Detecting Anomalous Insiders in Collaborative Information Systems

Abstract

Collaborative information systems (CISs) are deployed within a diverse array of environments that manage sensitive information. Current security mechanisms detect insider threats, but they are ill-suited to monitor systems in which users function in dynamic teams. In this paper, we introduce the community anomaly detection system (CADS), an unsupervised learning framework to detect insider threats based on the access logs of collaborative environments. The framework is based on the observation that typical CIS users tend to form community structures based on the subjects accessed (e.g., patients’ records viewed by healthcare providers). CADS consists of two components: 1) relational pattern extraction, which derives community structures and 2) anomaly prediction, which leverages a statistical model to determine when users have sufficiently deviated from communities. We further extend CADS into MetaCADS to account for the semantics of subjects (e.g., patients’ diagnoses). To empirically evaluate the framework, we perform an assessment with three months of access logs from a real electronic health record (EHR) system in a large medical center. The results illustrate our models exhibit significant performance gains over state-of-the-art competitors. When the number of illicit users is low, MetaCADS is the best model, but as the number grows, commonly accessed semantics lead to hiding in a crowd, such that CADS is more prudent.

Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis

“…The goal of these questions is to determine if the findings of the study are replicable. Five studies have a low risk of bias -Chen et al [13], Eberie et al [34], Parveen et al [12], Raissi-Dehkordi et al [21], and Yu et al [23] and the remaining eight studies have a high risk of bias (Table 4, Fig. 14).…”

“…Figure 5 shows the number of selected papers used these feature vectors. A total of 35 studies were included in this survey [12][13][14][15][16][17][18][19][20][21][22][23][24]. Table 2 presents the features that belong to these domains and the sources of information for each feature domain.…”

“…However, none of these citation papers use the IDPAs presented in these research papers. The most cited papers are: Chen et al [13] and Brdiczka et al [24].…”

Clinical Data Reuse or Secondary Use: Current Status and Potential Future Progress

“…Chen and colleagues described the application of relational data mining to detect anomalies in the accesses to communities information systems [179]. The study by Peissig and colleagues used Inductive Logic Programming (ILP) -a method that infers an hypothesis from the analysis of the background knowledge and examples -to derive phenotypes from EHR data [180].…”

Work-Based Access Control Model for Cooperative Healthcare Environments: Formal Specification and Verification

“…The access control decision function (DF ) (Definition 23) takes the access request (Q) (Definition 21) as an input and returns a Boolean value presenting the access control decision. The pre-condition for the success of DF is as shown in (21) and (22). In the worst case, the complexity of WBAC's DF is O(card(act r (usr)) + (card(w) × card(team member ))).…”