Threat Detection Model Research Articles

An email content-based insider threat detection model using anomaly detection algorithms

Insider threats significantly impact businesses as well as governments and military organizations. The focus of threats has shifted from external attack to within organizations where authorized users have become potential insider threats. Existing insider threats detection methods, such as the rule-based approach rely on expert knowledge making it not robust. An insider threat detection method is proposed based on email user behaviour and anomaly detection algorithms to overcome this limitation. An email content based on the IT administrator role is constructed from the CERT r6.2 dataset using natural language pre-processing modules. Topic modelling is performed on the dataset to generate a vector space, which serves as input to anomaly detection algorithms to detect malicious email contents. The experimental results demonstrate that the proposed model has an 89% detection rate over the baseline model. A combination of K-means and PCA anomaly detection algorithms yielded a good detection rate of 89% for 1%, 5%, 10%, 15%, 20%, 25%, and 30% cut-off values anomaly scores.

Digital Threat Detection Model to Mitigate Cybersecurity Risks in Organizations

Digital Threat Detection Model to Mitigate Cybersecurity Risks in Organizations

A Review of the Neurobiological Basis of Trauma-Related Dissociation and Its Relation to Cannabinoid- and Opioid-Mediated Stress Response: a Transdiagnostic, Translational Approach

Dissociative experiences have been associated with increased disease severity, chronicity, and, in some cases, reduced treatment response across trauma-related and other psychiatric disorders. A better understanding of the neurobiological mechanisms through which dissociative experiences occur may assist in identifying novel pharmacological and non-pharmacological treatment approaches. Here, we review emerging work on the dissociative subtype of posttraumatic stress disorder (PTSD), and other trauma-related disorders providing evidence for two related overarching neurobiological models of dissociation, the defense cascade model of dissociation and Mobb's threat detection model. In particular, we review neuroimaging studies highlighting alterations in functional connectivity of key brain regions associated with these models, including connectivity between the prefrontal cortex, the amygdala and its complexes, the insula, and the periaqueductal gray. Work implicating the kappa-opioid and endocannabinoid systems in trauma-related dissociative experiences is also reviewed. Finally, we hypothesize mechanisms by which pharmacological modulation of these neurochemical systems may serve as promising transdiagnostic treatment modalities for individuals experiencing clinically significant levels of dissociation. Specifically, whereas kappa-opioid receptor antagonists may serve as a pharmacological vehicle for the selective targeting of dissociative symptoms and associated emotion overmodulation in the dissociative subtype of posttraumatic stress disorder and transdiagnostically, modulation of the endocannabinoid system may reduce symptoms associated with emotional undermodulation of the fight or flight components of the defense cascade model.

A malicious threat detection model for cloud assisted internet of things (CoT) based industrial control system (ICS) networks using deep belief network

Internet of Things (IoT) devices are extensively used in modern industries combined with the conventional industrial control system (ICS) network through the industrial cloud to make the production data easily available to the corporate business management and easier control for highly profitable production systems. The different devices within the conventional ICS network originally manufactured to run on an isolated network and was not considered for the privacy and security of the control and production/architecture data being trafficked over the manufacturing plant to the corporate. Due to their extensive integration with the industrial cloud network over the internet, these ICS networks are exposed to a significant threat of malicious activities created by malicious software. Protecting ICS from such attacks requires continuous update of their database of anti-malware tools which requires efforts from manual experts on a regular basis. This limits real time protection of ICS.Earlier work by Huda et al. (2017) based on a semi-supervised approach performed well. However training process of the semi-supervised-approach (Huda et al., 2017) is complex procedure which requires a hybridization of feature selection, unsupervised clustering and supervised training techniques. Therefore, it could be time consuming for ICS network for real time protection. In this paper, we propose an adaptive threat detection model for industrial cloud of things (CoT) based on deep learning. Deep learning has been used in many domain of pattern recognition and a popular approach for its simple training procedure. Most importantly, deep learning can learn the hidden patterns of the domain in an unsupervised manner which can avoid the requirements of huge expensive labeled data. We used this particular characteristic of deep learning to design our detection model.Two different types of deep learning based detection models are proposed in this work. The first model uses a disjoint training and testing data for a deep belief network (DBN) and corresponding artificial neural network (ANN). In the second proposed detection model, DBN is trained using new unlabeled data to provide DBN with additional knowledge about the changes in the malicious attack patterns. Novelty of the proposed detection models is that the models are adaptive where training procedures is simpler than earlier work (Huda et al, 2017) and can adapt new malware behaviors from already available and cheap unlabeled data at the same time. This will avoid expensive manual labeling of new attacks and corresponding time complexity making it feasible for ICS networks. Performances of standard DBNs are sensitive to its configurations and values for the hyper-parameters including number of hidden nodes, learning rate and number epochs. Therefore proposed detection models find an optimal configuration by varying the structure of DBNs and other parameters. The proposed detection models are extensively tested on a real malware test bed. Experimental results show that the proposed approaches achieve higher accuracies than standard detection algorithms and obtain similar performances with earlier semi-supervised work (Huda et al., 2017) but provide a comparatively simplified training model.

