surroundings. In healthcare, the collected data can monitor user emotion, behavior, and activity, which leads to the development of personalized decisions and improves lifestyle. In this paper, we analyzed the existing health fog framework and identified its limitations in terms of security, performance, and accuracy. Based on these limitations, we propose a secure health fog (SHF) framework that collects data from different Internet of Things (IoT) devices and maintains a personalized repository for adaptive model tuning. The adaptive model improves periodically based on user feedback and generates a personalized recommendation. Moreover, the existing IoT devices mostly rely on low-cost and low-power Zigbee technology, which is vulnerable to different attacks, such as device control, eavesdropping, fake device injection, malicious insider, man-in-the-middle, masquerading, message tampering, privacy leakage, and replay attack. Therefore, we propose a Zigbee Secure Health Fog (ZigbeeSHF) protocol, which uses symmetric and public-key cryptography to prevent these attacks. For data migration security, we concatenate the encrypted data with the encrypted digital signature to provide data authenticity, integrity, and confidentiality. To support our claims, we use the automated formal verification tools Scyther and AVISPA (Automated Validation of Internet Security Protocols and Applications), which evaluate the protocols based on the threat model and exploits the vulnerabilities in different attacking environments. The results of both tools ensure prevention against the mentioned attacks. As a proof of concept, we also evaluate the accuracy and performance of our proposed framework in a smart studio apartment. The result shows that the adaptive model tuned for an individual user is very effective, and the average accuracy of 32.5% is improved after one month. Furthermore, the proposed ZigbeeSHF protocol requires 7.93% and 25.35% more computation time than Zigbee with and without installation code, respectively.

An Analysis of Motive and Observable Behavioral Indicators Associated With Insider Cyber-Sabotage and Other Attacks

Malicious insider attacks affect all sectors, economies, and organizations of the world, with insider cyber-sabotage causing significant damage. Key findings from previous research on malicious insider threats underscore a need for prevention and detection programs that are broadly based. Current risk management administrative and technical mitigation techniques often include indicators of potential malicious insiders in the form of personal factors and observable behaviors. However, these need empirical validation in the context of cyber-sabotage. This article builds on previous research on insider threats and investigates the relationship between motives, behavioral indicators, and insider cyber-sabotage. We examine 74 actual cases of convicted insider threat attacks using a logistic regression model. The results confirm hypotheses that revenge (one of the motives), addiction (one of the observable behavioral indicators), and poor work performance increase the likelihood of insider sabotage. The findings provide empirical validation of cyber-sabotage specific indicators for insider threat programs. Implications and future research are discussed.

Analyzing Data Granularity Levels for Insider Threat Detection Using Machine Learning

Malicious insider attacks represent one of the most damaging threats to networked systems of companies and government agencies. There is a unique set of challenges that come with insider threat detection in terms of hugely unbalanced data, limited ground truth, as well as behaviour drifts and shifts. This work proposes and evaluates a machine learning based system for user-centered insider threat detection. Using machine learning, analysis of data is performed on multiple levels of granularity under realistic conditions for identifying not only malicious behaviours, but also malicious insiders. Detailed analysis of popular insider threat scenarios with different performance measures are presented to facilitate the realistic estimation of system performance. Evaluation results show that the machine learning based detection system can learn from limited ground truth and detect new malicious insiders in unseen data with a high accuracy. Specifically, up to 85% of malicious insiders are detected at only 0.78% false positive rate. The system is also able to quickly detect the malicious behaviours, as low as 14 minutes after the first malicious action. Comprehensive result reporting allows the system to provide valuable insights to analysts in investigating insider threat cases.

