MENU: Home Bio Affiliations Research Teaching Publications Videos Collaborators/Students Contact FAQ ©2007-14 RSS

Paper in ACM KDD 2013 “Detecting insider threats in a real corporate database of computer usage activity”

  • T. E. Senator, H. G. Goldberg, A. Memory, W. T. Young, B. Rees, R. Pierce, D. Huang, M. Reardon, D. A. Bader, E. Chow, I. Essa, J. Jones, V. Bettadapura, D. H. Chau, O. Green, O. Kaya, A. Zakrzewska, E. Briscoe, R. I. L. Mappus, R. McColl, L. Weiss, T. G. Dietterich, A. Fern, W. Wong, S. Das, A. Emmott, J. Irvine, J. Lee, D. Koutra, C. Faloutsos, D. Corkill, L. Friedland, A. Gentzel, and D. Jensen (2013), “Detecting insider threats in a real corporate database of computer usage activity,” in Proceedings of the 19th ACM SIGKDD international conference on Knowledge discovery and data mining, New York, NY, USA, 2013, pp. 1393-1401. [WEBSITE] [DOI] [BIBTEX]
    @inproceedings{2013-Senator-DITRCDCUA,
      Acmid = {2488213},
      Address = {New York, NY, USA},
      Author = {Senator, Ted E. and Goldberg, Henry G. and Memory, Alex and Young, William T. and Rees, Brad and Pierce, Robert and Huang, Daniel and Reardon, Matthew and Bader, David A. and Chow, Edmond and Essa, Irfan and Jones, Joshua and Bettadapura, Vinay and Chau, Duen Horng and Green, Oded and Kaya, Oguz and Zakrzewska, Anita and Briscoe, Erica and Mappus, Rudolph IV L. and McColl, Robert and Weiss, Lora and Dietterich, Thomas G. and Fern, Alan and Wong, Weng--Keen and Das, Shubhomoy and Emmott, Andrew and Irvine, Jed and Lee, Jay-Yoon and Koutra, Danai and Faloutsos, Christos and Corkill, Daniel and Friedland, Lisa and Gentzel, Amanda and Jensen, David},
      Booktitle = {{Proceedings of the 19th ACM SIGKDD international conference on Knowledge discovery and data mining}},
      Date-Added = {2013-10-22 22:29:23 +0000},
      Date-Modified = {2014-05-16 20:10:57 +0000},
      Doi = {10.1145/2487575.2488213},
      Isbn = {978-1-4503-2174-7},
      Location = {Chicago, Illinois, USA},
      Month = {September},
      Numpages = {9},
      Pages = {1393--1401},
      Publisher = {ACM},
      Series = {KDD '13},
      Title = {Detecting insider threats in a real corporate database of computer usage activity},
      Url = {http://doi.acm.org/10.1145/2487575.2488213},
      Year = {2013},
      Bdsk-Url-1 = {http://doi.acm.org/10.1145/2487575.2488213},
      Bdsk-Url-2 = {http://dx.doi.org/10.1145/2487575.2488213}}

Abstract

This paper reports on methods and results of an applied research project by a team consisting of SAIC and four universities to develop, integrate, and evaluate new approaches to detect the weak signals characteristic of insider threats on organizations’ information systems. Our system combines structural and semantic information from a real corporate database of monitored activity on their users’ computers to detect independently developed red team inserts of malicious insider activities. We have developed and applied multiple algorithms for anomaly detection based on suspected scenarios of malicious insider behavior, indicators of unusual activities, high-dimensional statistical patterns, temporal sequences, and normal graph evolution. Algorithms and representations for dynamic graph processing provide the ability to scale as needed for enterprise-level deployments on real-time data streams. We have also developed a visual language for specifying combinations of features, baselines, peer groups, time periods, and algorithms to detect anomalies suggestive of instances of insider threat behavior. We defined over 100 data features in seven categories based on approximately 5.5 million actions per day from approximately 5,500 users. We have achieved area under the ROC curve values of up to 0.979 and lift values of 65 on the top 50 user-days identified on two months of real data.

via ACM DL Detecting insider threats in a real corporate database of computer usage activity.

Tags: , ,


You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

AddThis Social Bookmark Button

Leave a Reply