Insider Threat Detection with Behavior-Based Attestation

Abstract:

Insiders, who have the lawful authority in network information system, formed a huge threat to security by abuse and misuse of authority. It has become one of huge challenge to the security of information system. Against the features of more subtle and more difficult to find, this paper study how to perceive the trusted behavior of insiders with behavior-based attestation. Taking into account the impact of various uncertainties in monitoring and perception process, dynamic awareness model of insider threat is presented based on subjective logic. In order to find the insider threats, monitoring data of actual behaviors are compared with operation tree; legality of the user behavior dynamically analyzed according to historical experience and current experience; the trust of user behavior legitimacy is represented as trust point in subjective logic. Finally, experiments are employed to test the validity and applicability of proposed method.

• Periodical: Applied Mechanics and Materials (Volumes 568-570)
• Pages: 1370-1375
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.568-570.1370
• Online since: June 2014
• Authors: Heng Qin, Jin Hui Zhao
• Keywords: Behavior-Based Attestation, Insider Threat, Operation Tree, Subjective Logic

References

[1] Pfleeger C P. Reflection son the Insider Threat, Insider Attack and Cyber Security. Springer, 2008: 5-16.

DOI: 10.1007/978-0-387-77322-3_2

[2] Information on http: /www. clearswift. de.

[3] Wood B. An insider threat model for adversary simulation. In: Proceedings of the Workshop with Title Research on Mitigating the Insider Threat to Information Systems, Arlington VA, (2000).

DOI: 10.7249/cf163

[4] Buford J, Lewis L, Jakobson G. Insider threat detection using situation-aware Mas. Proceedings of the 11th International Conference on Information Fusion, New York: IEEE Press, (2008).

[5] WANG Chao, GUO Yuan-bo, MA Jian-feng et al. HMM-Based Detection Method for Resource Misuse in Information Systems. Electronica Sinica, 2010, 38(6): 1383-1388.

[6] Wang Hui, Yang Guancan, Han Dongmei. Research of predicting insider threat based on Bayesian network. Application Research of Computers, 2013, 30(9): 2767-2771.

[7] Wang Hui, Lui Shufen. A Scalable Predicting Model for Insider Threat. Journal of Computers，2006, 29(8): 1346-1355.

[8] Cun Peng, Yao Danlin. Insider threat detection model based on operation tree. Journal of the Hebei Academy of Sciences, 2008, 25(1): 10-14.

[9] ZHANG Hong Bin, PEI Qingqi, MA Jianfeng. An Algorithm for Sensing Insider Threat Based on Cloud Model. Journal of Computers, 2009, 32(4): 784-792.

DOI: 10.3724/sp.j.1016.2009.00784

[10] ZHANG Hongbin, PEI Qingqi, WANG Chao. Sensing insider threat based on access vectors. Journal of Xidian University, 2014, 41(1): 137-144.

[11] Shafer G． Perspectives on the theory and practice of belief functions. International Journal of Approximate Reasoning，1990，4(5/6) : 323-362.