Insider Threat Detection in Organization using Machine Learning

Abstract

A Cyber Attack is a sudden attempt launched by cybercriminals against multiple computers or networks. According to evolution of cyber space, insider attack is the most serious attack faced by end users, all over the world. Insiders that perform attack have certain advantage over other attack since they familiar system policies and procedures. It is performed by authorized person such as current working employee, pre-working employee and business organizations. Cyber security reports show that both US federal Agency as well as different organizations faces insider threat. Compromised Users, Careless Users and Malicious Users are some of the ground for insider attack. User-Centric insider threat detection based on data granularity provide a new extent for insider detection since data is analysed on it’s depth. but, improper selection of feature is a demerit. As a result, Data granularity with two stage confirmation method is used in the proposed system. In the first stage dual filtering using Hidden Markov model and fuzzy logic is involved. In the second stage, the predicted output from first stage is again checked using profile-to-profile or template-to-template comparison. The selection of user’s information as well as triple feature for generating training set is an additional advantage of the proposed approach. Two stage confirmation leads to increase in performance measure with very low false positive rate.

Keywords: Cyber security, Fuzzy logic, Hidden Markov model, Machine Learning (ML).

View PDF