E-Watcher: insider threat monitoring and detection for enhanced security

IF 1.8 4区 计算机科学 Q3 TELECOMMUNICATIONS Annals of Telecommunications Pub Date : 2024-04-04 DOI:10.1007/s12243-024-01023-7
Zhiyuan Wei, Usman Rauf, Fadi Mohsen
{"title":"E-Watcher: insider threat monitoring and detection for enhanced security","authors":"Zhiyuan Wei, Usman Rauf, Fadi Mohsen","doi":"10.1007/s12243-024-01023-7","DOIUrl":null,"url":null,"abstract":"<p>Insider threats refer to harmful actions carried out by authorized users within an organization, posing the most damaging risks. The increasing number of these threats has revealed the inadequacy of traditional methods for detecting and mitigating insider threats. These existing approaches lack the ability to analyze activity-related information in detail, resulting in delayed detection of malicious intent. Additionally, current methods lack advancements in addressing noisy datasets or unknown scenarios, leading to under-fitting or over-fitting of the models. To address these, our paper presents a hybrid insider threat detection framework. We not only enhance prediction accuracy by incorporating a layer of statistical criteria on top of machine learning-based classification but also present optimal parameters to address over/under-fitting of models. We evaluate the performance of our framework using a real-life threat test dataset (CERT r4.2) and compare it to existing methods on the same dataset (Glasser and Lindauer 2013). Our initial evaluation demonstrates that our proposed framework achieves an accuracy of 98.48% in detecting insider threats, surpassing the performance of most of the existing methods. Additionally, our framework effectively handles potential bias and data imbalance issues that can arise in real-life scenarios.</p>","PeriodicalId":50761,"journal":{"name":"Annals of Telecommunications","volume":null,"pages":null},"PeriodicalIF":1.8000,"publicationDate":"2024-04-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"Annals of Telecommunications","FirstCategoryId":"94","ListUrlMain":"https://doi.org/10.1007/s12243-024-01023-7","RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q3","JCRName":"TELECOMMUNICATIONS","Score":null,"Total":0}
引用次数: 0

Abstract

Insider threats refer to harmful actions carried out by authorized users within an organization, posing the most damaging risks. The increasing number of these threats has revealed the inadequacy of traditional methods for detecting and mitigating insider threats. These existing approaches lack the ability to analyze activity-related information in detail, resulting in delayed detection of malicious intent. Additionally, current methods lack advancements in addressing noisy datasets or unknown scenarios, leading to under-fitting or over-fitting of the models. To address these, our paper presents a hybrid insider threat detection framework. We not only enhance prediction accuracy by incorporating a layer of statistical criteria on top of machine learning-based classification but also present optimal parameters to address over/under-fitting of models. We evaluate the performance of our framework using a real-life threat test dataset (CERT r4.2) and compare it to existing methods on the same dataset (Glasser and Lindauer 2013). Our initial evaluation demonstrates that our proposed framework achieves an accuracy of 98.48% in detecting insider threats, surpassing the performance of most of the existing methods. Additionally, our framework effectively handles potential bias and data imbalance issues that can arise in real-life scenarios.

查看原文
分享 分享
微信好友 朋友圈 QQ好友 复制链接
本刊更多论文
E-Watcher:内部威胁监控和检测,增强安全性
内部威胁是指组织内部授权用户实施的有害行为,具有最大的破坏性风险。这些威胁的日益增多暴露了传统方法在检测和缓解内部威胁方面的不足。这些现有方法缺乏详细分析活动相关信息的能力,导致恶意意图的延迟检测。此外,目前的方法在处理嘈杂数据集或未知场景方面缺乏进步,导致模型拟合不足或拟合过度。为了解决这些问题,我们的论文提出了一种混合内部威胁检测框架。我们不仅通过在基于机器学习的分类之上加入一层统计标准来提高预测准确性,还提出了解决模型过拟合/欠拟合问题的最佳参数。我们使用现实生活中的威胁测试数据集(CERT r4.2)评估了我们框架的性能,并将其与相同数据集上的现有方法进行了比较(Glasser 和 Lindauer,2013 年)。初步评估表明,我们提出的框架在检测内部威胁方面达到了 98.48% 的准确率,超过了大多数现有方法。此外,我们的框架还能有效处理现实生活中可能出现的偏差和数据不平衡问题。
本文章由计算机程序翻译,如有差异,请以英文原文为准。
求助全文
约1分钟内获得全文 去求助
来源期刊
Annals of Telecommunications
Annals of Telecommunications 工程技术-电信学
CiteScore
5.20
自引率
5.30%
发文量
37
审稿时长
4.5 months
期刊介绍: Annals of Telecommunications is an international journal publishing original peer-reviewed papers in the field of telecommunications. It covers all the essential branches of modern telecommunications, ranging from digital communications to communication networks and the internet, to software, protocols and services, uses and economics. This large spectrum of topics accounts for the rapid convergence through telecommunications of the underlying technologies in computers, communications, content management towards the emergence of the information and knowledge society. As a consequence, the Journal provides a medium for exchanging research results and technological achievements accomplished by the European and international scientific community from academia and industry.
期刊最新文献
Editorial of 6GNet 2023 special issue On the (in)efficiency of fuzzing network protocols Mixed $$\mathcal {H}_{2}$$/$$\mathcal {H}_{\infty }$$ fault detection and control for uncertain delta operator systems with mixed random delays and multiple data packet dropouts Investigation of LDPC codes with interleaving for 5G wireless networks Opportunistic data gathering in IoT networks using an energy-efficient data aggregation mechanism
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
已复制链接
已复制链接
快去分享给好友吧!
我知道了
×
扫码分享
扫码分享
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1