一种基于内部威胁的需求分析架构

本论文从企业目标或商业任务角度,提出了一个基于内部威胁的需求采集框架。该框架包含了一个内部威胁识别和估方法,以及抵御风险的需求启发方法。最后,描述了组织系统防御需求的收集方法。     

Predicting shareholder litigation on insider trading from financial text: An interpretable deep learning approach

The detrimental effects of insider trading on the financial markets and the economy are well documented. However, resource-constrained regulators face a great challenge in detecting insider trading and enforcing insider trading laws. We develop a text analytics framework that uses machine learning to predict ex-ante potentially opportunistic insider trading (using actual insider trading allegation by shareholders as the proxy) from corporate textual disclosures. Distinct from typical black-box neural network models, which have difficulty tracing a prediction back to key features, our approach combines the predictive power of deep learning with attention mechanisms to provide interpretability to the model. Further, our model utilizes representations from a business proximity network and incorporates the temporal variations of a firm’s financial disclosures. The empirical results offer new insights into insider trading and provide practical implications. Overall, we contribute to the literature by reconciling performance and interpretability in predictive analytics. Our study also informs the practice by proposing a new method for regulators to examine a large amount of text in order to monitor and predict financial misconduct.     

In a ‘trusting’ environment, everyone is responsible for information security

Information security is important in any organisation and particularly where personal and medical information is routinely recorded. Further, where the organisational culture revolves around trust, as in the medical environment, insider threats, both malicious and non-malicious, are difficult to manage. International research has shown that changing security culture and increasing awareness is necessary as technical resolutions are not sufficient to control insider threats. This area of information security is both important and topical in view of the recently publicised breaches of patient health information. Ensuring that all staff assumes responsibility for information security, particularly as part of an information security governance framework, is one practical solution to the problem of insider threats.     

Private Keyword-Search for Database Systems Against Insider Attacks

The notion of searchable encrypted keywords introduced an elegant approach to retrieve encrypted data without the need of decryption. Since the introduction of this notion, there are two main searchable encrypted keywords techniques, symmetric searchable encryption (SSE) and public key encryption with keyword search (PEKS). Due to the complicated key management problem in SSE, a number of concrete PEKS constructions have been proposed to overcome it. However, the security of these PEKS schemes was only weakly defined in presence of outsider attacks; therefore they suffer from keyword guessing attacks from the database server as an insider. How to resist insider attacks remains a challenging problem. We propose the first searchable encrypted keywords against insider attacks (SEK-IA) framework to address this problem. The security model of SEK-IA under public key environment is rebuilt. We give a concrete SEK-IA construction featured with a constant-size trapdoor and the proposed scheme is formally proved to be secure against insider attacks. The performance evaluations show that the communication cost between the receiver and the server in our SEK-IA scheme remains constant, independent of the sender identity set size, and the receiver needs the minimized computational cost to generate a trapdoor to search the data from multiple senders.     

网络信息系统的内部威胁模型研究

网络信息系统内部攻击构成了十分危险的安全威胁,这样的认识已逐渐被人们广泛接受。但是,对内部攻击的深入研究却相对比较少。该文从网络系统的使用者这一角度,而不是技术本身,阐述了内部攻击的图示模型,剖析了内部攻击的成因,并针对内部攻击的一些细节进行了详细的系统论述。     

A comprehensive security analysis of LEACH++ clustering protocol for wireless sensor networks

Wireless sensor networks (WSNs) will play a major role in future technologies in the development of the cyber-physical society. Studies show that WSNs are vulnerable to various insider attacks that may degrade its performance and affect the application services. Various intrusion detection system-based solutions have been proposed for WSNs to secure them from such attacks; however, these solutions have certain limitations with respect to completeness and evaluation. Recently, we proposed an intrusion detection framework to secure WSNs from insider attacks and proposed a protocol called LEACH++. In this paper, we perform a detailed security analysis of LEACH++ against black-hole, sink-hole and selective forwarding attacks by launching a number of attacks with different patterns. The results of our experiments performed in network simulator-2 show that the proposed scheme is highly efficient and achieves higher accuracy and detection rates with very low false-positive rate when compared to an anomaly based detection scheme.

