PROACTIVE INSIDER-THREAT DETECTION - Against Confidentiality in Sensitive Pervasive Applications

Joon S. Park, Jaeho Yim, Jason Hallahan

2009

Abstract

The primary objective of this research is to mitigate insider threats against sensitive information stored in an organization’s computer system, using dynamic forensic mechanisms to detect insiders’ malicious activities. Among various types of insider threats, which may break confidentiality, integrity, or availability, this research is focused on the violations of confidentiality with privilege misuse or escalation in sensitive applications. We identify insider-threat scenarios and then describe how to detect each threat scenario by analyzing the primitive user activities, we implement our detection mechanisms by extending the capabilities of existing software packages. Since our approach can proactively detect the insider’s malicious behaviors before the malicious action is finished, we can prevent the possible damage proactively. In this particular paper the primary sources for our implementation are from the Windows file system activities, the Windows Registry, the Windows Clipboard system, and printer event logs and reports. However, we believe our approaches for countering insider threats can be also applied to other computing environments.

Paper Citation

in Harvard Style

S. Park J., Yim J. and Hallahan J. (2009). PROACTIVE INSIDER-THREAT DETECTION - Against Confidentiality in Sensitive Pervasive Applications . In Proceedings of the 11th International Conference on Enterprise Information Systems - Volume 3: ICEIS, ISBN 978-989-8111-86-9, pages 393-398. DOI: 10.5220/0002004203930398

in Bibtex Style

@conference{iceis09,
author={Joon S. Park and Jaeho Yim and Jason Hallahan},
title={PROACTIVE INSIDER-THREAT DETECTION - Against Confidentiality in Sensitive Pervasive Applications},
booktitle={Proceedings of the 11th International Conference on Enterprise Information Systems - Volume 3: ICEIS,},
year={2009},
pages={393-398},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0002004203930398},
isbn={978-989-8111-86-9},
}

in EndNote Style

TY - CONF
JO - Proceedings of the 11th International Conference on Enterprise Information Systems - Volume 3: ICEIS,
TI - PROACTIVE INSIDER-THREAT DETECTION - Against Confidentiality in Sensitive Pervasive Applications
SN - 978-989-8111-86-9
AU - S. Park J.
AU - Yim J.
AU - Hallahan J.
PY - 2009
SP - 393
EP - 398
DO - 10.5220/0002004203930398