Approach to combining different methods for detecting insiders

Abstract

The paper deals with the problem of internal intruders (insiders) in the organization. It presents Top-7 methods of insider detection and substantiates the necessity of their joint usage. A technique to combine different methods of insider detection is proposed. A combination of methods means using the results of only one of them, union or/and intersecting it with the results of others. The technique formalization and graphic interpretation are given, as well as expressions for completeness, precision, accuracy, error and F-measure. Visualization of the third method combination is provided as an example. The results of experiments on insider detection at the real corporate network using human and machine-based methods are presented.