Insider Threat Risk Prediction based on Bayesian Network

Abstract

Insider threat protection has received increasing attention in the last ten years due to the serious consequences of malicious insider threats. Moreover, data leaks and the sale of mass data have become much simpler to achieve, e.g., the dark web can allow malicious insiders to divulge confidential data whilst hiding their identities. In this paper, we propose a novel approach to predict the risk of malicious insider threats prior to a breach taking place. Firstly, we propose a new framework for insider threat risk prediction, drawing on technical, organisational and human factor perspectives. Secondly, we employ a Bayesian network to model and implement the proposed framework. Furthermore, this Bayesian network-based prediction model is evaluated in a range of challenging environments. The risk level predictions for each authorised users within the organisation are examined so that any insider threat risk can be identified. The proposed insider threat prediction model achieved better results when compared to the empirical judgments of security experts

Intrusion Detection System Based on Integrated System Calls Graph and Neural Networks

“…Data mining algorithms have been used to detect intrusions for Smart grids [23], and the use of Ramdom Forest for intrusion classification is also extensive [24]. Finally, Bayesian networks have been used to predict the risk of internal attacks [25], as well as to detect anomalies for IoT technology [26].…”

Bayesian network model to distinguish between intentional attacks and accidental technical failures: a case study of floodgates

“…BNs are used for developing medical decision support systems (Curiac et al 2009;Kahn et al 2001;Kahn Jr et al 1997;Luciani et al 2003;Milho and Fred 2001;Onisko et al 1999). Furthermore, BNs are also used in fault diagnosis (Cai et al 2014;Huang et al 2008;Zhao et al 2013), cyber security (Alile 2018; Apukhtin 2011; Axelrad et al 2013;Elmrabit et al 2020;Greitzer et al 2010;Greitzer et al 2012;Herland et al 2016;Holm et al 2015;Ibrahimović and Bajgorić 2016;Kornecki et al 2013;Kwan et al 2009;Kwan et al 2008;Mo et al 2009;Pappaterra 2021;Pecchia et al 2011;Shin et al 2015;Wang and Guo 2010;Zhou et al 2018).…”

“…ICSs were originally designed for isolated environments (Effendi and Davis 2015). Such systems were mainly susceptible to technical failures.…”

Event‐driven data alteration detection using block‐chain

“…It also informs that insider attacks are one of the most difficult to detect and that is what most of the organizations feel. Since the insider attacks are not easy to detect and most of the organizations feel vulnerable to it, it has become one of the major challenges for the organization 2‐5 …”

“…Since the insider attacks are not easy to detect and most of the organizations feel vulnerable to it, it has become one of the major challenges for the organization. [2][3][4][5] With the advancement in cryptographic technique, the block-chain was first introduced in a crypto-currency framework such as Bit-coin. 6 In last decade, block-chain-based framework plans have progressed significantly, and found effective in different de-centralized applications.…”