Tracking the Insider Attacker: A Blockchain Traceability System for Insider Threats

Area of Science:

• Cybersecurity
• Information Security
• Computer Science

Background:

• Insider threats pose significant risks to organizational data confidentiality, integrity, and availability.
• The authorized access of insider threats complicates tracking and forensic analysis due to erased attack traces.
• Existing cybersecurity measures often struggle to effectively mitigate insider threats and their consequences.

Purpose of the Study:

• To propose a novel blockchain traceability system designed to mitigate insider threats.
• To enhance the forensic capabilities for insider attacks and prevent attacker evasion.
• To address the challenges in tracking and evidence collection associated with insider threats.

Main Methods:

• Development of an insider threat model focusing on forensics and evasion prevention.
• Analysis of the difficulties in tracking insider attackers and gathering evidence.
• Design of a blockchain traceability system including data, transaction, and block structures, consensus, storage, and query algorithms.
• Integration of differential privacy to protect user data.

Main Results:

• The proposed blockchain system effectively addresses insider threat challenges.
• Experiments demonstrate the system's capability in mitigating insider threats.
• Enhanced traceability and forensic evidence collection were achieved.

Conclusions:

• The blockchain traceability system offers a robust solution for mitigating insider threats.
• The system improves the ability to detect, track, and gather evidence on insider attacks.
• Implementing this system enhances overall organizational cybersecurity posture against internal malicious actors.