Empirical Detection Techniques of Insider Threat Incidents

Abstract

Vital organizations have faced increasing challenges of how to defend against insider threats that may cause a severe damage to their assets. The nature of insider threats is more challenging than external threats, as insiders have a privileged access to sensitive assets of an organization. In fact, there are several studies that reviewed the insider threat detection approaches from taxonomical and theoretical perspectives. However, the protection against insider threat incidents requires empirical defense solutions. Hence, our study uniquely focuses on empirical detection approaches that are validated with empirical results. We propose a 10-question model that highlights different prospective of empirical detection approaches. Significant factors are also proposed to reveal the extent to which the detection approaches are effective against insider threat incidents (e.g., feature domains, protection coverage, classification techniques, simulated scenarios, performance and accuracy metrics, etc.). The objective of this paper is to enhance researchers' efforts in the domain of insider attack by systemizing the detection techniques in comparable manner. It also highlights the challenges and gaps for further research to institute more effective solutions that can predict, detect, and prevent emerging attack incidents. Some recommendations for future research directions are also presented. INDEX TERMSInsider threat, rigorous literature review, 10-question model, insider attack detection, information security.Recent studies have shown that insider attacks are costlier for organizations than external threats. This section summarizes

Cybersecurity Enterprises Policies: A Comparative Study

“…The relevance of behavioral information security, as defined by the author, is concerned with users' behavior in protecting information through the use of antimalware software, data backup, and secure wireless networks. The authors also mentioned data collecting and measurement solutions that are available to provide exclusive access to authorized individuals alone [58]. Stahl et al [59] investigated the significance of information security policies, and looked at examples of them in the healthcare industry.…”

“…Aviation [25,58] • Mechanisms for preventing illegal access to aviation services or airport areas by managing access control and providing authentication.…”

“…Aviation: In the aviation industry, access control policy is critical for regulating access by people, vehicles, luggage, and cargo, as well as securing connected technological systems [58]. The other critical issue in aviation infrastructure is ensuring the security of critical areas within airport vicinities, by relying on access control policies and other biometric technology to recognize unauthorized individuals among airport workers to ensure the security of critical areas within airport vicinities [25].…”

An Insider Data Leakage Detection Using One-Hot Encoding, Synthetic Minority Oversampling and Machine Learning Techniques

“…Several case studies of organizations failures, with respect to insider threats, can be found in [4]. The studies in [17][18][19] reviewed the literature of the insider threat detection area from different perspectives. For example, cybersecurity issues related to insider threats, such as advanced persistent threats and malware, are reviewed in [17], while a classification of the insider threat research is demonstrated in [18].…”

“…For example, cybersecurity issues related to insider threats, such as advanced persistent threats and malware, are reviewed in [17], while a classification of the insider threat research is demonstrated in [18]. The study in [19], categorized and compared different empirical techniques for insider threat detection in terms of 10 significant factors (e.g., datasets, feature domains, classification techniques, simulated scenarios, performance and accuracy metrics, etc.). It highlights the factors that reflect the methodology and performance of reviewed approaches from various empirical perspectives.…”