内部威胁检测中用户属性画像方法与应用

随着信息技术与互联网技术在企业组织中的广泛应用,企业安全面临着前所未有的挑战。大多数企业既面临着企业外部的攻击,也面临着内部人员的内部攻击。由于缺乏及时有效的检测手段,内部攻击对企业和组织造成的损害在一定程度上比外部攻击更加严重。在组织和企业内部,“人”是实施破坏行为的主体,是内部威胁检测中的主要研究对象。针对现有内部威胁检测中对内部员工完全隔离监管方法的相似威胁检测关联性低、检测效率低等问题,文中把研究重点从发现诱因转移到相似用户的聚类和监管上,以组织内的用户作为研究主体,提出了内部威胁检测中用户属性画像方法。该方法首先定义了画像相似度计算方法;然后,从用户性格、人格、过往经历、工作状态、遭遇的挫折等多方面着手,利用本体理论、标签式画像方法将多因素整合;最后,通过改进的K-Means算法实现用户聚类与分组管理,实现了潜在恶意用户共同监管的目的,减少了相似破坏多次发生的可能性。实验结果证明了所提方法的可行性,其为组织预防内部威胁提供了思路和方法。     

Practical management of malicious insider threat – An enterprise CSIRT perspective

Communication and Information Systems (CIS) now form the primary information store, exchange and data analysis for all modern military and are crucial to command and control. The ubiquitousness of CIS within the military not only means that there is a complete reliance on CIS, but also presents new avenues of attack by malicious insiders. Military sources say that the insider threat is their number one security concern. This paper presents a case study of the technical counter measures and processes used to deter, detect and mitigate malicious insider threats that the author has researched, using non-classified anonymous interview and the analysis of anonymised qualitative field data, within a specific military organisation. It is not the intention of the author that this paper be viewed as an analysis of the “current state of play” of threats and countermeasures that generically exist across all military and defence organisations – rather it presents the technological and organisational processes utilised and challenges encountered at one organisation. A short discussion of the Computer Security Incident Response Team (CSIRT) structure adopted to successfully manage insider and other CIS security threats is presented, followed by a more detailed overview of existing and emerging technical efforts to deter, detect and mitigate such malicious insider threats within the military environment under study. Emphasis will be on the emerging technologies such as anomaly detection using real-time e-discovery, enterprise forensics and profiling users “cyber” behaviour and how these integrate into CSIRT technologies and processes. The technical advantages and challenges that such technologies present within a military alliance will be discussed. The success of such technologies in combating current malicious insider threat environment will be briefly compared with those put forward as challenges in the “Research on mitigating the insider threat to information systems #2” workgroup which took place in 2000 (Anderson et al., 2000.). In closing the author introduce the concept of Stateful Object Use Consequence Analysis as a way of managing the insider threat.     

一种无监督的窃密攻击及时发现方法

近年来,窃密攻击成为了最严重的网络安全威胁之一.除了恶意软件,人也可以成为窃密攻击的实施主体,尤其是组织或企业的内部人员.由人实施的窃密很少留下明显的异常痕迹,给真实场景中攻击的及时发现和窃密操作的分析还原带来了挑战.提出了一个方法,将每个用户视为独立的主体,通过对比用户当前行为事件与其历史正常行为的偏差检测异常,以会话为单元的检测实现了攻击发现的及时性,采用无监督算法避免了对大量带标签数据的依赖,更能适用于真实场景.对算法检测为异常的会话,进一步提出事件链构建方法,一方面还原具体窃密操作,另一方面通过与窃密攻击模式对比,更精确地判断攻击.在卡内基梅隆大学的CERT内部威胁数据集上进行了实验,结果达到99%以上的准确率,且可以做到无漏报、低误报,证明了方法的有效性和优越性.     

基于混合N-Gram模型和XGBoost算法的内部威胁检测方法

随着政府企事业单位网络安全机制的建立健全,单纯从外部进入目标系统的攻击门槛越来越高,导致内部威胁逐渐增多。内部威胁区别于外部威胁,攻击者主要来自于内部用户,使得攻击更具隐蔽性,更难被检测。本文提出一种基于混合N-Gram模型和XGBoost算法的内部威胁检测方法。采用词袋、N-Gram、词汇表3种特征提取方法进行实验比对及参数N值筛选,基于混合N-Gram模型和XGBoost算法的内部威胁检测方法检测效果比通过1维数据、2维数据、4维数据的不同特征进行组合的特征子集效果更优,特定度达到0.23,灵敏度达到27.65,准确度达到0.94,F1值达到0.97。对比特定度、灵敏度、准确度、F1值4项评价指标,基于混合N-gram特征提取方法比传统的词袋、词汇表特征提取方法在检测中更有效。此检测方法不仅提高了内部威胁检测特征码的区分度,同时提高了特征提取的准确性和计算性能。     

