Detecting threatening insiders with lightweight media forensics
Loading...
Authors
Garfinkel, Simson L.
Beebe, Nicole
Liu, Lishu
Maasberg, Michele
Subjects
Advisors
Date of Issue
2013
Date
Publisher
Language
Abstract
This research uses machine learning and outlier
analysis to detect potentially hostile insiders through the automated
analysis of stored data on cell phones, laptops, and desktop
computers belonging to members of an organization. Whereas
other systems look for specific signatures associated with hostile
insider activity, our system is based on the creation of a “storage
profile” for each user and then an automated analysis of all the
storage profiles in the organization, with the purpose of finding
storage outliers. Our hypothesis is that malicious insiders will
have specific data and concentrations of data that differ from
their colleagues and coworkers. By exploiting these differences,
we can identify potentially hostile insiders. Our system is based on a combination of existing open source
computer forensic tools and datamining algorithms. We modify
these tools to perform a “lightweight” analysis based on statistical
sampling over time. In this, our approach is both efficient and
privacy sensitive. As a result, we can detect not just individuals
that differ from their co-workers, but also insiders that differ
from their historic norms. Accordingly, we should be able to
detect insiders that have been “turned” by events or outside
organizations. We should also be able to detect insider accounts
that have been taken over by outsiders.
Our project, now in its first year, is a three-year project
funded by the Department of Homeland Security, Science and
Technology Directorate, Cyber Security Division. In this paper
we describe the underlying approach and demonstrate how the
storage profile is created and collected using specially modified
open source tools. We also present the results of running these
tools on a 500GB corpus of simulated insider threat data created
by the Naval Postgraduate School in 2008 under grant from the
National Science Foundation.
Type
Article
Description
Series/Report No
Department
Computer Science (CS)
Organization
Identifiers
NPS Report Number
Sponsors
Funder
Format
Citation
Distribution Statement
Rights
This publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States.