Specializing network analysis to detect anomalous insider actions.

Area of Science:

• Computer Science
• Information Security
• Data Mining

Background:

• Collaborative information systems (CIS) offer efficient coordination but face security risks due to broad user access privileges.
• Insider threats, stemming from authorized users misusing access, pose significant risks to CIS.
• Existing insider threat detection models often require extensive labeled data or assume substantial behavioral deviations, limiting their practical application.

Purpose of the Study:

• To introduce a novel approach for detecting insider actions in CIS that deviate from expected collaborative behavior.
• To develop and evaluate a specialized network anomaly detection (SNAD) model for identifying anomalous user activities within collaborative environments.

Main Methods:

• The proposed SNAD model assesses a user's influence on the similarity of user groups accessing specific records.
• The approach analyzes access patterns within audit logs to detect deviations from normal collaborative behavior.
• Empirical evaluation involved extensive testing on real-world datasets from an electronic health record system and Wikipedia.

Main Results:

• The SNAD model effectively detects insider actions by measuring user influence on group access patterns.
• Extensive evaluations demonstrated SNAD's superior performance compared to competing methods.
• SNAD achieved an average of 20-30% greater area under the ROC curve in detecting threats.

Conclusions:

• The SNAD model offers a theoretically sound and empirically validated method for detecting insider threats in dynamic collaborative systems.
• This approach overcomes limitations of existing models by not requiring extensive labeled data or assuming large behavioral deviations.
• SNAD provides a more effective solution for enhancing security in collaborative information systems.