An Insider Threat Detection Method Based on User Behavior Analysis

Jiang, Wei; Tian, Yuan; Liu, Weixin; Liu, Wenmao

doi:10.1007/978-3-030-00828-4_43

Cited by 11 publications

(3 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Still, there are general approaches that are used very often such as bagging [31], boosting, [32,33], and rule engines [34][35][36]. Random Forests (RF) are one of the most widely used methods, either because they are an established method and included in various machine learning tools [8,27], used as a benchmark [2], or used in an ensemble together with other methods such as in [37].…”

Section: Resultsmentioning

confidence: 99%

User Behavior Analysis for Detecting Compromised User Accounts: A Review Paper

Jurišić,

Tomičić,

Grd

2023

Cybernetics and Information Technologies

View full text Add to dashboard Cite

The rise of online transactions has led to a corresponding increase in online criminal activities. Account takeover attacks, in particular, are challenging to detect, and novel approaches utilize machine learning to identify compromised accounts. This paper aims to conduct a literature review on account takeover detection and user behavior analysis within the cybersecurity domain. By exploring these areas, the goal is to combat account takeovers and other fraudulent attempts effectively.

show abstract

Section: Resultsmentioning

confidence: 99%

User Behavior Analysis for Detecting Compromised User Accounts: A Review Paper

Jurišić,

Tomičić,

Grd

2023

Cybernetics and Information Technologies

View full text Add to dashboard Cite

show abstract

“…Jiang et al [20] have tried to extract the significant features that often cause organization information loss (attack) from much-related research. The "XGBoost" algorithm is used to identify the insider threat by aggregating the proposed significant feature with user behavior simultaneously.…”

Section: "An Insider Threat Detection Methods Based On User Behavior ...mentioning

confidence: 99%

Two-Steps Insider Threat Detection Protocol (2S-ITDP) Based on Computer Usage Pattern Analysis

Sawatnatee¹,

Prakancharoen²

2023

IJSSE

View full text Add to dashboard Cite

The server, a computer system logging on of the organization's clients, has to verify whether the log-on requester is the formals registered before accessing. Unfortunately, the common log-on protocol rarely detected the imposter requester and untrusted organizational clients. This paper presents the proactive protocol to prevent the outside intruder and detect untrusted corporate clients. This research innovates the step by step practical control flow of whole activities of proactive and preventive framework about intrusion. The suggested protocol comprises the proposed authentication protocol and the client's computer system using sequential pattern analysis. These two activities can inhibit outside intruders, and detect and eliminate the fake client (known other organizational clients' secret passwords). Otherwise, it can see whether the real clients are working correctly as prior computer usage. The evaluation presents that the "two-step insider threat detection protocol (2S-ITDP)" can proactively prevent both outside and inside intruders better than the typical authentication protocol. Furthermore, the accuracy of classification is about eighty-eight percent.

show abstract

“…A technique using LSTM-CNN algorithm has been shown to identify user anomalous behavior in [5], by monitoring user activities and extracting temporal features. While in [6], detection algorithm XGBoost has been used and behavior characteristic features are extracted from audit logs. Technique proposed in [7] extracted features and fields from user behavior logs for behavior auditing, and then these log files are used to train the Improved Hidden Markov Model (IHMM) for detection of malicious behavior.…”

Section: User Behavior Based Insider Detection Techniquesmentioning

confidence: 99%

Behavioral Based Insider Threat Detection Using Deep Learning

et al. 2021

View full text Add to dashboard Cite

The most detrimental cyber attacks are usually not originated by malicious outsiders or malware but from trusted insiders. The main advantage insider attackers have over external elements is their ability to bypass security checks and remain undiscovered, this may cause serious damage to the organizational assets.This paper focuses on insider threat detection through behavioral analysis of users. User behavior is categorized as normal or malicious based on user activity. A series of events and activities are analyzed for feature selection to efficiently detect adversarial behavior. Selected feature vectors are used for model training during the implementation phase. A deep learning based approach is proposed that detects insiders with greater accuracy and low false positive rate. A rich event / user role based feature set containing Logon/Logoff events, User_role, Functional_unit etc are used for detection. The dataset used is the CMU CERT synthetic insider threat dataset r4.2. Performance of our proposed algorithm has been compared to other well-known techniques i.e. long short term Memory-convolutional neural network, random forest, long short term memory-recurrent neural network, one class support vector machine , Markov chain model,multi state long short term memory & convolutional neural network, gated recurrent unit & skipgram. The comparison proved that our novel approach produces relatively good accuracy( 90.60%), precision(97%) and F1 Score (94%).

show abstract

An Insider Threat Detection Method Based on User Behavior Analysis

Cited by 11 publications

References 10 publications

User Behavior Analysis for Detecting Compromised User Accounts: A Review Paper

User Behavior Analysis for Detecting Compromised User Accounts: A Review Paper

Two-Steps Insider Threat Detection Protocol (2S-ITDP) Based on Computer Usage Pattern Analysis

Behavioral Based Insider Threat Detection Using Deep Learning

Contact Info

Product

Resources

About