Maintaining defender's reputation in anomaly detection against insider attacks

Area of Science:

• Computer Science
• Cybersecurity
• Artificial Intelligence

Background:

• Insider threats pose significant challenges to anomaly detection systems.
• Attackers, both naive and sophisticated, continuously evolve their strategies.
• Effective reputation management is crucial for robust anomaly detection.

Purpose of the Study:

• To develop novel algorithms for establishing defender reputation in anomaly detection.
• To address the challenge of detecting both smart, adaptive insiders and naive attackers.
• To improve the trade-off between detection rates and false positives in insider attack scenarios.

Main Methods:

• Proposed two distinct reputation establishment algorithms tailored to different attacker models.
• Developed algorithms for systems with only smart insiders.
• Developed algorithms for systems with both smart and naive attackers.
• Conducted theoretical analysis and performance evaluations.

Main Results:

• The proposed reputation-establishment algorithms significantly enhance anomaly detection performance.
• Improved trade-off between detection and false positives against insider attacks.
• Demonstrated effectiveness against both smart and naive attacker types.

Conclusions:

• Novel reputation algorithms offer a substantial improvement in defending against insider threats.
• The developed methods provide a more robust anomaly detection framework.
• Effective reputation management is key to mitigating evolving insider attack strategies.