Malicious Insider Attack Detection in IoTs Using Data Analytics

Internet of Things (IoTs) are set to revolutionize our lives and are widely being adopted nowadays. The IoT devices have a range of applications including smart homes, smart industrial networks and healthcare. Since these devices are responsible for generating and handling large amounts of sensitive data, the security of the IoT devices always poses a challenge. It is observed that a security breach could effect individuals and eventually the world at large. Artificial intelligence (AI), on the other hand, has found many applications and is widely being explored in providing security specifically for IoT devices. Malicious insider attack is the biggest security challenge associated with the IoT devices. Although, most of the research in IoT security has pondered on the means of preventing illegal and unauthorized access to systems and information; unfortunately, the most destructive malicious insider attacks that are usually a consequence of internal exploitation within an IoT network remains unaddressed. Therefore, the focus of this research is to detect malicious insider attacks in the IoT environment using AI. This research presents a lightweight approach for detecting insider attacks and has the capability of detecting anomalies originating from incoming data sensors in resource constrained IoT environments. The results and comparison show that the proposed approach achieves better accuracy as compared to the state of the art in terms of: a) improved attack detection accuracy; b) minimizing false positives; and c) reducing the computational overhead.

Recommender System for Geo-Social Access Control Framework

A malicious attack or threat can happen within any organization, from their own employees, administrators, contractors or former employees, who pose the important resources of a company such as database, physical laboratories and financial resources. In an organization insider attacks are most common as well as most costly affair. According to United States cyber security 2018 statistics, insider threat holds the risk of 74% out of surveyed organizations. The insider threat has caused immense loss to data as well as monetary assets. Among the surveyed organization by US cyber securities, 53% of organization claimed their remediation cost was around $ 100000 and in 2018 the number raised to 66%. Higher number of organization claimed insider attackers were most costly attacks in comparison with external attacks. Some of the probable reasons, why it is difficult to stop an insider attack are, firstly insider threat may be unintentional and all of sudden. Second is distinguishing regular work by employee and malicious work is difficult. Third is most of the insider attackers are technologically sound to mask their intentional activities or easily erase the intentional activity signs from the system before anyone observes it. Lastly and the worst case is employees simply say their intentional act was by mistake and escape from scenario. To avoid such malicious insider attacks lots of research is done on access control. Access control is a method or technique to control the access of an insider to the organizations valuable resources. There are different types of access control models, having their own access control policies and criteria to grant the authority, to have an access to specific resources of an organization. In this paper we discuss the different types of technical access control models that have been developed with certain parameters and their advantages and limitations.

ARCN: Authenticated Routing on Cloud Network to Mitigate Insider Attacks on Infrastructure as a Service

Cloud security is one of the major issues which are affecting the acceptance of Cloud computing (CC). In spite of the number of benefits offered by CC, it also suffers from a myriad of security vulnerabilities. Security is the prime concern while we are accessing the resources from the Cloud through the Internet. This research work is primarily on IAAS (Infrastructure as a service). Here a protocol called Authenticated Routing on Cloud Network (ARCN) has been proposed, to secure the communication route between the client and service provider. The proposed protocol ARCN uses the public key cryptography to mitigate the various security attacks like malicious insider attacks, Spoofing, Falsified routes, DoS, etc.

ADRCN: A Framework to Detect and Mitigate Malicious Insider Attacks in Cloud-Based Environment on IaaS

Security is a critical factor for any of the computing platforms. Cloud computing is a new computing environment but still, its basic technology is the Internet. Thus, Cloud computing environment not only has the threats of its own but it is also prone to security issues of its underlying technology i.e. Internet. In this paper, the authors are proposing a secure routing framework viz. Authenticated Dynamic Routing in Cloud Networks (ADRCN) to mitigate the malicious insider attacks while maintaining the path integrity in the Clouds. Symmetric cryptography with hashing is used to maintain the integrity of the path between the source and destination. The purpose of ADRCN is to maintain the integrity of the path between the client and data center. If malicious insider tries to perform an attack between the client and the data center then it will be detected. This work aims to give a solution for detection and prevention of malicious insider attacks in Cloud-based environments.

Inside the Insider

We present an overview of two major research projects on the role of monetary incentives and psychological traits in attracting individuals to hacking behavior. In the first study, scenarios were developed for five situations to determine if monetary incentives could be used to influence subjects to obtain healthcare information and to release that information. Approximately 35% to 46% of the 523 survey participants indicated that there is a price, ranging from $1,000 to over $10 million, acceptable for violating HIPAA laws. In the second study, 439 subjects completed a survey that identified the psychological traits that contribute to an individual's propensity to participate in White Hat, Grey Hat, or Black Hat hacking. Preliminary results suggest that individuals that are White Hat, Grey Hat and Black Hat hackers score high on the Machiavellian and Psychopathy scales. We also found evidence that Gray Hatters oppose authority, Black Hatters score high on the thrill-seeking dimension, and White Hatters, the good guys, tend to be Narcissists. Our focus on both studies is malicious insider attacks because insiders have the ability to do substantial monetary and reputational damage to the organization. Several suggestions have been made on addressing insider threats.

