Knowing who to watch: Identifying attackers whose actions are hidden within false alarms and background noise

Abstract

Insider attacks are often subtle and slow, or preceded by behavioral indicators such as organizational rulebreaking which provide the potential for early warning of malicious intent; both these cases pose the problem of identifying attacks from limited evidence contained within a large volume of event data collected from multiple sources over a long period. This paper proposes a scalable solution to this problem by maintaining long-term estimates that individuals or nodes are attackers, rather than retaining event data for post-facto analysis. These estimates are then used as triggers for more detailed investigation. We identify essential attributes of event data, allowing the use of a wide range of indicators, and show how to apply Bayesian statistics to maintain incremental estimates without global updating. The paper provides a theoretical account of the process, a worked example, and a discussion of its practical implications. The work includes examples that identify subtle attack behaviour in subverted network nodes, but the process is not network-specific and is capable of integrating evidence from other sources, such as behavioral indicators, document access logs and financial records, in addition to events identified by network monitoring.

Discovering New Cyber Protection Approaches from a Security Professional Prospective

“…Now, at any given time, an organization needs to focus on two fronts to mitigate unknown attacks. It is possible to study patterns and attributes of certain or all events but if the end focus is not determine, it could lead in missing exploits unless IDS detected it as being an anomaly [23]. Some research refer to this dilemma as the "Dark Side of IT" where stopping an employee that has access to sensitive information is difficult if he/she wants to sell to competitors but implementing strong security policy is critical in such situation [73].…”

Towards an Early Warning System for Network Attacks Using Bayesian Inference

“…However it is not a methodological weakness of this approach, and only due to a practical constraint accessing a sufficiently large known malicious (heartbleed) dataset. In such a situation, if the historical rate of occurrences of certain attacks is known, it can be used to estimate the likelihood that certain events derive from such attacks or it may be sufficient to quantify these frequencies by an expert in a similar way to estimating risk likelihoods to an accuracy of an order of magnitude [22].…”

“…Such uncertainty needs to be acknowledged [21]. Using Bayesian technique and its variants for intrusions detection can be found in [22], [23]. The relevance of information fusion for network security monitoring has been widely discussed [24].…”

Segregation-of-duties Conflicts in the Insider Threat Landscape-An Overview and Case Study

“…Insiders are usually employees, contractors, consultants or personnel from thirdparty service providers who would have been granted legitimate access to IT systems [1]. An insider threat could arise from anyone in these categories because these people have knowledge of the internal IT system and sometimes of the security controls protecting it [2] [3].…”