Insider threat detection of adaptive optimization DBN for behavior logs

For the problems of insider threats such as great harm due to damage and resultant loss, difficulty in extracting abnormal behavior features of insiders because of transparency and concealment, and low detection rate, an insider threat detection model using adaptive optimization DBN for behavior logs is put forward. The model carries out deep learning based on the integrated and normalized behavior logs to fully learn normal and abnormal behavior features of insiders to form optimal representations of the behavior features of insiders. The experimental results show that the multiple-hidden-layer deep learning model can fully learn the behavior features of insiders, improving the detection rate of insider threat. Particularly, the adaptive optimization method of the golden section is better than that using the dichotomy method, which can increase the threat detection rate of the DBN model to 97.872%, with more significant advantages.

Mitigation of Hardware Trojan based Denial-of-Service attack for secure NoCs

As Multiprocessor System-on-Chips (MPSoCs) continue to scale, security for Network-on-Chips (NoCs) is a growing concern as rogue agents threaten to infringe on the hardware’s trust and maliciously implant Hardware Trojans (HTs) to undermine their reliability. The trustworthiness of MPSoCs will rely on our ability to detect Denial-of-Service (DoS) threats posed by the HTs and mitigate HTs in a compromised NoC to permit graceful network degradation. In this paper, we propose a new light-weight target-activated sequential payload (TASP) HT model that performs packet inspection and injects faults to create a new type of DoS attack. Faults injected are used to trigger a response from error correction code (ECC) schemes and cause repeated retransmission to starve network resources and create deadlocks capable of rendering single-application to full chip failures. To circumvent the threat of HTs, we propose a heuristic threat detection model to classify faults and discover HTs within compromised links. To prevent further disruption, we propose several switch-to-switch link obfuscation methods to avoid triggering of HTs in an effort to continue using links instead of rerouting packets with minimal overhead (1–3 cycles). To sustain data integrity over a compromised link, we propose an optimized implementation of algebraic manipulation detection (AMD) codes to detect any fault injection in targeted flits. Our proposed modifications complement existing fault detection and obfuscation methods and only add 2% in area overhead and 6% in excess power consumption in the NoC micro-architecture.

A survey on gaps, threat remediation challenges and some thoughts for proactive attack detection in cloud computing

The long-term potential benefits through reduction of cost of services and improvement of business outcomes make Cloud Computing an attractive proposition these days. To make it more marketable in the wider IT user community one needs to address a variety of information security risks. In this paper, we present an extensive review on cloud computing with the main focus on gaps and security concerns. We identify the top security threats and their existing solutions. We also investigate the challenges/obstacles in implementing threat remediation. To address these issues, we propose a proactive threat detection model by adopting three main goals: (i) detect an attack when it happens, (ii) alert related parties (system admin, data owner) about the attack type and take combating action, and (iii) generate information on the type of attack by analyzing the pattern (even if the cloud provider attempts subreption). To emphasize the importance of monitoring cyber attacks we provide a brief overview of existing literature on cloud computing security. Then we generate some real cyber attacks that can be detected from performance data in a hypervisor and its guest operating systems. We employ modern machine learning techniques as the core of our model and accumulate a large database by considering the top threats. A variety of model performance measurement tools are applied to verify the model attack prediction capability. We observed that the Support Vector Machine technique from statistical machine learning theory is able to identify the top attacks with an accuracy of 97.13%. We have detected the activities using performance data (CPU, disk, network and memory performance) from the hypervisor and its guest operating systems, which can be generated by any cloud customer using built-in or third party software. Thus, one does not have to depend on cloud providers’ security logs and data. We believe our line of thoughts comprising a series of experiments will give researchers, cloud providers and their customers a useful guide to proactively protect themselves from known or even unknown security issues that follow the same patterns.

Detection of Anomalous Insiders in Collaborative Environments via Relational Analysis of Access Logs.

Collaborative information systems (CIS) are deployed within a diverse array of environments, ranging from the Internet to intelligence agencies to healthcare. It is increasingly the case that such systems are applied to manage sensitive information, making them targets for malicious insiders. While sophisticated security mechanisms have been developed to detect insider threats in various file systems, they are neither designed to model nor to monitor collaborative environments in which users function in dynamic teams with complex behavior. In this paper, we introduce a community-based anomaly detection system (CADS), an unsupervised learning framework to detect insider threats based on information recorded in the access logs of collaborative environments. CADS is based on the observation that typical users tend to form community structures, such that users with low a nity to such communities are indicative of anomalous and potentially illicit behavior. The model consists of two primary components: relational pattern extraction and anomaly detection. For relational pattern extraction, CADS infers community structures from CIS access logs, and subsequently derives communities, which serve as the CADS pattern core. CADS then uses a formal statistical model to measure the deviation of users from the inferred communities to predict which users are anomalies. To empirically evaluate the threat detection model, we perform an analysis with six months of access logs from a real electronic health record system in a large medical center, as well as a publicly-available dataset for replication purposes. The results illustrate that CADS can distinguish simulated anomalous users in the context of real user behavior with a high degree of certainty and with significant performance gains in comparison to several competing anomaly detection models.