     

Leader’s dilemma game: An experimental design for cyber insider threat research

One of the problems with insider threat research is the lack of a complete 360° view of an insider threat dataset due to inadequate experimental design. This has prevented us from modeling a computational system to protect against insider threat situations. This paper provides a contemporary methodological approach for using online games to simulate insider betrayal for predictive behavioral research. The Leader’s Dilemma Game simulates an insider betrayal scenario for analyzing organizational trust relationships, providing an opportunity to examine the trustworthiness of focal individuals, as measured by humans as sensors engaging in computer-mediated communication. This experimental design provides a window into trustworthiness attribution that can generate a rigorous and relevant behavioral dataset, and contributes to building a cyber laboratory that advances future insider threat study.     

内部威胁检测研究

近年来,以系统破坏、信息窃取以及电子欺诈为主的内部攻击因为隐蔽性强、破坏性大的特点对个人与企业,甚至国家安全造成了严重威胁。因此十分有必要关注内部威胁已有的研究成果与发展趋势。本文分析了内部威胁的特征,提出基于信任理论的形式化定义。同时将当前内部威胁研究热点归结为内部威胁模型研究、主观要素研究、客观要素研究及其它研究四个领域,分别介绍各个领域的研究状况,并对每个领域的研究进展进行归纳和分析。通过分析内部威胁已有案例以及当前研究进展,针对现有研究不足提出新型内部威胁检测系统,并展望未来的关键技术。     

基于Agent的内部威胁实时检测框架

针对企业信息系统中的内部威胁行为,特别是内部用户的资源滥用行为,提出了一种基于Agent的实时检测框架,通过比较用户身份权限和异常操作行为发现恶意内部威胁行为.该框架有数据采集模块、检测模块、审计模块和响应模块构成.从身份认证、访问控制、操作审计和漏洞检测四个方面对检测系统进行功能说明,并就关键技术给出了详细介绍.应用实例证明该检测框架实现了用户实名登录、行为检测与事后审计,从根本上防止了恶意内部人员获取非法数据并提供响应和干预能力,提高了信息系统的安全性.最后,总结了内部威胁检测技术发展趋势.     

Assessing insider threats to information security using technical,behavioural and organisational measures

The UK government took a bruising in the headlines (Sep 2008) after a Home Office contractor lost a USB stick containing unencrypted data on all 84,000 prisoners in England and Wales. As a result, the Home Office terminated the £1.5 million contract with the management consultancy firm.The world woke up to the largest attempted bank fraud ever when the UK’s National Hi-Tech Crime Unit foiled the world’s largest potential bank robbery in March 2005. With the help of the security supervisor, thieves masquerading as cleaning staff installed hardware keystroke loggers on computers within the London branch of a Japanese bank, to steal £220m.It is indeed sobering to imagine that any organisation could fall victim to such events and the damage an insider can do. The consulting firm lost the contract worth £1.5 million due to a small mistake by an employee. The London branch of the Japanese Bank would have lost £220 million had not the crime been foiled.Insider threat is a reality. Insiders commit fraud or steal sensitive information when motivated by money or revenge. Well-meaning employees can compromise the security of an organisation with their overzealousness in getting their job done. Every organisation has a varied mix of employees, consultants, management, partners and complex infrastructure and that makes handling insider threats a daunting challenge. With insider attacks, organisations face potential damage through loss of revenue, loss of reputation, loss of intellectual property or even loss of human life.The insider threat problem is more elusive and perplexing than any other threat. Assessing the insider threat is the first step to determine the likelihood of any insider attack. Technical solutions do not suffice since insider threats are fundamentally a people issue. Therefore, a three-pronged approach - technological, behavioural and organisational assessment is essential in facilitating the prediction of insider threats and pre-empt any insider attack thus improving the organization’s security, survivability, and resiliency in light of insider threats.     

