Legg, Philip A., Buckley, Oliver ORCID: https://orcid.org/0000-0003-1502-5721, Goldsmith, Michael and Creese, Sadie (2017) Automated insider threat detection system using user and role-based profile assessment. IEEE Systems Journal, 11 (2). pp. 503-512. ISSN 1932-8184
Preview |
PDF (Accepted manuscript)
- Accepted Version
Download (1MB) | Preview |
Abstract
Organizations are experiencing an ever-growing concern of how to identify and defend against insider threats. Those who have authorized access to sensitive organizational data are placed in a position of power that could well be abused and could cause significant damage to an organization. This could range from financial theft and intellectual property theft to the destruction of property and business reputation. Traditional intrusion detection systems are neither designed nor capable of identifying those who act maliciously within an organization. In this paper, we describe an automated system that is capable of detecting insider threats within an organization. We define a tree-structure profiling approach that incorporates the details of activities conducted by each user and each job role and then use this to obtain a consistent representation of features that provide a rich description of the user's behavior. Deviation can be assessed based on the amount of variance that each user exhibits across multiple attributes, compared against their peers. We have performed experimentation using ten synthetic data-driven scenarios and found that the system can identify anomalous behavior that may be indicative of a potential threat. We also show how our detection system can be combined with visual analytics tools to support further investigation by an analyst.
Item Type: | Article |
---|---|
Faculty \ School: | Faculty of Science > School of Computing Sciences |
UEA Research Groups: | Faculty of Science > Research Groups > Smart Emerging Technologies Faculty of Science > Research Groups > Cyber Security Privacy and Trust Laboratory |
Depositing User: | Pure Connector |
Date Deposited: | 31 Jan 2018 12:30 |
Last Modified: | 01 Jun 2024 01:13 |
URI: | https://ueaeprints.uea.ac.uk/id/eprint/66157 |
DOI: | 10.1109/JSYST.2015.2438442 |
Downloads
Downloads per month over past year
Actions (login required)
View Item |