Potential Insider Threats Research Articles

A federated and explainable approach for insider threat detection in IoT

An insider threat is a malicious action launched by authorized personnel inside the organization. Since insider actions may only leave a small digital footprint in the system, it is considered a major cybersecurity challenge in different applications. Along with the rapid growth of the Internet of Things (IoT) and the extensive attack surface in this technology, many concerns have been raised regarding the potential insider threats in IoT environments. Several studies have been conducted on Machine Learning (ML)-based insider threat detection solutions which are focused on the models’ performance while the trustability of these models is neglected. Trustworthy Learning refers to a new trend in ML that focuses on ways to ensure that the data collection and data analysis procedures in ML techniques follow ethical applications and are trustable to human users. This approach enforces the acceptance and successful adoption of ML-based solutions. This study aims to propose an improved trustworthy insider threat detection method that ensures two of the trustworthy learning requirements: Privacy and Explainability. The proposed solution protects the privacy of the utilized data and is capable of explaining why certain behaviors are detected as a threat. The proposed solution also leverages data collaboration between different data owners to increase the volume of data used in the training process and enhance the performance of the ML model. Experimental results show the proposed solution outperforms the learning models trained by individual data holders.

Preventing and countering insider threats and radicalism in an Indonesian research reactor: Development of a human reliability program (HRP)

Nuclear technology has been present in Indonesia for more than 60 years, with the main facilities being three research reactors managed safely and securely. Considering the rapid changes in Indonesia's socio-political and economic situation, it is imperative to anticipate potential insider threats due to these influences. Thus, the National Nuclear Energy Agency of Indonesia developed the first human reliability program (HRP) in Indonesia, perhaps the first HRP in Southeast Asia. The development of this HRP was based on qualitative and quantitative analysis. The HRP candidates were determined based on their level of risk and ability to access nuclear facilities, and 20 people who worked directly in a research reactor were selected as HRP candidates. The candidates' background data and interviews were the basis for determining their assessment. The 20 HRP candidates were unlikely to be an internal threat. However, some of the candidates had significant records of job dissatisfaction. Counseling support could be one of the solutions for this issue. Two candidates disagreed with government policies, so they tended to sympathize with banned groups. Therefore, management should warn and nurture them to not become future insider threats. The results of this HRP provided an overview of the HR situation in a research reactor in Indonesia. Various aspects must be further developed, especially management's commitment to periodically or when necessary, increase the knowledge of the HRP team and, if necessary, invite outside experts.

Explainable artificial intelligence to evaluate industrial internal security using EEG signals in IoT framework

Industrial insider threat detection has consistently been a popular field of research. To help detect potential insider threats, the emotional states of humans are identified through a wide range of physiological signals including the galvanic skin response, electrocardiogram, and electroencephalogram (EEG). This paper presents an insider risk assessment system as a fitness for duty security evaluation using EEG brainwave signals with explainable deep learning and machine learning algorithms to classify abnormal EEG signals indicating a potential insider threat and evaluating fitness for duty. The system is designed to be cost-effective by using an Emotiv Insight EEG device with five electrodes. In this study, the data from 17 people in different emotional states were collected. The different levels of emotions were mapped and classified into four risk levels, namely low, normal, medium, and high. The data were collected while the subjects were presented with different images from the scientific international affective picture system. The collected EEG signals were preprocessed to eliminate noise from physical movements and blinking. The data were then used to train self-feature learning of two- and one-dimensional convolutional neural networks, Adaptive Boosting, random forest, and K-nearest neighbors models; the proposed method yielded classification accuracies of 96, 75, 97, 94 and 81%, respectively.

An email content-based insider threat detection model using anomaly detection algorithms

Insider threats significantly impact businesses as well as governments and military organizations. The focus of threats has shifted from external attack to within organizations where authorized users have become potential insider threats. Existing insider threats detection methods, such as the rule-based approach rely on expert knowledge making it not robust. An insider threat detection method is proposed based on email user behaviour and anomaly detection algorithms to overcome this limitation. An email content based on the IT administrator role is constructed from the CERT r6.2 dataset using natural language pre-processing modules. Topic modelling is performed on the dataset to generate a vector space, which serves as input to anomaly detection algorithms to detect malicious email contents. The experimental results demonstrate that the proposed model has an 89% detection rate over the baseline model. A combination of K-means and PCA anomaly detection algorithms yielded a good detection rate of 89% for 1%, 5%, 10%, 15%, 20%, 25%, and 30% cut-off values anomaly scores.