An event based approach for quantifying the effects of securities fraud in the IT industry

Detecting the incidence and impact of illegal insider trading is a difficult process since access to the actual trading records of insiders that overlap precisely with fraudulent events is difficult. This paper provides a case study of a specific IT stock in Canada that was successfully prosecuted in the Canadian court system for market manipulation and illegal insider trading violations. The study provides a quantification of the impact of insider trading activities by the President directly through his own account or through accounts under his control, and illustrates the impact of some off-exchange transactions by the impugned parties. Overall, the costs of the insider trading violations are quite high, given the significant wealth effects produced by the events surrounding this case.     

Detecting Insider Threats: Solutions and Trends

ABSTRACT

Insider threats pose significant challenges to any organization. Many solutions have been proposed in the past to detect insider threats. Unfortunately, given the complexity of the problem and the human factors involved, many solutions which have been proposed face strict constraints and limitations when it comes to the working environment. As a result, many past insider threat solutions have in practice failed in their implementations. In this work, we review some of the recent insider threat detection solutions and explore their benefits and limitations. We also discuss insider threat issues for emerging areas such as cloud computing, virtualization, and social networking.     

内部威胁云模型感知算法

利用系统访问控制关系,定义了主体、客体两个偏序结构和二者间的映射关系,建立了分层映射内部威胁模型;利用此模型定义了表征系统内部威胁状态的内部威胁云模型,并设计了基于云模型的感知算法,实现了对系统内部威胁的评测感知.基于云模型的内部威胁感知算法,利用云模型从多角度将系统的定性、定量内部威胁特征融合分析、决策,克服了原有方法不能同时定量定性分析内部威胁的缺陷,提高了感知的准确性和客观性.实验结果表明,此算法能够实时、有效地感知系统的内部安全威胁.     

Insider threat mitigation: preventing unauthorized knowledge acquisition

This paper investigates insider threat in relational database systems. It discusses the problem of inferring unauthorized information by insiders and proposes methods to prevent such threats. The paper defines various types of dependencies as well as constraints on dependencies that may be used by insiders to infer unauthorized information. It introduces the constraint and dependency graph (CDG) that represents dependencies and constraints. In addition, CDG shows the paths that insiders can follow to acquire unauthorized knowledge. Moreover, the paper presents the knowledge graph (KG) that demonstrates the knowledgebase of an insider and the amount of information that the insider has about data items. To predict and prevent insider threat, the paper defines and uses the threat prediction graph (TPG). A TPG shows the threat prediction value (TPV) of each data item in insiders’ KG, where TPV is used to raise an alert when an insider threat occurs. The paper provides solutions to prevent insider threat without limiting the availability of data items. Algorithms, theorems, proofs and experiments are provided to show the soundness, the completeness and the effectiveness of the proposed approaches.     

Identifying a potential insider using classification models

Classification models based on statistical data have been developed that make it possible to identify a potential insider based on the indicators that manifest in the context of data incompleteness regarding the insider’s behavior.     

信息系统内部威胁检测技术研究

针对企业信息系统中日益严重的内部威胁行为,特别是冒名登录、越权操作等行为,基于用户行为分析的技术,采用主客体混合的分层安全模型,建立了一种新的信息系统内部威胁检测框架.通过比较用户异常行为及主客体权限发现恶意内部威胁行为.应用正则表达式与混合加密算法保证检测准确性和日志安全性.从身份认证、访问控制、操作审计和行为阈值技术四个方面进行安全检测,对关键技术给出了详细介绍.实验证明该检测框架防止了内部人员破坏数据并提供响应和干预能力,提高了信息系统安全性.最后,展望了内部威胁检测技术发展趋势.     

无线传感器网络下多因素身份认证协议的内部人员攻击

无线传感器网络技术一经提出,迅速得到学术界、工业界的广泛关注,在国防军事、环境监测、智能家居、健康护理等领域发挥着重要作用.身份认证是保障无线传感器网络实时访问的关键安全技术.基于增强的攻击者模型,提出一种被长期忽略的内部攻击威胁,对无线传感器网络环境下的两个代表性认证协议进行了安全性分析.指出Mir等人的协议无法抵抗内部攻击和智能卡丢失攻击,且未实现前向安全性;指出Fang等人的协议同样无法实现所声称的前向安全性特性,且对内部攻击和智能卡丢失攻击是脆弱的.针对协议具体失误之处,提出相应的解决方案.总结了7类应对内部攻击的解决方案.指出了现有方法的不足,提出了合理的解决方案.     

