Leveraging social networks to detect anomalous insider actions in collaborative environments

Abstract

Collaborative information systems (CIS) enable users to coordinate efficiently over shared tasks. T hey are often deployed in complex dynamic systems that provide users with broad access privileges, but also leave the system vulnerable to various attacks. Techniques to detect threats originating from beyond the system are relatively mature, but methods to detect insider threats are still evolving. A promising class of insider threat detection models for CIS focus on the communities that manifest between users based on the usage of common subjects in the system. However, current methods detect only when a user’s aggregate behavior is intruding, not when specific actions have deviated from expectation. In this paper, we introduce a method called specialized network anomaly detection (SNAD) to detect such events. SNAD assembles the community of users that access a particular subject and assesses if similarities of the community with and without a certain user are sufficiently different. We present a theoretical basis and perform an extensive empirical evaluation with the access logs of two distinct environments: those of a large electronic health record system (6,015 users, 130,457 patients and 1,327,500 accesses) and the editing logs of Wikipedia (2,388,955 revisors, 55,200 articles and 6,482,780 revisions). We compare SNAD with several competing methods and demonstrate it is significantly more effective: on average it achieves 20–30% greater area under an ROC curve.

NetSpot: Spotting Significant Anomalous Regions on Dynamic Networks

“…Note that some of the patterns found in Wikipedia are short-lived and have big-network-span (1,2,3,4,6,7,9), while others affect smaller portion of the network, but extend in a longer time period (5,8,10). If we use anomaly detection methods based on single edge/node analysis, we will not discover the full range of patterns and many of the events reported in Table 3 will be missed.…”

“…This includes algorithms to detect unusual behavior in social, email and phone call networks [8,12,13], computer network traffic [14,17,32], smart grid sensor data [6] and water distribution networks [19]. Most of these approaches focus on link and node behavior anomalies [2,5,18,27,28,9].…”

“…While detecting anomalous nodes and edges is complementary to our method, global approaches are often non sensitive enough in detecting anomalies that involve small parts of the network. Recently, Chen et al [8] proposed a method for anomalous community evolution discovery, which considers six possible types of community-dynamics anomalies: grown, shrunk, merged, split, born and vanished. In contrast, we aim to find regions in which the anomalous behavior persists in space (connected subnetworks) and time.…”

Specializing network analysis to detect anomalous insider actions

“…This is because the current set of approaches tend to assume that either training information is available to build robust classifiers or that the user has committed a large number of actions that deviate from “normal” behavior. Given these limitations, the main contributions of this paper, which is an extension of [28], are as follow:…”

“…Our model then assesses if the similarity of the network with and without the user are significantly different. In contrast to [28], we provide justification for certain modeling decisions and the similarity measures employed.…”