NATO Human View Executable Architectures for Critical Infrastructure Analysis

Engineering managers are responsible for the secure operation of critical infrastructure systems and need tools and methods to identify and mitigate potential insider threats such as physical damage to equipment, information leakage, malware, and identify theft. This research examines the benefit of development and analysis of the NATO Human View to aid engineering managers with this responsibility. In an illustrative case study, the NATO Human View is used to analyze electrical grid personnel; the results demonstrate that the NATO Human View can be used to enable engineering managers to make investment decisions that can mitigate security threats.

Employee profiling via aspect-based sentiment and network for insider threats detection

Historically, the harm caused by insiders has proven to be one of the greatest concerns for any organization. As such, it has received considerable attention from both the industrial and research communities. Existing works mainly focused on modeling the employees’ normal biometric behavior (e.g., human to device interaction pattern) to detect anomalous behavior which corresponds to the insider activity. However, it is unattainable to stop the insider at the final moment when the malicious act is being carried out. In this paper, we propose a novel framework which performs employee profiling based on aspect-based sentiments and social network information and examine its applicability for early detection of potential insider threats. On the contrary to the traditional sentiment analysis, aspect-based sentiment analysis provides more fine-grained information on the employee. Our framework employs a combination of deep learning techniques such as Gated Recurrent Unit (GRU) and skipgram to build temporal sentiment profiles for the employees. It then performs anomaly detection on the profiles and ranks the employees based on their respective anomaly score. Due to the absence of relevant benchmark dataset, we augmented the publicly available real-world Enron email corpus with an insider threat scenario to evaluate our framework. The evaluation results demonstrate that the augmentation is indeed reflected in the augmented employee’s anomaly ranking (i.e., from normal to abnormal) and her close associates are indeed placed closely to her when the profiles are visualized in the 2D space. The profiles obtained from our framework can also be used to complement any existing expert and intelligent systems with additional capabilities in handling textual information such as, integration with profiles obtained from biometric behavior to form a more comprehensive threat detection system.

Detecting Potential Insider Threat: Analyzing Insiders’ Sentiment Exposed in Social Media

In the era of Internet of Things (IoT), impact of social media is increasing gradually. With the huge progress in the IoT device, insider threat is becoming much more dangerous. Trying to find what kind of people are in high risk for the organization, about one million of tweets were analyzed by sentiment analysis methodology. Dataset made by the web service “Sentiment140” was used to find possible malicious insider. Based on the analysis of the sentiment level, users with negative sentiments were classified by the criteria and then selected as possible malicious insiders according to the threat level. Machine learning algorithms in the open-sourced machine learning software “Weka (Waikato Environment for Knowledge Analysis)” were used to find the possible malicious insider. Decision Tree had the highest accuracy among supervised learning algorithms and K-Means had the highest accuracy among unsupervised learning. In addition, we extract the frequently used words from the topic modeling technique and then verified the analysis results by matching them to the information security compliance elements. These findings can contribute to achieve higher detection accuracy by combining individual’s characteristics to the previous studies such as analyzing system behavior.

Using Regression to Predict Potential Insider Threats

Using Regression to Predict Potential Insider Threats

Indicator-based Behavior Ontology for Detecting Insider Threats in Network Systems

Malicious insider threats have increased recently, and methods of the threats are diversifying every day. These insider threats are becoming a significant problem in corporations and governments today. From a technology standpoint, detecting potential insider threats is difficult in early stage because it is unpredictable. In order to prevent insider threats in early stage, it is necessary to collect all of insiders’ data which flow in network systems, and then analyze whether the data are potential threat or not. However, analyzing all of data makes us spend too much time and cost. In addition, we need a large repository in order to collect and manage these data. To resolve this problem, we develop an indicator-based behavior ontology (IB2O) that allows us to understand and interpret insiders’ data packets, and then to detect potential threats in early stage in network systems including social networks and company networks. To show feasibility of the behavior ontology, we developed a prototype platform called Insider Threat Detecting Extractor (ITDE) for detecting potential insider threats in early stage based on the behavior ontology. Finally, we showed how the behavior ontology would help detect potential inside threats in network system. We expect that the behavior ontology will be able to contribute to detecting malicious insider threats in early stage.