Detecting Insider Threats: Solutions and Trends

ABSTRACT

Insider threats pose significant challenges to any organization. Many solutions have been proposed in the past to detect insider threats. Unfortunately, given the complexity of the problem and the human factors involved, many solutions which have been proposed face strict constraints and limitations when it comes to the working environment. As a result, many past insider threat solutions have in practice failed in their implementations. In this work, we review some of the recent insider threat detection solutions and explore their benefits and limitations. We also discuss insider threat issues for emerging areas such as cloud computing, virtualization, and social networking.     

基于Agent的内部威胁实时检测框架

针对企业信息系统中的内部威胁行为,特别是内部用户的资源滥用行为,提出了一种基于Agent的实时检测框架,通过比较用户身份权限和异常操作行为发现恶意内部威胁行为.该框架有数据采集模块、检测模块、审计模块和响应模块构成.从身份认证、访问控制、操作审计和漏洞检测四个方面对检测系统进行功能说明,并就关键技术给出了详细介绍.应用实例证明该检测框架实现了用户实名登录、行为检测与事后审计,从根本上防止了恶意内部人员获取非法数据并提供响应和干预能力,提高了信息系统的安全性.最后,总结了内部威胁检测技术发展趋势.     

基于最小攻击树的UEFI恶意行为检测模型

指出了UEFI中源代码、自身扩展模块及来自网络的安全隐患,分析了传统的BIOS与已有的UEFI恶意代码检测方法的不足,定义了结合UEFI平台特点的攻击树与威胁度,构建了动态扩展的威胁模型库与恶意行为特征库相结合的攻击树模型,设计了针对UEFI恶意行为检测的加权最小攻击树算法。实验证明了模型的有效性与可扩展性。     

基于底层数据流分析的恶意软件检测方法

近些年来,层出不穷的恶意软件对系统安全构成了严重的威胁并造成巨大的经济损失,研究者提出了许多恶意软件检测方案。但恶意软件开发中常利用加壳和多态等混淆技术,这使得传统的静态检测方案如静态特征匹配不足以应对。而传统的应用层动态检测方法也存在易被恶意软件禁用或绕过的缺点。本文提出一种利用底层数据流关系进行恶意软件检测的方法,即在系统底层监视程序运行时的数据传递情况,生成数据流图,提取图的特征形成特征向量,使用特征向量衡量数据流图的相似性,评估程序行为的恶意倾向,以达到快速检测恶意软件的目的。该方法具有低复杂度与高检测效率的特点。实验结果表明本文提出的恶意软件检测方法可达到较高的检测精度以及较低的误报率,分别为98.50%及3.18%。     

Detecting anomalous access patterns in relational databases

A considerable effort has been recently devoted to the development of Database Management Systems (DBMS) which guarantee high assurance and security. An important component of any strong security solution is represented by Intrusion Detection (ID) techniques, able to detect anomalous behavior of applications and users. To date, however, there have been few ID mechanisms proposed which are specifically tailored to function within the DBMS. In this paper, we propose such a mechanism. Our approach is based on mining SQL queries stored in database audit log files. The result of the mining process is used to form profiles that can model normal database access behavior and identify intruders. We consider two different scenarios while addressing the problem. In the first case, we assume that the database has a Role Based Access Control (RBAC) model in place. Under a RBAC system permissions are associated with roles, grouping several users, rather than with single users. Our ID system is able to determine role intruders, that is, individuals while holding a specific role, behave differently than expected. An important advantage of providing an ID technique specifically tailored to RBAC databases is that it can help in protecting against insider threats. Furthermore, the existence of roles makes our approach usable even for databases with large user population. In the second scenario, we assume that there are no roles associated with users of the database. In this case, we look directly at the behavior of the users. We employ clustering algorithms to form concise profiles representing normal user behavior. For detection, we either use these clustered profiles as the roles or employ outlier detection techniques to identify behavior that deviates from the profiles. Our preliminary experimental evaluation on both real and synthetic database traces shows that our methods work well in practical situations. This material is based upon work supported by the National Science Foundation under Grant No. 0430274 and the sponsors of CERIAS.     

Catching the malicious insider

This paper looks at the issue of the malicious insider and at a range of the environmental and technical issues that have led to the current situation. The paper also examines why the threat from the malicious insider is changing and looks at a range of measures that can be taken in order to minimise the likelihood of an attack and to enhance the probability of detection in the case of an attack.     

