Context-Aware Insider Threat Detection Alex Memory

We are researching ways to detect insider threats in computer usage data crossing multiple modalities – e.g., resources and devices used, network and communication patterns – and where signals of possible threat are highly contextual – e.g., detectable only after inferring user roles, peer groups, collaborators and personal history. The contexts are also dynamic – reflecting a user’s rapid shifts in focus when working on different tasks and longer term changes in interests – and take place in a setting that is identity-aware but privacypreserving. Although currently focused on the insider threat domain, the architecture, representations and algorithms we are developing are broadly applicable and can lead to interesting future research directions for context-aware computing. 1 Insider Threats and Anomaly Detection Insiders within an organization, i.e. those with legitimate access to sensitive internal data and systems, can pose a disproportionate threat to the organization and to society if they use this access for malicious purposes (Cappelli, Moore, and Trzeciak 2012). Automatic insider threat detection is challenging because insiders have more knowledge than outsiders of the sensors and defenses meant to prevent malicious use and use it to cover their tracks in novel ways. Also, insiders can hide a few harmful activities in plain sight by interspersing them amongst their normal activities (which they maintain to avoid raising suspicion). Handling this means teasing apart separate activities across time, resource usage, device usage and networks of communication. They can also use multiple user accounts, e.g. administrator accounts, to make identifying them more difficult. The consequence of this, and the fact that cases of insider threat – although costly – are few in number, is that techniques such as supervised machine learning cannot be applied directly. Anomaly detection, which finds outliers in some context, is a promising alternative for insider threat detection – and also fraud detection and network intrusion detection – where the anomalies are the focus, rather than the overwhelming Copyright c © 2013, Association for the Advancement of Artificial Intelligence (www.aaai.org). All rights reserved. Approved for Public Release, Distribution Unlimited majority of the data, which represents harmless user activity (Aggarwal 2013; Chandola, Banerjee, and Kumar 2009). However, with this approach it is critical to construct contexts around individuals. By contexts we mean the linking of users’ traits, roles and activities to relevant baseline populations and baseline time periods to compare against. Useful contexts simultaneously reveal threats and minimize false positives. To do this we are developing representations of activities of users and have techniques for designing relevant baselines for specific activity scenarios. Our existing research has led to the PRODIGAL (Proactive Detection of Insider Threats with Graph Analysis And Learning) architecture, and the results we2 have achieved so far (Young et al. 2013; Senator et al. 2013), done in a privacy-preserving setting with a real corporate database of computer use activity, suggest promising new directions for research for context-aware computing. An Architecture for Insider Threat Detection The PRODIGAL architecture finds suspected insider threat instances using models of user activity at multiple levels. Dependencies between observable events and latent activity states are captured on a blackboard model, and components for anomaly detection are specified with a specialized visual language.