Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> Publication quality <s> One critical threat facing many organizations is the inside attacks from masqueraders, internal users or external intruders who exploit legitimate user identity and perform malicious attacks. Anomaly intrusion detection systems can be deployed to build a user behavior profile from his/her past activities in a computer system and detect masqueraders if a large deviation is observed. In this paper, we use a finite automata based model to construct a normal behavior reference model from the analysis of shell command sequences. A fuzzy evaluation mechanism is proposed to classify the degree of threat as linguistic terms. The fuzzy number calculated from the output of a fuzzy inference system is compared with predefined generalized fuzzy numbers representing different threat levels. A case will be labeled as the linguistic term which has the highest similarity value with it. Experiments conducted on two data sets both achieved high detection rates of masqueraders and few false alarms, which stand out other methods. <s> BIB001 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> Publication quality <s> Insider Threat has become one of the most important types of attacks to identify and combat for both government and commercial organizations in recent years. The irreversible financial and security damages that can result from this type of threat have placed Insider Threat among the most important problems in cybersecurity [1]. The complexity of the problem is mainly due to the fact that the attacker is a legitimate user of the system, which makes it very difficult to draw a clear line between legitimate and malicious actions. This paper presents a multi-perspective approach for detection of insider threats in typical enterprise networks. In this approach, multiple detection engines monitor network activities from different perspectives and use the aggregate information to adjust their detection sensitivities. Experimental results from our studies show that this approach results in reduced false alarm probability as well as an increased ability to detect attacks by colluding insiders. <s> BIB002 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> Publication quality <s> Collaborative information systems (CISs) are deployed within a diverse array of environments that manage sensitive information. Current security mechanisms detect insider threats, but they are ill-suited to monitor systems in which users function in dynamic teams. In this paper, we introduce the community anomaly detection system (CADS), an unsupervised learning framework to detect insider threats based on the access logs of collaborative environments. The framework is based on the observation that typical CIS users tend to form community structures based on the subjects accessed (e.g., patients' records viewed by healthcare providers). CADS consists of two components: 1) relational pattern extraction, which derives community structures and 2) anomaly prediction, which leverages a statistical model to determine when users have sufficiently deviated from communities. We further extend CADS into MetaCADS to account for the semantics of subjects (e.g., patients' diagnoses). To empirically evaluate the framework, we perform an assessment with three months of access logs from a real electronic health record (EHR) system in a large medical center. The results illustrate our models exhibit significant performance gains over state-of-the-art competitors. When the number of illicit users is low, MetaCADS is the best model, but as the number grows, commonly accessed semantics lead to hiding in a crowd, such that CADS is more prudent. <s> BIB003 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> Publication quality <s> The act of conducting an insider attack carries with it cognitive and social challenges that may affect an offender’s day-to-day work behavior. We test this hypothesis by examining the language used in e-mails that were sent as part of a 6-hr workplace simulation. The simulation involved participants (N = 54) examining databases and exchanging information as part of a four-stage organized crime investigation. After the first stage, 25% of the participants were covertly incentivized to act as an “insider” by providing information to a provocateur. Analysis of the language used in participants’ e-mails found that insiders became more self-focused, showed greater negative affect, and showed more cognitive processing compared to their coworkers. At the interpersonal level, insiders showed significantly more deterioration in the degree to which their language mimicked other team members over time. Our findings demonstrate how language may provide an indirect way of identifying employees who are undertaking an insider attack. <s> BIB004 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> Publication quality <s> Evidence of malicious insider activity is often buried within large data streams, such as system logs accumulated over months or years. Ensemble-based stream mining leverages multiple classification models to achieve highly accurate anomaly detection in such streams, even when the stream is unbounded, evolving, and unlabeled. This makes the approach effective for identifying insider threats who attempt to conceal their activities by varying their behaviors over time. This paper applies ensemble-based stream mining, supervised and unsupervised learning, and graph-based anomaly detection to the problem of insider threat detection. It demonstrates that the ensemble-based approach is significantly more effective than traditional single-model methods, supervised learning outperforms unsupervised learning, and increasing the cost of false negatives correlates to higher accuracy. Future work will consider a wider range of tunable parameters in an effort to further reduce false positives, include a more sophisticated polling algorithm for weighting better models, and implement parallelization to lower runtimes to more rapidly detect emerging insider threats. <s> BIB005
Our study reveals that none of the selected IDPAs are assessed rigorously by neutral experts. This observation suggests that there may be publication bias. Publication bias is a potential threat in all areas of research. Hence it is important to evaluate publication bias in studies. Bias articles provide vague information regarding design, implementation and evaluation of the proposed algorithms so that no one else can try to replicate the study. We measure the publication quality based on ten questions on a 5-point scale about how transparent a publication is. The goal of these questions is to determine if the findings of the study are replicable. Five studies have a low risk of bias -Chen et al. BIB003 , Eberie et al. BIB004 , Parveen et al. BIB005 , Raissi-Dehkordi et al. BIB002 , and Yu et al. BIB001 and the remaining eight studies have a high risk of bias (Table 4 , Fig. 14) .