Developing insider attack detection model: A grounded approach

Abstract

Insider threats and attacks are a known problem. Within an enterprise it is very difficult to detect and identify insider attacks and abuse against Information Systems. A study was conducted by observing a group of IS security analysts who detect and identify insider attacks. Commonalities and generalizations were made based on the study to create an insider attack detection model. This model will allow other IS security analysts the ability to increase detection of insider attacks and reduce false positives.