基于多特征融合的Webshell恶意流量检测方法

Webshell是针对Web应用系统进行持久化控制的最常用恶意后门程序,对Web服务器安全运行造成巨大威胁。对于 Webshell 检测的方法大多通过对整个请求包数据进行训练,该方法对网页型 Webshell 识别效果较差,且模型训练效率较低。针对上述问题,提出了一种基于多特征融合的Webshell恶意流量检测方法,该方法以Webshell的数据包元信息、数据包载荷内容以及流量访问行为3个维度信息为特征,结合领域知识,从3个不同维度对数据流中的请求和响应包进行特征提取;并对提取特征进行信息融合,形成可以在不同攻击类型进行检测的判别模型。实验结果表明,与以往研究方法相比,所提方法在正常、恶意流量的二分类上精确率得到较大提升,可达99.25%;训练效率和检测效率也得到了显著提升,训练时间和检测时间分别下降95.73%和86.14%。     

Applications of wavelet data reduction in a recommender system

Memory-based collaborative filtering (CF) recommender systems have emerged as an effective technique for information filtering. CF recommenders are being widely adopted for e-commerce applications to assist users in finding and selecting items of interest. As a result, the scalability of CF recommenders presents a significant challenge; one that is particularly resilient because the volume of data these systems utilize will continue to increase over time. This paper examines the impact of discrete wavelet transformation (DWT) as an approach to enhance the scalability of memory-based collaborative filtering recommender systems. In particular, a wavelet transformation methodology is proposed and applied to both synthetic and real-world recommender ratings. For experimental purposes, the DWT methodology’s effect on predictive accuracy and calculation speed is evaluated to compare recommendation quality and performance.     

信息系统内部威胁检测技术研究

针对企业信息系统中日益严重的内部威胁行为,特别是冒名登录、越权操作等行为,基于用户行为分析的技术,采用主客体混合的分层安全模型,建立了一种新的信息系统内部威胁检测框架.通过比较用户异常行为及主客体权限发现恶意内部威胁行为.应用正则表达式与混合加密算法保证检测准确性和日志安全性.从身份认证、访问控制、操作审计和行为阈值技术四个方面进行安全检测,对关键技术给出了详细介绍.实验证明该检测框架防止了内部人员破坏数据并提供响应和干预能力,提高了信息系统安全性.最后,展望了内部威胁检测技术发展趋势.     

Insider Attack Detection Using Deep Belief Neural Network in Cloud Computing

Cloud computing is a high network infrastructure where users, owners, third users, authorized users, and customers can access and store their information quickly. The use of cloud computing has realized the rapid increase of information in every field and the need for a centralized location for processing efficiently. This cloud is nowadays highly affected by internal threats of the user. Sensitive applications such as banking, hospital, and business are more likely affected by real user threats. An intruder is presented as a user and set as a member of the network. After becoming an insider in the network, they will try to attack or steal sensitive data during information sharing or conversation. The major issue in today's technological development is identifying the insider threat in the cloud network. When data are lost, compromising cloud users is difficult. Privacy and security are not ensured, and then, the usage of the cloud is not trusted. Several solutions are available for the external security of the cloud network. However, insider or internal threats need to be addressed. In this research work, we focus on a solution for identifying an insider attack using the artificial intelligence technique. An insider attack is possible by using nodes of weak users’ systems. They will log in using a weak user id, connect to a network, and pretend to be a trusted node. Then, they can easily attack and hack information as an insider, and identifying them is very difficult. These types of attacks need intelligent solutions. A machine learning approach is widely used for security issues. To date, the existing lags can classify the attackers accurately. This information hijacking process is very absurd, which motivates young researchers to provide a solution for internal threats. In our proposed work, we track the attackers using a user interaction behavior pattern and deep learning technique. The usage of mouse movements and clicks and keystrokes of the real user is stored in a database. The deep belief neural network is designed using a restricted Boltzmann machine (RBM) so that the layer of RBM communicates with the previous and subsequent layers. The result is evaluated using a Cooja simulator based on the cloud environment. The accuracy and F-measure are highly improved compared with when using the existing long short-term memory and support vector machine.     

