A New Take on Detecting Insider Threats

TLDR

The threat that malicious insiders pose towards organisations is a significant problem. The study investigates detecting insider threats by modelling users’ normal behaviour to spot anomalous deviations. The authors employ Hidden Markov Models to learn normal user behaviour and flag significant deviations as potential attacks. The method successfully detects insider threats, accurately models user behaviour, and outperforms prior approaches.

Abstract

The threat that malicious insiders pose towards organisations is a significant problem. In this paper, we investigate the task of detecting such insiders through a novel method of modelling a user's normal behaviour in order to detect anomalies in that behaviour which may be indicative of an attack. Specifically, we make use of Hidden Markov Models to learn what constitutes normal behaviour, and then use them to detect significant deviations from that behaviour. Our results show that this approach is indeed successful at detecting insider threats, and in particular is able to accurately learn a user's behaviour. These initial tests improve on existing research and may provide a useful approach in addressing this part of the insider-threat challenge.