Using the Actionable Intelligence Approach for the DPI of Cybercrime Insider Investigation

Abstract

Cybercrime threats are often originating from trusted, malicious, or negligent insiders, who have excessive access privileges to an organization's network, system, or data. The sophistication of insider threats has led to cybercrime issues. Even when an incident is detected, the follow-up countermeasures are required to analyze the results. The analysis of cybercrime insider investigation presents many opportunities for actionable intelligence on improving the quality and value of digital evidence. There are several advantages of applying Deep Packet Inspection (DPI) methods in cybercrime insider investigation. This study discusses the importance of actionable intelligence to conduct investigations and addresses the countermeasure of a cybercrime insider investigation with DPI to detect anomalies in network packets.