An Insider Threat Detection Method Based on Business Process Mining

Current intrusion detection systems are mostly for detecting external attacks, but the “Prism Door” and other similar events indicate that internal staff may bring greater harm to organizations in information security. Traditional insider threat detection methods only consider the audit records of personal behavior and failed to combine it with business activities, which may miss the insider threat happened during a business process. The authors consider operators' behavior and correctness and performance of the business activities, propose a business process mining based insider threat detection system. The system firstly establishes the normal profiles of business activities and the operators by mining the business log, and then detects specific anomalies by comparing the content of real-time log with the corresponding normal profile in order to find out the insiders and the threats they have brought. The relating anomalies are defined and the corresponding detection algorithms are presented. The authors have performed experimentation using the ProM framework and Java programming, with five synthetic business cases, and found that the system can effectively identify anomalies of both operators and business activities that may be indicative of potential insider threat.

Privacy preserving model: a new scheme for auditing cloud stakeholders

The Cloud computing paradigm provides numerous attractive services to customers such as the provision of the on-demand self-service, usage-based pricing, ubiquitous network access, transference of risk, and location independent resource sharing. However, the security of cloud computing, especially its data privacy, is a highly challengeable task. To address the data privacy issues, several mechanisms have been proposed that use the third party auditor (TPA) to ensure the integrity of outsourced data for the satisfaction of cloud users (CUs). However, the role of the TPA could be the potential security threat itself and can create new security vulnerabilities for the customer’s data. Moreover, the cloud service providers (CSPs) and the CUs could also be the adversaries while deteriorating the stored private data. As a result, the objective of this research is twofold. Our first research goal is to analyze the data privacy-preserving issues by identifying unique privacy requirements and presenting a supportable solution that eliminates the possible threats towards data privacy. Our second research goal is to develop the privacy-preserving model (PPM) to audit all the stakeholders in order to provide a relatively secure cloud computing environment. Specifically, the proposed model ensures the quality of service (QoS) of cloud services and detects potential malicious insiders in CSPs and TPAs. Furthermore, our proposed model provides a methodology to audit a TPA for minimizing any potential insider threats. In addition, CUs can use the proposed model to periodically audit the CSPs using the TPA to ensure the integrity of the outsourced data. For demonstrating and validating the performance, the proposed PPM is programmed in C++ and tested on GreenCloud with NS2 by applying merging processes. The experimental results help to identify the effectiveness, operational efficiency, and reliability of the CSPs. In addition, the results demonstrate the successful rate of handling the negative role of the TPA and determining the TPA’s malicious insider detection capabilities.

Predict insider threats using human behaviors

In a Systems Engineering perspective, insider threats are not new but emerging. For modern systems that require a seamless integration between human and machine, human interactions with systems become a large part of operations. This creates a system security challenge while protecting systems from insider threats. As technology evolves, system vulnerabilities and network penetrations from external entities have been the center of attention. However, when considering system security, insider threats are as damaging as external threats. Unforutnately, insider threats have been overlooked for decades and there is no clear guidance or standards to protect systems from insider attacks. In this paper, we focus on identifying potential insider threats based on human behaviors, such as system logins. By analyzing user behavioral patterns, we attempt to identify suspicious behaviors based on common characterestics that appear to be unusual and estimate the prediction interval to determine if such behaviors should be considered as a threat. Having a baseline of normal user behaviors and comparing against unusual behaviors allow us to predict and identify potential insider threats.

Triangular data privacy-preserving model for authenticating all key stakeholders in a cloud environment

Cloud computing is a relatively new paradigm that provides numerous advantages to service providers, developers, and customers with respect to flexibility, scalability, and availability at a lower cost. Motivated by these technical and economical advantages, many data owners outsource their data to centralized large data centers where the data are not only stored but also shared among multiple users. This method of data outsourcing brings many new security challenges for data integrity. There have been several mechanisms proposed lately that allow data owners to use a public verifier (e.g., a third-party auditor (TPA)) for efficiently auditing cloud data integrity. The use of a TPA for this purpose is inevitable, since it provides several advantages to both cloud service users (CSUs) and cloud service providers (CSPs) in terms of efficiency, fairness, trust, etc. – which is essential to achieve economies of scale for cloud computing. Although the existing public auditing schemes are capable of simultaneously performing multiple auditing tasks (including the integrity of cloud data) in an efficient manner, these methods can reveal confidential information to public verifiers which makes a TPA a potential threat to the data security of CSUs and the reputation of CSPs. Therefore, cloud computing requires a holistic approach to security that can deal with all the potential threats that exist in the cloud environment. Taking these points into account, this paper presents a novel triangular data privacy-preserving (TDPP) model that supports public auditing with the capability of auditing all the key stakeholders (i.e., CSU, TPA, and CSP) for achieving optimal security in a cloud environment. Specifically, our proposed TDPP model supports three types of auditing. First, the TPA can audit the CSP for ensuring (a) the correctness of the CSU's data stored at the service provider side and (b) that the CSP is in full compliance of its own service level agreement (SLA). Second, the TPA can audit the CSU to (a) determine any violation of terms and conditions defined in the SLA for the cloud services provided by the CSP and (b) monitor the feedback provided by the CSU for the utilized services. Third, either the CSU or CSP can audit the TPA to minimize the possibility of any potential insider threats or attacks. For instance, the CSU can audit the TPA to (a) ensure that private information being shared with the TPA is not disclosed to any third party or misused by an insider and (b) verify that the TPA performs assigned auditing tasks according to the given specification within the agreed time frame. Our experimental results demonstrate the effectiveness and efficiency of our proposed scheme when auditing all key stakeholders.

