A Big Data Approach Towards Detection of Insider Attack

Abstract

In a big data system, infrastructure is made up like that large number of information is stored on a server which has all client’s data and other data also and that data is used by users, basically they host the data. Information security is considered as a major challenge in such system. From a client’s standpoint, the biggest risks in using big data systems is that they have to believe on the service provider of big data system, this system are owns and designed by service provider, user have to store and access that data so that they have lot of risk about it. Methodology: This work propose a new system architecture in which insider attacks can be identified by using the repetition of data on different nodes in the system. From all of the attacks, Insider attacks are one of today’s most difficult cyber security problem that are not well addressed by commonly employed security solutions. Until several scientific research paper published in domain of insider attack, this paper certify that the field can benefit from the proposed structure, taxonomy and novel categorization of research that contribute to the organization of insider attack incidents and the defense solutions used for them. The target of our order is to systematize learning in insider threat research, while utilizing existing ground theory strategy for rigorous literature review Work process of proposed system categories among some classes that include: 1) Events and datasets, 2) Examination of attackers, 3) Process act, and 4) Defense solutions. Special attention is paid to the definitions and taxonomies of the insider threat; we present an auxiliary scientific classification of insider threat incidents, which is based on existing taxonomies. Outcome: This paper will help to improve researcher’s work in the domain of insider attack, because it provides following things: 1) Time-to-time an updated and mostly available datasets that can be helpful for testing new detection solutions against different attack, 2) References of existing case studies and architecture of insider’s behaviors is used for the purpose of testing defense solutions or expanding their coverage, 3) An exchange of knowledge about current patterns and further research directions that can be used for thinking in the insider risk space.

Keywords: Big data, Hadoop, Internal attack detection, Intrusion detection, Security, Spam, Spark.

View PDF