A generic approach for integrity verification of big data

Data integrity verification is a primary issue for the prominent and unchallenged success of Big Data. The large scale of data includes extra security overheads on customers that used Big Data services. In Big Data environment, many security challenges have pinched out such as data security, malicious insider attack, cyber attack, and abuse of data. In this paper, we have analyzed and identified a novel data integrity verification technique that provides better performance, efficiency, and quick review of Big Data. The milestone of our work are algebraic signature, homomorphic tag, and Combinatorial Batch Codes (CBC). Homomorphic tag delegates a special verifiable value to each data blocks. CBC allocates integral data to store on Big Data servers. This research work used multiple third-party auditors for batch auditing which ensure data integrity in a Big Data environment. Our approach handles single point failure error of single Third Party Auditor (TPA) efficiently. Without using any additional data structure, it supports dynamic data operations. The security and performance analysis with comparative results show the genuine application of our approach within the latest Big Data environment.

Securing Services in Networked Cloud Infrastructures

In this paper, we propose techniques and architecture for securing services that are hosted in a multi-tenant networked cloud infrastructures. Our architecture is based on trusted virtual domains and takes into account both security policies of the tenant domains as well as specific security policies of the virtual machines in the tenant domains. We describe techniques for detecting a range of attacks such as attacks between the virtual machines within a trusted virtual domain, attacks between the virtual machines in different domains, malicious insider attacks and attacks against specific services such as DNS, database and web servers within a domain. We address security policies for trusted virtual domain management such as secure addition and deletion of a virtual machine and the revocation of privileges associated with a virtual machine in a domain. We also discuss forensic analysis of attacks and fine granular detection of malicious entities and mechanisms for restoration of services. Furthermore the proposed architecture provides mechanisms for enhancing the assurance of communications between the virtual machines in different domains. Finally, we present the implementation of our security architecture using Xen and illustrate how our architecture is able to secure services in networked cloud infrastructures.

Securing Digital Image from Malicious Insider Attacks

Protection of digital images from malicious (and dishonest) insider entities is an important concern in modern digital space. A malicious entity can alter some important features of an image to mislead the target recipient of the image, which can cause harm in applications such as healthcare, insurance, product description and so on. In order to protect digital images, cryptographic primitives such as pseudo-random function and digital signature have been used in practice for image protection. In this article, the authors present a method of image protection from malicious image manipulation. The authors use the concept of secret sharing and public key primitives in the proposed method. This article discusses on attacks involving generation of fake shares to cheat honest user(s) and a demonstration of the proposed system employing a centralized server to generate shares and authenticate them on the basis of requests is made as a counter to the described attack.

SPFP: Ticket-based secure handover for fast proxy mobile IPv6 in 5G networks

Recently, Chuang et al. introduced a secure password authentication mechanism, called SPAM, for seamless handovers in Proxy Mobile IPv6 (PMIPv6). SPAM aimed at providing high security properties while optimizing handover latency and computation overhead, but as pointed out in this paper SPAM is vulnerable to replay and malicious insider attacks as well as the compromise of a single node. In this paper, a new Security Protocol for Fast PMIPv6, called SPFP, is proposed that provides a ticket-based secure handover for mobile nodes (MNs). In SPFP, a ticket containing authentication materials is used for fast handover authentication when an MN changes its attachment point. Moreover, the MN’s anonymity is supported for preserving location privacy. Detailed operations of initial authentication and handover authentication are presented with message flows. The formal security analysis of SPFP is provided with results of qualitative analysis and quantitative analysis.

