Probabilistic Modeling of Insider Threat Detection Systems
Due to the high consequences of poorly performing automated insider threat detection systems (ITDSs), it is advantageous for Government and commercial organizations to understand the performance and limitations of potential systems before their deployment. We propose to capture the uncertainties and dynamics of organizations deploying ITDSs to create an accurate and effective probabilistic graphical model that forecasts the operational performance of an ITDS throughout its deployment. Ultimately, we believe this modeling methodology will result in the deployment of more effective ITDSs.
KeywordsInsider threat Probabilistic relational models
This work was supported by IARPA contract 2016-16031100002. The views expressed are those of the authors and do not reflect the official policy or position of the U.S. Government.
- 1.INSA’s Security Policy Reform Council: Assessing the mind of the malicious insider. Technical report, Intelligence and National Security Alliance (2017). https://www.insaonline.org/
- 2.Ester, M., Kriegel, H.P., Sander, J., Xu, X., et al.: A density-based algorithm for discovering clusters in large spatial databases with noise. In: KDD, vol. 96, pp. 226–231 (1996)Google Scholar
- 3.Friedman, N., Getoor, L., Koller, D., Pfeffer, A.: Learning probabilistic relational models. In: IJCAI, vol. 99, pp. 1300–1309 (1999)Google Scholar
- 4.Glasser, J., Lindauer, B.: Bridging the gap: a pragmatic approach to generating insider threat data. In: Security and Privacy Workshops (SPW), pp. 98–104. IEEE (2013)Google Scholar
- 5.Goodman, N.D.: The principles and practice of probabilistic programming. In: Proceedings of the 40th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pp. 399–402. ACM (2013)Google Scholar
- 6.Jensen, F.V.: An Introduction to Bayesian Networks, vol. 210. UCL Press, London (1996)Google Scholar
- 7.NPR: Ex-NSA contractor accused of taking classified information is indicted (2013). http://www.npr.org/sections/thetwo-way/2017/02/09/514275544/ex-nsa-contractor-indicted-for-taking-classifed-information
- 8.Pfeffer, A.: Creating and manipulating probabilistic programs with Figaro. In: 2nd International Workshop on Statistical Relational AI (2012)Google Scholar
- 9.Pfeffer, A.: Practical Probabilistic Programming. Manning Publications, Cherry Hill (2016)Google Scholar
- 11.Ruttenberg, B.E., Pfeffer, A.: Decision-making with complex data structures using probabilistic programming. arXiv preprint arXiv:1407.3208 (2014)
- 12.Salem, M.B., Hershkop, S., Stolfo, S.J.: A survey of insider attack detection research. In: Stolfo, S.J., Bellovin, S.M., Keromytis, A.D., Hershkop, S., Smith, S.W., Sinclair, S. (eds.) Insider Attack and Cyber Security. Advances in Information Security, vol. 39, pp. 69–90. Springer, Boston (2008). https://doi.org/10.1007/978-0-387-77322-3_5 CrossRefGoogle Scholar
- 14.New York Times: A lawsuit against Uber highlights the rush to conquer driverless cars (2017). https://nyti.ms/2kVzR8Z