Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> Sources of insider attack data for research <s> Abstract Malicious insiders are one of the most serious threats to an organization’s information assets. The threat is also extremely difficult to mitigate: an insider can be more knowledgeable than an external attacker about the target system and is, therefore, more effective at defeating security controls that mainly defend against external attacks. A promising technique for addressing the insider threat is to accurately predict an insider’s moves and identify the optimal defense strategy. To this end, we propose a game-theoretic model for the insider problem, which we call an “insider game”. An insider game is built on a stochastic game, a game played in a non-deterministic state machine that can describe most computing systems. The model captures other key properties, especially the system administrator’s uncertainty about the system state due to the insider’s hidden action. The efficacy of the model is demonstrated using a real-life incident. Equilibrium strategies are computed to predict the insider’s actions and identify the best way to respond to them. <s> BIB001 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> Sources of insider attack data for research <s> The insider threat is a prime security concern for government and industry organizations. As insider threat programs come into operational practice, there is a continuing need to assess the effectiveness of tools, methods, and data sources, which enables continual process improvement. This is particularly challenging in operational environments, where the actual number of malicious insiders in a study sample is not known. The present paper addresses the design of evaluation strategies and associated measures of effectiveness; several quantitative/statistical significance test approaches are described with examples, and a new measure, the Enrichment Ratio, is proposed and described as a means of assessing the impact of proposed tools on the organization's operations. <s> BIB002 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> Sources of insider attack data for research <s> Addressing the insider threat is a major issue in cyber and corporate security in order to enhance trusted computing in critical infrastructures. In this paper we study the psychosocial perspective and the implications of insider threat prediction via social media, Open Source Intelligence and user generated content classification. Inductively, we propose a prediction method by evaluating the predisposition towards law enforcement and authorities, a personal psychosocial trait closely connected to the manifestation of malevolent insiders. We propose a methodology to detect users holding negative attitude towards authorities. For doing so, we facilitate a brief analysis of the medium (YouTube), machine learning techniques and a dictionary-based approach, in order to detect comments expressing negative attitude. Thus, we can draw conclusions over a user behavior and beliefs via the content the user generated within the limits a social medium. We also use an assumption free flat data representation technique in order to decide over the user's attitude and improve the scalability of our method. Furthermore, we compare the results of each method and highlight the common behavior and characteristics manifested by the users. As privacy violations may well-rise when using such methods, their use should be restricted only on exceptional cases, e.g. when appointing security officers or decision-making staff in critical infrastructures. <s> BIB003
Only a small percentage of studies use original real-world data -in our survey 4 out of 16 studies (Fig. 3) . The major sources of real data are the log files of the online systems, and social media websites. Obtaining security data for research purposes is difficult, if not impossible, due to financial, business and national security concerns. Furthermore, even if one acquires real data, data on those conducting insider attacks are not publicly available for privacy reasons BIB002 . Often, insider attacks are not even caught as attacker leaves no traces. Consequently, research with real-world data proves challenging. For Fig. 2 The trend of security research for the insider cyber threat. The x-axis represents 'Year' and the y-axis represents the number of publications published in any given year example, Kandias et al. BIB003 have conducted a content analysis of user comments on YouTube videos looking for any negative comments on law enforcement. Theoretically, these negative comments posted by employees are likely to reflect their intent to commit malicious acts. However, there is no ground-truth whether the individual was involved in any malicious activity. Our survey reveals that insider threat studies use the following sources of data: ➢ Real-world system log data ➢ Social media data ➢ Simulated data drawn from stochastic models ➢ Real data injected with synthetic anomalies. ➢ Simulated data drawn from stochastic models which are developed from real data ➢ Game-theoretic approach (GTA) In our survey, the 16 studies use data for assessing the effectiveness of a feature or algorithm [12-15, 18, 21-27, 29, 34, 38, 40] . Figure 3 illustrates the percentage of data sources used in the sample of articles. The figure shows that the primary sources of research data are the simulated data drawn from the arbitrarily defined models and the data generated through the game (GTA). In GTA, a digital landscape is very carefully created to simulate the real world as closely as possible. The game is based on a set of rules created by experts. Ideally, these rules should simulate the real situation. The game is usually played by multiple players. A central assumption of the game is that the players are rational. A rational player is one who always chooses an action which gives the outcome he most prefers, given what he expects his opponents to do. An insider game is a sequential, stochastic Fig. 3 Usage of various data sources in the selected studies. Real-world system log data is represented by 'RL', social media data by 'SM', real data injected with synthetic anomalies by 'RIS', simulated data drawn from stochastic models which are developed from real data by 'SR', simulated data drawn from stochastic models by 'SS' and game data by 'GTA'. The x-axis represents different data sources and the y-axis represents the number of the studies use the data source game with imperfect information. The game is usually played by two teams, one team being called the insiders and the other the defendants. The goal of insiders is to exploit potential attack paths across IT layers that may lead to a security compromise. The goal of defenders is to prevent insiders from achieving their goal. Two teams play in turn. Each team has a set of actions with anticipated costs and expected future benefits of courses of action. On their turn, a team will randomly choose its action based on some probability distribution. On any turn (except for their first turn) a team may opt to play none. Each team's available set of strategy choices are conditional on all previous actions of the opponent. Both teams continue to play until the Nash equilibrium is reached where both teams' strategy is optimized giving what the other player is doing. As players play the game, the data is generated automatically by different players. GTA is not only a good source of research data, it is also a promising source of operational data BIB001 . Data generated from GTA can be used along with the real data in the case where the real data is not sufficient. Another popular source of research data is the real data injected with synthetic anomalies. The majority of real world data does not carry information about malicious events. Hence, researchers collect real-wold security data that contains a great deal of legitimate traffic. They simulate insider attacks based on high-profile cases of insider attacks. Then they inject simulated attacks into the real data. Other sources of research data include the simulated data drawn from stochastic models which are developed from real data. A few studies generate models from real world data and then generate data from estimated models to protect the anonymity and privacy of the users' data and also to control the size of the data stream.