Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> Best practice recommendations <s> The ability to mine data represented as a graph has become important in several domains for detecting various structural patterns. One important area of data mining is anomaly detection, but little work has been done in terms of detecting anomalies in graph-based data. In this paper we present graph-based approaches to uncovering anomalies in applications containing information representing possible insider threat activity: e-mail, cell-phone calls, and order processing. <s> BIB001 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> Best practice recommendations <s> Searching for an optimal feature subset from a high dimensional feature space is known to be an NP-complete problem. We present a hybrid algorithm, SAGA, for this task. SAGA combines the ability to avoid being trapped in a local minimum of simulated annealing with the very high rate of convergence of the crossover operator of genetic algorithms, the strong local search ability of greedy algorithms and the high computational efficiency of generalized regression neural networks. We compare the performance over time of SAGA and well-known algorithms on synthetic and real datasets. The results show that SAGA outperforms existing algorithms. <s> BIB002 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> Best practice recommendations <s> In current enterprise environments, information is becoming more readily accessible across a wide range of interconnected systems. However, trustworthiness of documents and actors is not explicitly measured, leaving actors unaware of how latest security events may have impacted the trustworthiness of the information being used and the actors involved. This leads to situations where information producers give documents to consumers they should not trust and consumers use information from non-reputable documents or producers. The concepts and technologies developed as part of the Behavior-Based Access Control (BBAC) effort strive to overcome these limitations by means of performing accurate calculations of trustworthiness of actors, e.g., behavior and usage patterns, as well as documents, e.g., provenance and workflow data dependencies. BBAC analyses a wide range of observables for mal-behavior, including network connections, HTTP requests, English text exchanges through emails or chat messages, and edit sequences to documents. The current prototype service strategically combines big data batch processing to train classifiers and real-time stream processing to classifier observed behaviors at multiple layers. To scale up to enterprise regimes, BBAC combines clustering analysis with statistical classification in a way that maintains an adjustable number of classifiers. <s> BIB003
This review study offers important insights into promising IDPAs for the future A good algorithm should adopt a holistic approach for IDP comprising individual behaviour models, community behaviour models, resource usage models and intention models to make the IDPA robust against both individual and collusion attacks, the high rate of false alarms, and data nonstationarity. The algorithm proposed by Mayhew et al. BIB003 is an example of a holistic system. A good IDPA should be a BN like the algorithm proposed by Eberie et al. BIB001 . A BN will make the IDPA robust against unbounded patterns, uneven time lags between activities, high dimensionality and interacting features. The BN should employ a Mamdani FIS -like the algorithm proposed by Yu et al. [23] -for making predictions at every level of the hierarchy. This strategy will make the algorithm robust against the uncertainty. A good IDPA should use the AD approach so as to address the problems associated with class imbalance and undetected insider attacks. It will be a complex model-there is no magic solution to this problem. Good search algorithms need to be employed. This problem can be reduced by running multiple global and local search algorithms together to optimize the model parameters BIB002 . Authors should take the following measures to minimize the bias and to improve the transparency of publications. The computer code for the proposed algorithm should be made public so that other researchers can easily evaluate the algorithm. Detailed pseudo-codes of the proposed algorithm should be provided for the readers with limited or no knowledge about the specific programming language. A reference and link to research data should be made in any publications arising from it. If data cannot be made available for reuse on ethical grounds, authors can build models from data and then simulate data from the model with added noise. This data can be made public. The best to date algorithms should be chosen for the benchmark.