Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> b) Opportunity <s> One critical threat facing many organizations is the inside attacks from masqueraders, internal users or external intruders who exploit legitimate user identity and perform malicious attacks. Anomaly intrusion detection systems can be deployed to build a user behavior profile from his/her past activities in a computer system and detect masqueraders if a large deviation is observed. In this paper, we use a finite automata based model to construct a normal behavior reference model from the analysis of shell command sequences. A fuzzy evaluation mechanism is proposed to classify the degree of threat as linguistic terms. The fuzzy number calculated from the output of a fuzzy inference system is compared with predefined generalized fuzzy numbers representing different threat levels. A case will be labeled as the linguistic term which has the highest similarity value with it. Experiments conducted on two data sets both achieved high detection rates of masqueraders and few false alarms, which stand out other methods. <s> BIB001 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> b) Opportunity <s> Abstract Malicious insiders are one of the most serious threats to an organization’s information assets. The threat is also extremely difficult to mitigate: an insider can be more knowledgeable than an external attacker about the target system and is, therefore, more effective at defeating security controls that mainly defend against external attacks. A promising technique for addressing the insider threat is to accurately predict an insider’s moves and identify the optimal defense strategy. To this end, we propose a game-theoretic model for the insider problem, which we call an “insider game”. An insider game is built on a stochastic game, a game played in a non-deterministic state machine that can describe most computing systems. The model captures other key properties, especially the system administrator’s uncertainty about the system state due to the insider’s hidden action. The efficacy of the model is demonstrated using a real-life incident. Equilibrium strategies are computed to predict the insider’s actions and identify the best way to respond to them. <s> BIB002 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> b) Opportunity <s> Information systems face several security threats, some of which originate by insiders. This paper presents a novel, interdisciplinary insider threat prediction model. It combines approaches, techniques, and tools from computer science and psychology. It utilizes real time monitoring, capturing the user's technological trait in an information system and analyzing it for misbehavior. In parallel, the model is using data from psychometric tests, so as to assess for each user the predisposition to malicious acts and the stress level, which is an enabler for the user to overcome his moral inhibitions, under the condition that the collection of such data complies with the legal framework. The model combines the above mentioned information, categorizes users, and identifies those that require additional monitoring, as they can potentially be dangerous for the information system and the organization. <s> BIB003 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> b) Opportunity <s> This paper demonstrates how to prevent or mitigate insider threats in relational databases. It shows how different order of accesses to the same data items may pose different levels of threat. Moreover, it states the conditions that are required to regard a data item as expired. In addition, it introduces the two different methods of executing insiders' tasks, and how to prevent insider threat in those. The models presented in this paper organize accesses to data items in a particular sequence so that the availability of data items is maximized and the expected threat is minimized to the lowest level. Furthermore, it determines when to give an insider an incorrect but acceptable value of a risky data item in order to prevent a possible threat. <s> BIB004 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> b) Opportunity <s> Insider Threat has become one of the most important types of attacks to identify and combat for both government and commercial organizations in recent years. The irreversible financial and security damages that can result from this type of threat have placed Insider Threat among the most important problems in cybersecurity [1]. The complexity of the problem is mainly due to the fact that the attacker is a legitimate user of the system, which makes it very difficult to draw a clear line between legitimate and malicious actions. This paper presents a multi-perspective approach for detection of insider threats in typical enterprise networks. In this approach, multiple detection engines monitor network activities from different perspectives and use the aggregate information to adjust their detection sensitivities. Experimental results from our studies show that this approach results in reduced false alarm probability as well as an increased ability to detect attacks by colluding insiders. <s> BIB005 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> b) Opportunity <s> Collaborative information systems (CISs) are deployed within a diverse array of environments that manage sensitive information. Current security mechanisms detect insider threats, but they are ill-suited to monitor systems in which users function in dynamic teams. In this paper, we introduce the community anomaly detection system (CADS), an unsupervised learning framework to detect insider threats based on the access logs of collaborative environments. The framework is based on the observation that typical CIS users tend to form community structures based on the subjects accessed (e.g., patients' records viewed by healthcare providers). CADS consists of two components: 1) relational pattern extraction, which derives community structures and 2) anomaly prediction, which leverages a statistical model to determine when users have sufficiently deviated from communities. We further extend CADS into MetaCADS to account for the semantics of subjects (e.g., patients' diagnoses). To empirically evaluate the