Detecting Anomalous Insiders in Collaborative Information Systems.

Area of Science:

• Computer Science
• Information Security
• Data Mining

Background:

• Collaborative Information Systems (CISs) manage sensitive data, necessitating robust insider threat detection.
• Existing security methods struggle with dynamic team structures common in CISs.
• Insider threats pose a significant risk to data integrity and privacy in collaborative environments.

Purpose of the Study:

• To develop an unsupervised learning framework for detecting insider threats in CISs.
• To address the limitations of current security mechanisms in dynamic team settings.
• To introduce a novel approach based on community structures within user access logs.

Main Methods:

• The Community Anomaly Detection System (CADS) framework was developed.
• CADS uses relational pattern extraction to identify user community structures.
• Anomaly prediction leverages statistical models to detect user deviations from established communities.
• MetaCADS extends CADS by incorporating subject semantics for enhanced detection.

Main Results:

• Empirical evaluation using three months of electronic health record (EHR) access logs demonstrated significant performance gains.
• CADS and MetaCADS outperformed state-of-the-art competitors in detecting insider threats.
• MetaCADS excelled when illicit users were few; CADS proved more prudent as illicit user numbers increased due to semantic "hiding in a crowd".

Conclusions:

• The proposed CADS framework effectively detects insider threats in CISs by modeling user communities.
• Accounting for subject semantics (MetaCADS) improves detection accuracy, especially in low-threat scenarios.
• The findings offer a more robust solution for securing sensitive information within dynamic collaborative environments.