| Insider threats are the behaviors conducted by legal employees within the organization,as well as partners and third parties with information access rights,who violated the security policies and cause damage to the confidentiality,integrity,and availability of the internal organization resources intentionally or unintentionally.With the popularity of the Internet,information systems are are increasingly dependent by business and organization management.The surveys saw that the losses caused by insider threats is increasing year by year.It is of great practical significance to detect the malicious behavior of insiders and control the damage caused by insider threats timely and efficiently.In recent years,researchers have studied insider threats from various levels and perspectives such as network traffic,system calls,employee psychology,and employee behavior.They have achieved many important results in theoretical frameworks and detection methods,but the research has not made breakthrough progress owing to the lacking of real enterprise data,the high cost of manual data labeling,labor relied feature extraction,and high false positive detective rate.In addition to system vulnerabilities and improper rights distribution,“human” is the main threat factor.Focusing on employees,we comprehensively analyzed their intrinsic psychology characteristics and personality,and modeled the normal historical behavior in business operations,which provides ideas and methods to detect malicious behavior of employees for enterprises and organizations.User profile technology is a method of extracting the user information from massive data and detailing users' internal needs and behavior preferences.We applied user profile technology to insider threat detection,and described the employees from the perspectives of internal characteristics,behavior details and behavioral processes comprehensively and meticulously.Based on the research of predecessors,the following results are achieved.1.Researching on the intrinsic characteristics of employees' psychology,personality,personality,etc.,we comprehensively analyzed the job information such as business department,job rank,work ability,as well as violations,and formed an attribute profile with static characteristics.Aiming at the problem that the intrinsic characteristics can not completely determine the malicious behaviors performing possibility,a method of clustering users by attribute profile similarity,and highlighting the “high-risk” users who are great similar to the malicious ones,was proposed.In the practice of insider threat detection,it can reduce the probability of malicious acts performing by strengthening the supervision of “high-risk” users.2.The audit log of users' various activities in the information system is recorded,and the behavior domain is divided according to the type of activity.A detailed profile of user's single domain activity was made.Aiming at the problem that the behavior feature extraction is over-reliant on labor,and the statistical features cannot utilize the behavior details,a method of extracting user behavior features with full details was proposed.Then,a classification support vector machine is used as the basic classifier.Based on the ensemble learning method,a dynamic update model adapting to the user behavior habits changes is proposed.The detailed information of the behavior log is fully utilized to describe the user single domain behavior completely and comprehensively.3.It integrated multi-domain behaviors,modeled the behaviors sequence,and formed a behavioral process profile that reflects the user's business logic and behavioral habits.Aiming at the problem of neglecting the intrinsic connection between behaviors and failing to make full use of behavioral sequence information,we proposed a method to model behavioral sequences by long-short term memory network,which provides a feasible method for predicting the probability of subsequent behavior based on pre-order behavior,and provides a strong basis for judging user abnormal behavior.4.The inside threat detection framework based on user profile was designed and implemented.The knowledge of expert domain is added to the inside threat detection process,and a self-improved and quasi-real-time updated insider threat detection system was formed.The experimental results show that the framework can improve the accuracy of inside threat detection and reduce the false positive rate. |