framework, we perform an assessment with three months of access logs from a real electronic health record (EHR) system in a large medical center. The results illustrate our models exhibit significant performance gains over state-of-the-art competitors. When the number of illicit users is low, MetaCADS is the best model, but as the number grows, commonly accessed semantics lead to hiding in a crowd, such that CADS is more prudent. <s> BIB006 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> b) Opportunity <s> The annual incidence of insider attacks continues to grow, and there are indications this trend will continue. While there are a number of existing tools that can accurately identify known attacks, these are reactive (as opposed to proactive) in their enforcement, and may be eluded by previously unseen, adversarial behaviors. This paper proposes an approach that combines Structural Anomaly Detection (SA) from social and information networks and Psychological Profiling (PP) of individuals. SA uses technologies including graph analysis, dynamic tracking, and machine learning to detect structural anomalies in large-scale information network data, while PP constructs dynamic psychological profiles from behavioral patterns. Threats are finally identified through a fusion and ranking of outcomes from SA and PP. The proposed approach is illustrated by applying it to a large data set from a massively multi-player online game, World of War craft (WoW). The data set contains behavior traces from over 350,000 characters observed over a period of 6 months. SA is used to predict if and when characters quit their guild (a player association with similarities to a club or workgroup in non-gaming contexts), possibly causing damage to these social groups. PP serves to estimate the five-factor personality model for all characters. Both threads show good results on the gaming data set and thus validate the proposed approach. <s> BIB007 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> b) Opportunity <s> Evidence of malicious insider activity is often buried within large data streams, such as system logs accumulated over months or years. Ensemble-based stream mining leverages multiple classification models to achieve highly accurate anomaly detection in such streams, even when the stream is unbounded, evolving, and unlabeled. This makes the approach effective for identifying insider threats who attempt to conceal their activities by varying their behaviors over time. This paper applies ensemble-based stream mining, supervised and unsupervised learning, and graph-based anomaly detection to the problem of insider threat detection. It demonstrates that the ensemble-based approach is significantly more effective than traditional single-model methods, supervised learning outperforms unsupervised learning, and increasing the cost of false negatives correlates to higher accuracy. Future work will consider a wider range of tunable parameters in an effort to further reduce false positives, include a more sophisticated polling algorithm for weighting better models, and implement parallelization to lower runtimes to more rapidly detect emerging insider threats. <s> BIB008 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> b) Opportunity <s> Malicious insiders pose significant threats to information security, and yet the capability of detecting malicious insiders is very limited. Insider threat detection is known to be a difficult problem, presenting many research challenges. In this paper we report our effort on detecting malicious insiders from large amounts of work practice data. We propose novel approaches to detect two types of insider activities: (1) blendin anomalies, where malicious insiders try to behave similar to a group they do not belong to, and (2) unusual change anomalies, where malicious insiders exhibit changes in their behavior that are dissimilar to their peers' behavioral changes. Our first contribution focuses on detecting blend-in malicious insiders. We propose a novel approach by examining various activity domains, and detecting behavioral inconsistencies across these domains. Our second contribution is a method for detecting insiders with unusual changes in behavior. The key strength of this proposed approach is that it avoids flagging common changes that can be mistakenly detected by typical temporal anomaly detection mechanisms. Our third contribution is a method that combines anomaly indicators from multiple sources of information. <s> BIB009 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> b) Opportunity <s> Insider threats detection problem has always been one of the most difficult challenges for organizations and research community. Effective behavioral categorization of users plays a vital role for the success of any detection mechanisms. It also helps to reduce false alarms in case of insider threats. In order to achieve this, a fuzzy classifier has been implemented along with genetic algorithm (GA) to enhance the efficiency of a fuzzy classifier. It also enhances the functionality of all other modules to achieve better results in terms of false alarms. A scenario driven approach along with mathematical evaluation verifies the effectiveness of the modified framework. It has been tested for the enterprises having critical nature of business. Other organizations can adopt it in accordance with their specific nature of business, need, and operational processes. The results prove that accurate classification and detection of users were achieved by adopting the modified framework which in turn minimizes false alarms. <s> BIB010 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> b) Opportunity <s> In recent years, the major source of information leakage is due to insiders. In order to detect information leakage by some internal insiders, anomaly detection using individual and community behavior models have been developed. The basic assumption of anomaly detection is each user has his/her own profile of activities and anomaly detection algorithm attempts to identify any deviation from the basic profile by each user. Both models neglected the possibility of change of individual user profile, e.g. change of individual interests. We propose here