A Model-Based Approach to Predicting the Performance of Insider Threat Detection Systems

Roberts, Shannon C.; Holodnak, John T.; Nguyen, Thanh Tuan; Yuditskaya, Sophia; Milosavljevic, Maja; Streilein, William W.

doi:10.1109/spw.2016.14

Cited by 15 publications

(12 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, in the literature, we noticed that most of the detection approaches (26 articles) deployed Anomaly-based detection mechanism. In contrary, little works in [7], [36], [41], [55] and [60] implemented Misuse-based detection mechanism, while the combination of the two mechanisms were applied in [48] and [37]. A graphical representation of detection mechanisms that are implemented by existing approaches is shown in Figure 7.…”

Section: Detection Mechanismsmentioning

confidence: 99%

See 1 more Smart Citation

Empirical Detection Techniques of Insider Threat Incidents

Alsowail

Al-Shehari

2020

IEEE Access

View full text Add to dashboard Cite

Vital organizations have faced increasing challenges of how to defend against insider threats that may cause a severe damage to their assets. The nature of insider threats is more challenging than external threats, as insiders have a privileged access to sensitive assets of an organization. In fact, there are several studies that reviewed the insider threat detection approaches from taxonomical and theoretical perspectives. However, the protection against insider threat incidents requires empirical defense solutions. Hence, our study uniquely focuses on empirical detection approaches that are validated with empirical results. We propose a 10-question model that highlights different prospective of empirical detection approaches. Significant factors are also proposed to reveal the extent to which the detection approaches are effective against insider threat incidents (e.g., feature domains, protection coverage, classification techniques, simulated scenarios, performance and accuracy metrics, etc.). The objective of this paper is to enhance researchers' efforts in the domain of insider attack by systemizing the detection techniques in comparable manner. It also highlights the challenges and gaps for further research to institute more effective solutions that can predict, detect, and prevent emerging attack incidents. Some recommendations for future research directions are also presented. INDEX TERMSInsider threat, rigorous literature review, 10-question model, insider attack detection, information security.Recent studies have shown that insider attacks are costlier for organizations than external threats. This section summarizes

show abstract

Section: Detection Mechanismsmentioning

confidence: 99%

“…The last scenario was a data leakage attack that was conducted by masqueraders using email attachments. This dataset is utilized to validate the detection approaches in [36], [48], [49], [56] and [57].…”

Section: Table 4 Available Datasets Of Insider Threat Detection Approachesmentioning

confidence: 99%

Empirical Detection Techniques of Insider Threat Incidents

Alsowail

Al-Shehari

2020

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Many articles focused on the use of cyber activity behaviors, login events, or the combination of login events with other features [55][56][57][58][59][60] using many different techniques. Nikolai and Wang [55] proposed a solution for data theft in Infrastructure as a Service IAAS Clouds; the k-nearest neighbor (KNN) is used to detect data theft in Clouds.…”

Section: Cyber Activity Behaviormentioning

confidence: 99%

“…Their monitoring system analyzed network messages patterns used to transfer data; using the similar KNN classifier technique and Dempster-Shafer theory by Punithavathani et al [57]. Roberts et al [56] provided a detection mechanism to counter insider threats in critical networks. W. Liu et al's [58] used the Bayesian networks (BNs) and novel modeling approach for the performance of insider threat detection.…”

Section: Cyber Activity Behaviormentioning

confidence: 99%

See 1 more Smart Citation

A Review of Insider Threat Detection: Classification, Machine Learning Techniques, Datasets, Open Challenges, and Recommendations

et al. 2020

View full text Add to dashboard Cite

Insider threat has become a widely accepted issue and one of the major challenges in cybersecurity. This phenomenon indicates that threats require special detection systems, methods, and tools, which entail the ability to facilitate accurate and fast detection of a malicious insider. Several studies on insider threat detection and related areas in dealing with this issue have been proposed. Various studies aimed to deepen the conceptual understanding of insider threats. However, there are many limitations, such as a lack of real cases, biases in making conclusions, which are a major concern and remain unclear, and the lack of a study that surveys insider threats from many different perspectives and focuses on the theoretical, technical, and statistical aspects of insider threats. The survey aims to present a taxonomy of contemporary insider types, access, level, motivation, insider profiling, effect security property, and methods used by attackers to conduct attacks and a review of notable recent works on insider threat detection, which covers the analyzed behaviors, machine-learning techniques, dataset, detection methodology, and evaluation metrics. Several real cases of insider threats have been analyzed to provide statistical information about insiders. In addition, this survey highlights the challenges faced by other researchers and provides recommendations to minimize obstacles.

show abstract

An Insider Threat Detection Model Using One-Hot Encoding and Near-Miss Under-Sampling Techniques

Alsowail

2022

Algorithms for Intelligent Systems

View full text Add to dashboard Cite

A Model-Based Approach to Predicting the Performance of Insider Threat Detection Systems

Cited by 15 publications

References 18 publications

Empirical Detection Techniques of Insider Threat Incidents

Empirical Detection Techniques of Insider Threat Incidents

A Review of Insider Threat Detection: Classification, Machine Learning Techniques, Datasets, Open Challenges, and Recommendations

An Insider Threat Detection Model Using One-Hot Encoding and Near-Miss Under-Sampling Techniques

Contact Info

Product

Resources

About