Paper Info
Title
Anomaly detection in multiple scale for insider threat analysis
Abstract
Insiders now pose the greatest risk to organizations' information infrastructure when they have the incentive, opportunity, rationalization and the capability to circumvent rules. Cost estimates approach $1000 B/year from modification of data, security mechanisms, unauthorized network connections, covert channels, and physical damage and destruction including information extrusion/exfiltration. We propose a method to quantify malicious insider activity with statistical and graph-based analysis aided with semantic scoring rules. Different types of personal activities or interactions are monitored to form a set of directed weighted graphs. The semantic scoring rules assign higher scores for events more significant or suspicious. Then we build personal activity profiles in the form of score tables. Profiles are created in multiple scales where the low level profiles are aggregated toward more stable higher-level profiles within the subject or object hierarchy. Further, the profiles are created in different time scales such as day, week, or month. During operation, the insider's current activity profile is compared to the historical profiles to produce an anomaly score. For each subject with a high anomaly score, a subgraph of connected subjects is extracted to look for any related score movement. Finally the subjects are ranked by their anomaly scores to help the analysts focus on high-scored subjectsln this research, we show the framework of the proposed system and the operational algorithms.
Year
DOI
Venue
2011
10.1145/2179298.2179386
CSIIRW
Keywords
DocType
Citations 
anomaly detection,multiple scale,anomaly score,high anomaly score,score table,related score movement,personal activity,malicious insider activity,higher score,semantic scoring rule,insider threat analysis,current activity profile,personal activity profile,scoring rule,covert channel,data security,information infrastructure,cost estimation
Conference
0
PageRank 
References 
Authors
0.34
4
2
Name
Order
Citations
PageRank
Yoohwan Kim137335.90
Frederick Sheldon28616.46