A gradient boosting decision tree approach for insider trading identification: An empirical model evaluation of China stock market

Insider trading is a kind of criminal behavior in stock market by using nonpublic information. In recent years, it has become the major illegal activity in China’s stock market. In this study, a combination approach of GBDT (Gradient Boosting Decision Tree) and DE (Differential Evolution) is proposed to identify insider trading activities by using data of relevant indicators. First, insider trading samples occurred from year 2007 to 2017 and corresponding non-insider trading samples are collected. Next, the proposed method is trained by the GBDT, and initial parameters of the GBDT are optimized by the DE. Finally, out-of-samples are classified by the trained GBDT–DE model and its performances are evaluated. The experiment results show that our proposed method performed the best for insider trading identification under time window length of ninety days, indicating the relevant indicators under 90-days time window length are relatively more useful. Additionally, under all three time window lengths, relative importance result shows that several indicators are consistently crucial for insider trading identification. Furthermore, the proposed approach significantly outperforms other benchmark methods, demonstrating that it could be applied as an intelligent system to improve identification accuracy and efficiency for insider trading regulation in China stock market.     

Anomaly Detection Based on Discrete Wavelet Transformation for Insider Threat Classification

Unlike external attacks, insider threats arise from legitimate users who belong to the organization. These individuals may be a potential threat for hostile behavior depending on their motives. For insider detection, many intrusion detection systems learn and prevent known scenarios, but because malicious behavior has similar patterns to normal behavior, in reality, these systems can be evaded. Furthermore, because insider threats share a feature space similar to normal behavior, identifying them by detecting anomalies has limitations. This study proposes an improved anomaly detection methodology for insider threats that occur in cybersecurity in which a discrete wavelet transformation technique is applied to classify normal vs. malicious users. The discrete wavelet transformation technique easily discovers new patterns or decomposes synthesized data, making it possible to distinguish between shared characteristics. To verify the efficacy of the proposed methodology, experiments were conducted in which normal users and malicious users were classified based on insider threat scenarios provided in Carnegie Mellon University’s Computer Emergency Response Team (CERT) dataset. The experimental results indicate that the proposed methodology with discrete wavelet transformation reduced the false-positive rate by 82% to 98% compared to the case with no wavelet applied. Thus, the proposed methodology has high potential for application to similar feature spaces.     

Practical management of malicious insider threat – An enterprise CSIRT perspective

Communication and Information Systems (CIS) now form the primary information store, exchange and data analysis for all modern military and are crucial to command and control. The ubiquitousness of CIS within the military not only means that there is a complete reliance on CIS, but also presents new avenues of attack by malicious insiders. Military sources say that the insider threat is their number one security concern. This paper presents a case study of the technical counter measures and processes used to deter, detect and mitigate malicious insider threats that the author has researched, using non-classified anonymous interview and the analysis of anonymised qualitative field data, within a specific military organisation. It is not the intention of the author that this paper be viewed as an analysis of the “current state of play” of threats and countermeasures that generically exist across all military and defence organisations – rather it presents the technological and organisational processes utilised and challenges encountered at one organisation. A short discussion of the Computer Security Incident Response Team (CSIRT) structure adopted to successfully manage insider and other CIS security threats is presented, followed by a more detailed overview of existing and emerging technical efforts to deter, detect and mitigate such malicious insider threats within the military environment under study. Emphasis will be on the emerging technologies such as anomaly detection using real-time e-discovery, enterprise forensics and profiling users “cyber” behaviour and how these integrate into CSIRT technologies and processes. The technical advantages and challenges that such technologies present within a military alliance will be discussed. The success of such technologies in combating current malicious insider threat environment will be briefly compared with those put forward as challenges in the “Research on mitigating the insider threat to information systems #2” workgroup which took place in 2000 (Anderson et al., 2000.). In closing the author introduce the concept of Stateful Object Use Consequence Analysis as a way of managing the insider threat.