基于静态行为特征的细粒度Android恶意软件分类

由于Android系统的开放性,恶意软件通过实施各种恶意行为对Android设备用户构成威胁。针对目前大部分现有工作只研究粗粒度的恶意应用检测,却没有对恶意应用的具体行为类别进行划分的问题,提出了一种基于静态行为特征的细粒度恶意行为分类方法。该方法提取多维度的行为特征,包括API调用、权限、意图和包间依赖关系,并进行了特征优化,而后采用随机森林的方法实现恶意行为分类。在来自于多个应用市场的隶属于73个恶意软件家族的24 553个恶意Android应用程序样本上进行了实验,实验结果表明细粒度恶意应用分类的准确率达95.88%,综合性能优于其它对比方法。     

基于自适应差异化图卷积的社交网络新增恶意用户检测

社交网络新增恶意用户检测作为一项分类任务,一直面临着数据样本不足、恶意用户标注稀少的问题。在数据有限的情况下,为了能够精确地检测出恶意用户,提出一种基于自适应差异化图卷积网络的检测方法。该方法通过提取社交网络中的用户特征和社交关系构建社交网络图。构建社交网络图后,计算节点与邻居的相似度,并对邻居进行优先级排序,利用优先级顺序采样关键邻居。关键邻居的特征通过自适应权重的加权平均方式聚合到节点自身,以此更新节点特征。特征更新后的节点通过特征降维和归一化计算得到恶意值,利用恶意值判断用户的恶意性。实验表明该方法和其他方法相比,具有更高的恶意用户查全率和整体查准率,并且能够快速地完成对新增用户的检测,证明了自适应差异化图卷积网络能够有效捕捉到少量样本的关键特征。     

The power of comments: fostering social interactions in microblog networks

Today’s ubiquitous online social networks serve multiple purposes, including social communication (Facebook, Renren), and news dissemination (Twitter). But how does a social network’s design define its functionality? Answering this would need social network providers to take a proactive role in defining and guiding user behavior. In this paper, we first take a step to answer this question with a data-driven approach, through measurement and analysis of the Sina Weibo microblogging service. Often compared to Twitter because of its format,Weibo is interesting for our analysis because it serves as a social communication tool and a platform for news dissemination, too. While similar to Twitter in functionality, Weibo provides a distinguishing feature, comments, allowing users to form threaded conversations around a single tweet. Our study focuses on this feature, and how it contributes to interactions and improves social engagement.We use analysis of comment interactions to uncover their role in social interactivity, and use comment graphs to demonstrate the structure of Weibo users interactions. Finally, we present a case study that shows the impact of comments in malicious user detection, a key application on microblogging systems. That is, using properties of comments significantly improves the accuracy in both modeling and detection of malicious users.     

内部用户行为监管方案

信息安全领域,内部威胁已被认为是一个非常严重的安全问题。因此要建立可信的操作系统环境,必须对登录的内部合法用户的行为进行监管,防止内部威胁的发生。提出了基于用户意图的动态访问控制模型,即依据用户提交的访问意图对内部用户进行访问控制和行为监控,并利用层次分析法AHP对监控得到的用户行为证据进行定量分析评估,然后根据评估结果对内部用户行为进行控制;最后利用Matlab对监管方案进行仿真,实验结果表明该方案可以有效地提高感知内部威胁行为的准确率,克服了难以对内部用户行为进行定量分析的缺点。     

基于行为特征分析的微博恶意用户识别

近年来,社交网络数据挖掘作为物理网络空间数据挖掘的一大热点,目前在用户行为分析、兴趣识别、产品推荐等方面都取得了令人可喜的成果。随着社交网络商业契机的到来,出现了很多恶意用户及恶意行为,给数据挖掘的效果产生了极大的影响。基于此,提出基于用户行为特征分析的恶意用户识别方法,该方法引入主成分分析方法对微博网络用户行为数据进行挖掘,对各维度特征的权重进行排序,选取前六维主成分特征可以有效识别恶意用户,主成分特征之间拟合出的新特征也能提升系统的识别性能。实验结果表明,引入的方法对微博用户特征进行了有效的排序,很好地识别出了微博社交网络中的恶意用户,为其他方向的社交网络数据挖掘提供了良好的数据清洗技术。     

基于图标相似性分析的恶意代码检测方法

据统计，在大量的恶意代码中，有相当大的一部分属于诱骗型的恶意代码，它们通常使用与常用软件相似的图标来伪装自己，通过诱骗点击达到传播和攻击的目的。针对这类诱骗型的恶意代码，鉴于传统的基于代码和行为特征的恶意代码检测方法存在的效率低、代价高等问题，提出了一种新的恶意代码检测方法。首先，提取可移植的执行体（PE）文件图标资源信息并利用图像哈希算法进行图标相似性分析；然后，提取PE文件导入表信息并利用模糊哈希算法进行行为相似性分析；最后，采用聚类和局部敏感哈希的算法进行图标匹配，设计并实现了一个轻量级的恶意代码快速检测工具。实验结果表明，该工具对恶意代码具有很好的检测效果。