An Approach for Data Security from Malicious Attacker in Cloud Computing

Objectives: Cloud computing allows clients to access various IT resources online without much expenditure and investment. Although there are various advantages of cloud computing, but still various security threats exist in the cloud environment, e.g. data security, account hijacking, privacy and users’ authenticity. Methods/Statistical Analysis: In this research paper, an empirical approach has been applied which is based upon the program implementation of the proposed model for data security in the cloud environment. The applied approach shows that the proposed model for data security will prevent the cloud data from the fraudulent activities that can be performed at both ends (i.e. cloud provider and cloud user). Findings/Conclusion: In this research paper, a model for data security has been presented which will protect cloud data from malicious insider attacks as well as fraud cloud user simultaneously. It is concluded that a single combined approach is enough to tackle the fraud at both ends i.e. at cloud user end and at cloud provider end. Implementation for above model is also done under compiler “Turbo C” and results are also shown in the form of screenshot for each case. It is also concluded that the cloud provider will have always a proof that he is not responsible for the corruption of cloud user’s data unless he has cloud user’s decryption key. Application/Improvements: The proposed model is applicable as a remedy for repudiation problems and providing better data security in cloud environment. The implemented program can be enhanced using high bit encryption method to improve and provide more data security to the cloud.

Lightweight Communication Overhead Authentication Scheme Using Smart Card

<p>Authentication takes its place to grant authorized user a remote access to certain online resources. As well, prevent unauthorized user from accessing that resources. Unforyunatly most of authentication schemes consider only security factors without taking in consideration the communication resources required. Recently, Li et. al. proposed an enhanced smart card based remote user password authentication scheme. We analyzed their scheme and we pointed out that, their scheme required high communication overhead. Furthermore, their scheme suffer from forgery, user impersonation and server impersonation attacks. Through this paper to address aforesaid weaknesses, we propose a Lightweight communication overhead authentication scheme using smart card. The security and performance analysis shows that, our proposed scheme is lightweight communication and computation cost as well secure and can withstand wide spectrum of malicious attacks, like forgery, insider, replay and stolen smart card attack. Besides, our scheme encompasses desired security attributes. Therefore, it is suitable for practical use compared to other related scheme. </p>

Insider Threat Mitigation in Cloud Computing

Insider threat is one of the most critical security threats for any Industry, even it is the most eldest strategy to fall an empire down, very common in diplomacy according to the human history. In the cloud computing ecosystem there are several problems that is harder than the normal (not could) scenarios. If the insider threats are the most dangerous threat even in the non-cloud platform then it must has multidimensional attack vectors in cloud computing. Many researches have been done and are being carried out in the field of cyber security for malicious insider attacks. In the provider end of the service, the insider who can harm the system most is the System administrator because he has the highest access control and other privileges. Sometimes when the user demands some resources and the provider is running out of that kind of resource then, they outsource the resource from the third party or cloud broker. The resources are like server, storage and device or public/private cloud. In this paper we propose a technical solution and some policies for the cloud provider to mitigate the insider attack due to the rogue administrator. We also discuss about the possibility of insider attack in outsourcing issue of cloud computing and provide some policies as solution for that problem.

Comments on “SPAM: A Secure Password Authentication Mechanism for Seamless Handover in Proxy Mobile IPv6 Networks”

Recently, Chuang et al. have introduced a secure password authentication mechanism for seamless handover in Proxy Mobile IPv6 (SPAM). SPAM aimed at providing high-security properties while optimizing the handover latency and the computation overhead. However, it is still vulnerable to replay and malicious insider attacks, as well as the compromise of a single node. This paper formally and precisely analyzes SPAM based on the Burrows–Abadi–Needham logic, followed by its weaknesses and related attacks.

Analysis of Insiders Attack Mitigation Strategies

Insider attacks become a severe threat to organizations. The emergence of Cloud computing that provides computing as a utility has attracted organizations to store their sensitive data remotely by subscribing the virtual storage from Cloud service provider. While data outsourcing relieves the data owners from burden of local data storage maintenance and security, the steps of embracing Cloud storage service has led to security problems. With the services provided by Cloud service provider that can be extended from Cloud user to Private Cloud and expanded to Public Cloud, there are many possibilities that malicious insider attacks may occur to exploit the weaknesses of Cloud systems. Until now there are no perfect mitigation strategies that can be relied on to solve the threats. We describe the Cloud computing and security issues, discuss about malicious insiders attack in Cloud computing and analyses the existing mitigation strategies and techniques to reduce malicious insiders threats in Cloud computing.