an anomaly detection model of insider threat using file content. The proposed model uses the document segmentation and Naive Bayes algorithm to classify the contents of files in an organization. We then set up the correlation matrices between users and their interests, and also the user community and their interests. We then propose a comprehensive model to detect the insider threat, which takes into consideration of the deviations of individual users’ current behaviors, their historical behaviors and their associated community behaviors simultaneously. According to the experimental test results, the proposed model can successfully detect the anomaly access to files in the internal systems. <s> BIB011 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> b) Opportunity <s> Abstract Insider threat is one of the most dangerous security threat, and a much more complex issue. These insiders can be a former or a disgruntled employee or any business associate that has or had an authorised access to information for any particular organization. They have control and security measures. Hence continuous monitoring is essential to track each and every activity within the network. Log management is a strong technique which includes both Log analysis with event correlation which provides the root cause of any attack and network can be protected from security violations. Though intrusion detection is complex process, while checking the ability to detect intrusive behaviour within the internal environment, it has to take care of suppressing the false alarm rate. Some strong approach is required on the basis of which decisions can be taken fast. This paper proposes a probabilistic approach which illustrates the frequency of occurrence of event in percentage while still considering the false alarm rate at an acceptable level. <s> BIB012 </s> Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis <s> b) Opportunity <s> Organizations are experiencing an ever-growing concern of how to identify and defend against insider threats. Those who have authorized access to sensitive organizational data are placed in a position of power that could well be abused and could cause significant damage to an organization. This could range from financial theft and intellectual property theft to the destruction of property and business reputation. Traditional intrusion detection systems are neither designed nor capable of identifying those who act maliciously within an organization. In this paper, we describe an automated system that is capable of detecting insider threats within an organization. We define a tree-structure profiling approach that incorporates the details of activities conducted by each user and each job role and then use this to obtain a consistent representation of features that provide a rich description of the user's behavior. Deviation can be assessed based on the amount of variance that each user exhibits across multiple attributes, compared against their peers. We have performed experimentation using ten synthetic data-driven scenarios and found that the system can identify anomalous behavior that may be indicative of a potential threat. We also show how our detection system can be combined with visual analytics tools to support further investigation by an analyst. <s> BIB013
Crime is all about opportunities. Most studies focus on the following two broad categorizations of features to determine the level of opportunity available to an insider in an organization to perform an attack against the system: insider's role in the system, and activity-based features BIB003 . Insider's role in the system Each insider has a system role associated his/her user account, such as being a system administrator, advanced user or novice user. A system role defines the kind of access to the system an insider has. A system role also determines if an insider has the privileges required to do a function or operation in the system. Activity-based features For insider threat detection and prediction, key sources of data are log files. These log files provide real-time data on the usage of resources, users, roles and activities BIB003 . A sensor can be set to any application or device to log data autonomously. Table 2 lists activity-based features, their major groups and sources of information on these features. The following seven categories of activity-based patterns are being explored widely: (i) file domain, (ii) database domain, (iii) Email domain, (iv) HTTP domain, (v) mobile calls, (vi)print domain, (vii) TCP/IP network flows, and (viii) Other applications such as MS Word, MS Power Point, MS Excel, JPG, and TXT. Figure 5 shows the number of selected papers used these feature vectors. A total of 35 studies were included in this survey BIB008 BIB006 BIB010 BIB012 BIB002 BIB013 BIB011 BIB004  BIB005 BIB009 BIB001 BIB007 . Table 2 presents the features that belong to these domains and the sources of information for each feature domain. Our survey reveals that the most widely used feature domains are the file domain and the database domain, and the least used feature domain is the device domain (Fig. 5) . Eldardiry et al. BIB009 compared the independent predictive powers of file, device, logon, http and email domains. According to this study, file and device domains are the most important feature domains, and logon and http domains are the least important feature domains. c) Capability Capability is used to determine the extent to which an insider can compromise a system with his/her current level of information technology (IT) sophistication. "Capability' represents the demonstrated skill level of an insider monitored by the IT system. The feature 'Capability' is broken down into three sub-features  : i. Unique applications run by the insider in different sessions: Typically, the higher the number of unique applications, the higher the insider's sophistication. ii. Multiple applications run simultaneously by the insider in different sessions: The higher the number of applications run simultaneously per session, the more sophisticated the insider. iii. The consumption of CPU and RAM by the user in different sessions: The higher the CPU and RAM usage, the higher the sophistication level of insiders.