Insider threat simulation and performance analysis of insider detection algorithms with role based models

Insider threat problems are widespread in industry today. They have resulted in huge losses to organizations. The security reports by leading organizations point out the fact that there have been many more insider attacks in recent years than any other form of attack. Detection of these insider threats is a top priority. One problem facing the detection mechanisms is that the real data for modeling is not easily available. This thesis describes a simulator which can simulate the insiders and generate access information in the form of logs. Currently there are many methods which use data mining algorithms to detect insider attacks. Role based detection is a well known mechanism to accurately distinguish insider behavior from the normal behavior. The thesis focuses on the advantages of using role based mechanisms for insider threat detection. Five algorithms have been chosen and performance analysis of these under various scenarios is carried out. The thesis discusses these results in detail. The simulator is built on the Scalable Simulation Framework (SSF). It is an extension of the Boeing simulator, JANUS. The simulator uses behavior files to model an insider/normal user and generates the access information using Markov chains.

Name thesis:degree_name

M.S.

Level thesis:degree_level

Thesis

Discipline thesis:degree_discipline

Electrical & Computer Engr

Grantor

University of Illinois at Urbana-Champaign

Year dc:date

2010

Author dc:creator

• Nellikar, Suraj

Contributors dc:contributor

• Nicol, David M.

• Insider threat
• Insider detection algorithms
• Role-based access control

Statement dc:rights

• Copyright 2010 Suraj Nellikar

Language dc:language

en

Handle dc:identifier

http://hdl.handle.net/2142/16177

OAI identifier oai:identifier

oai:www.ideals.illinois.edu:2142/16177