The risk posed by insider threats has usually been approached by analyzing the behavior of users solely in the cyber domain. In this article, we show the viability of using physical movement logs, collected via a building access control system, together with an understanding of the layout of the building housing the system's assets, to detect malicious insider behavior that manifests itself in the physical domain. In particular, we propose a systematic framework that uses contextual knowledge about the system and its users, learned from historical data gathered from a building access control system, to select suitable models for representing movement behavior. We suggest two different models of movement behavior in this article and evaluate their ability to represent normal user movement. We then explore the online usage of the learned models, together with knowledge about the layout of the building being monitored, to detect malicious insider behavior. Finally, we show the effectiveness of the developed framework using real-life data traces of user movement in railway transit stations. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from permissions@acm.org.  Insider threats are a top concern of all organizations, because they are common and can have severe consequences. However, insider threats are difficult to detect, since the adversary already has physical and cyber access to the organization's assets. Many state-of-the-art research efforts [Salem et al. 2008 ] and state-of-the-practice tools [Alien Vault 2016; Tripwire 2016] focus on the cyber aspect of insider attacks by analyzing the user's cyber footprint (e.g., logins and file accesses). However, the strength of an organization's defense mechanisms is only as strong as its weakest link. By failing to consider the physical aspect of users' behavior, an organization not only leaves itself unable to detect precursor physical behavior that could facilitate future cyber attacks but also opens itself up to less tech-savvy attacks, such as vandalism and theft [CERT Insider Threat Center 2011]. Thus, physical security plays a crucial role in an organization's overall defense posture. This is especially true for critical infrastructure systems such as power grids and transportation systems in which a physical breach can have major real-world effects. Building access controls [Luallen 2011] are often used to limit the areas that users can access based on their role in the organization; they normally do so through a relatively static assignment of a set of locations to the user's tracking device (e.g., RFID tag or access card). When a user moves between spaces (e.g., swiping a card at a door), information about this movement is logged. Although building access control restricts the spaces that a user is able to access, it is merely the first step towards physical security. Like other access control solutions, it faces the problem of being overly permissive [Bauer et al. 2009 ]. However, denying access to rarely accessed rooms is a costly solution, as it places the burden on administrators to grant every access request, which can lead to severe consequences, especially in time-critical situations (e.g., maintenance). Even with a restrictive set of granted permissions, the access control solutions in place do not take into account the context of a user's access. Thus, we focus on developing a more advanced behavior-monitoring capability that detects abnormalities in a user's movement within an organization's buildings. In Section 3.5, we examine the effect of the addition of such defenses on the overall security posture of an organization. The results of the analysis in that section indicate that this type of defense capability will increase the strength of the organization's security. As such, it is an important defense mechanism that deserves more attention from researchers and security practitioners. In this article, we explore how physical access logs collected from a railway transit system can be used to develop a more advanced behavior-monitoring capability for the purposes of detecting abnormalities in a user's movement. In particular, we aim (1) to determine the feasibility of characterizing the movement behavior of users in a complex real-world system, (2) to develop techniques that can be applied to this detection problem, and (3) to identify ways to integrate real-time detection into physical security. We provide a systematic approach to tackling these issues in a way that can be generalized to a diverse set of systems. We observe that since an organization consists of users who have a diverse set of roles, the movement patterns of users in different roles may vary vastly because of their job needs. Instead of proposing a single technique to model all users, we construct a methodical approach that selects the appropriate model based on the context of the organizational role and learns that model from historical data. More specifically, we propose metrics to determine the feasibility of modeling the behavior of certain users in a system. We then construct models that factor in contextual information about location, and show that the model can be used in an online manner. We propose two different models and evaluate their ability to represent normal user movement behavior by comparing the detection rates of the framework when it is using those models. This
In subsequent sections, we formally define this improved Markov model and evaluate its ability to represent normal user movement behavior, in comparison to the Markov model in REF .
Data-driven Model-based Detection of Malicious Insiders via Physical Access Logs
TOMC
Computer Science