Buckley, Oliver

Hodges, Duncan

Paxton-Fear, Katie

E-space: Manchester Metropolitan University's Research Repository

Paxton-Fear, Katie and Hodges, Duncan and Buckley, Oliver (2018) Con-nected events and malicious insiders: Investigating patterns of insider threatusing natural language processing. Cranfield University. (Unpublished)Downloaded from: http://e-space.mmu.ac.uk/627529/Version: Published VersionPublisher: Cranfield UniversityPlease cite the published versionhttps://e-space.mmu.ac.ukwww.cranfield.ac.ukKatie Paxton-Fear K.Paxton-Fear@cranfield.ac.uk †, Dr Duncan Hodges d.hodges@cranfield.ac.uk †, Dr Oliver Buckley o.buckley@uea.ac.uk‡† Cranfield University ‡ University of East AngliaCentre for Electronic Warfare and Cyber, Cranfield Defence and Security, Defence Academy of the United KingdomConnected events and malicious insiders: Investigating patterns of insider threat using natural language processingGoal of this ResearchTo present a new methodology for the investigation and understanding of insider threat events. Using natural language processing and visualisations to investigate written reports, revealing links between actions, actors, events and causes of insider attack.What is Insider Threat?Insider threat is a security threat that comes from within an organisation, as apposed toexternal threats such as hackers. These insiders often have access to systems andinformation due to their job and understand where there are gaps in security systems. Inrecent times insider attacks have been widely publicised due to the actions of EdwardSnowden and his information theft, however all organisations are at risk of insiderattacks, and there are many ways for an insider to damage or attack an organisation orsystem. These can include malicious insiders, those who purposely and knowinglycommit attacks, and inadvertent insiders, those who click on a link in a suspicious emailor leave a security door open while going outside to have a cigarette.How do we detect insider threats?Currently insider threats are detected in several ways such as, users accessing files orinformation that deviates from the expected activity on an IT system or network,behavioural or lifestyle clues such as resentment or gambling. Often insider threatsremain unknown and are found by accident or well after the damage has been done.Due to the large amount of privileged access insiders have, as well as their knowledge ofsecurity flaws within systems it is no surprise that they are hard to detect. Current stateof the art for computer systems involves the tracking and monitoring of computer logsand network traffic, using machine learning to detect anomalies.However, if the insider threat activity takes place while a baseline “normal” is beingrecorded, or if the insider threat activity is so close to the normal baseline with fewanomalies it cannot be detected.Insiders can be anyone within an organisationInsider Threat activity is often committed at the same time as regular activityIf the baseline reading for normal activity is taken when insider activity is being recorded it can be impossible to detectWhy use natural language processing?Natural language processing (NLP) is the process in which a computer can “understand”natural language, this can be text or speech. There are many different types of NLP tasks,such as translation, summarisation, recognising appointments from emails and findingentities such as places or people's names. Insider threats are witnessed by differentpeople, at different times, and in different ways, after an attack reports can be a valuablesource of information on the attack, however this value is often lost and locked behindlarge amounts of text, using natural language processing details can be extracted whichwould otherwise be missed. This can be achieved by taking reports written after aninsider attack and mapping these relationships, focusing on actors, actions, causality andevents that took place. This will then allow an investigator to explore an attack, anddevelop mitigation and defence strategies from their understanding of the attack. Inaddition to this new detection systems can be developed and created based on theevolving nature of the attackReferencesCappelli, D., Moore, A. and Trzeciak, R. (2015) The Cert Guide to Insider Threats: How to prevent, detect, and respond to Information Technology crimes (Theft, Sabotage, Fraud). Addison-Wesley. Available at: 10.1017/CBO9781107415324.004 (Accessed: 21 February 2018).Sanzgiri, A. (2016) ‘Classification of Insider Threat Detection Techniques’, CISRC ’16 Proceedings of the 11th Annual Cyber and Information Security Research Conference, New York, New York, USA: ACM Press, pp. 5–8. Available at: 10.1145/2897795.2897799 (Accessed: 21 February 2018).Proposed natural language processing and visualisation techniques for insider threatAn example NLP system

Connected events and malicious insiders: Investigating patterns of insider threat using natural language processing

https://e-space.mmu.ac.uk/627529/1/Poster.pdf

Connected events and malicious insiders: Investigating patterns of insider threat using natural language processing

Abstract

Similar works

Full text

Available Versions

E-space: Manchester Metropolitan University's Research Repository