Towards a conceptual model and reasoning structure for insider threat detection

The insider threat faced by corporations and governments today is a real and significant problem, and one that has become increasingly difficult to combat as the years have progressed. From a technology standpoint, traditional protective measures such as intrusion detection systems are largely inadequate given the nature of the ‘insider’ and their legitimate access to prized organisational data and assets. As a result, it is necessary to research and develop more sophisticated approaches for the accurate recognition, detection and response to insider threats. One way in which this may be achieved is by understanding the complete picture of why an insider may initiate an attack, and the indicative elements along the attack chain. This includes the use of behavioural and psychological observations about a potential malicious insider in addition to technological monitoring and profiling techniques. In this paper, we propose a framework for modelling the insider-threat problem that goes beyond traditional technological observations and incorporates a more complete view of insider threats, common precursors, and human actions and behaviours. We present a conceptual model for insider threat and a reasoning structure that allows an analyst to make or draw hypotheses regarding a potential insider threat based on measurable states from real-world observations.

An extensible analysable system model

Analysing real-world systems for vulnerabilities with respect to security and safety threats is a difficult undertaking, not least due to a lack of availability of formalisations for those systems. While both formalisations and analyses can be found for artificial systems such as software, this does not hold for real physical systems. Approaches such as threat modelling try to target the formalisation of the real-world domain, but still are far from the rigid techniques available in security research. Many currently available approaches to assurance of critical infrastructure security are based on (quite successful) ad-hoc techniques. We believe they can be significantly improved beyond the state-of-the-art by pairing them with static analyses techniques. In this paper we present an approach to both formalising those real-world systems, as well as providing an underlying semantics, which allows for easy development of analyses for the abstracted systems. We briefly present one application of our approach, namely the analysis of systems for potential insider threats.

Using PLSI-U to detect insider threats by datamining e-mail

Despite a technology bias that focuses on external electronic threats, insiders pose the greatest threat to an organisation. This paper discusses an approach to assist investigators in identifying potential insider threats. We discern employees' interests from e-mail using an extended version of PLSI. These interests are transformed into implicit and explicit social network graphs, which are used to locate potential insiders by identifying individuals who feel alienated from the organisation or have a hidden interest in a sensitive topic. By applying this technique to the Enron e-mail corpus, a small number of employees appear as potential insider threats.

Using Author Topic to detect insider threats from email traffic

One means of preventing insider theft is by stopping potential insiders from becoming actual thieves. This article discusses an approach to assist managers in identifying potential insider threats. By using the Author Topic [Rosen-Zvi Michal, Griffiths Thomas, Steyvers Mark, Smyth Padhraic. The author-topic model for authors and documents. In: Proceedings of the 20th conference on uncertainty in artificial intelligence; 2004. p. 487–94.] clustering algorithm, we discern employees' interests from their daily emails. These interests then provide a means to create an implicit and an explicit social network graph. This approach locates potential insiders by finding individuals who either (1) feel alienated from the organization (a key warning sign of a possible disgruntled worker) or (2) have a hidden interest in a sensitive (e.g. proprietary or classified) topic. In both cases, this is revealed when someone demonstrates an interest in a topic but does not share that interest with anyone in the organization. By applying this technique to the Enron email corpus, we produce coherent, sensible topics and reveal Sherron Watkins, the famous Enron whistleblower, as a potential insider threat from the viewpoint of the individuals behind the Enron scandal.