2013 DetectingInsiderThreatsinaRealC

• (Senator et al., 2013) ⇒ Ted E. Senator, Henry G. Goldberg, Alex Memory, William T. Young, Brad Rees, Robert Pierce, Daniel Huang, Matthew Reardon, David A. Bader, Edmond Chow, Irfan Essa, Joshua Jones, Vinay Bettadapura, Duen Horng Chau, Oded Green, Oguz Kaya, Anita Zakrzewska, Erica Briscoe, Rudolph IV L. Mappus, Robert McColl, Lora Weiss, Thomas G. Dietterich, Alan Fern, Weng--Keen Wong, Shubhomoy Das, Andrew Emmott, Jed Irvine, Jay-Yoon Lee, Danai Koutra, Christos Faloutsos, Daniel Corkill, Lisa Friedland, Amanda Gentzel, and David Jensen. (2013). “Detecting Insider Threats in a Real Corporate Database of Computer Usage Activity.” In: Proceedings of the 19th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. ISBN:978-1-4503-2174-7 doi:10.1145/2487575.2488213

Subject Headings:

Cited By

• http://scholar.google.com/scholar?q=%222013%22+Detecting+Insider+Threats+in+a+Real+Corporate+Database+of+Computer+Usage+Activity
• http://dl.acm.org/citation.cfm?id=2487575.2488213&preflayout=flat#citedby

Quotes

Author Keywords

• Anomaly detection; data mining; insider threat

Abstract

This paper reports on methods and results of an applied research project by a team consisting of SAIC and four universities to develop, integrate, and evaluate new approaches to detect the weak signals characteristic of insider threats on organizations' information systems. Our system combines structural and semantic information from a real corporate database of monitored activity on their users' computers to detect independently developed red team inserts of malicious insider activities. We have developed and applied multiple algorithms for anomaly detection based on suspected scenarios of malicious insider behavior, indicators of unusual activities, high-dimensional statistical patterns, temporal sequences, and normal graph evolution. Algorithms and representation]]s for dynamic graph processing provide the ability to scale as needed for enterprise-level deployments on real-time data streams. We have also developed a visual language for specifying combinations of features, baselines, peer groups, time periods, and algorithms to detect anomalies suggestive of instances of insider threat behavior. We defined over 100 data features in seven categories based on approximately 5.5 million actions per day from approximately 5, 500 users. We have achieved area under the ROC curve values of up to 0.979 and lift values of 65 on the top 50 user-days identified on two months of real data.

References

;

	Author	volume	Date Value	title	type	journal	titleUrl	doi	note	year
2013 DetectingInsiderThreatsinaRealC	Christos Faloutsos Thomas G. Dietterich David Jensen Duen Horng Chau Danai Koutra Ted E. Senator Henry G. Goldberg Alex Memory William T. Young Brad Rees Robert Pierce Daniel Huang Matthew Reardon David A. Bader Edmond Chow Irfan Essa Joshua Jones Vinay Bettadapura Oded Green Oguz Kaya Anita Zakrzewska Erica Briscoe Rudolph IV L. Mappus Robert McColl Lora Weiss Alan Fern Weng--Keen Wong Shubhomoy Das Andrew Emmott Jed Irvine Jay-Yoon Lee Daniel Corkill Lisa Friedland Amanda Gentzel			Detecting Insider Threats in a Real Corporate Database of Computer Usage Activity				10.1145/2487575.2488213		2013