The threat that malicious insiders pose towards organisations is a significant problem. In this paper, we investigate the task of detecting such insiders through a novel method of modelling a user's normal behaviour in order to detect anomalies in that behaviour which may be indicative of an attack. Specifically, we make use of Hidden Markov Models to learn what constitutes normal behaviour, and then use them to detect significant deviations from that behaviour. Our results show that this approach is indeed successful at detecting insider threats, and in particular is able to accurately learn a user's behaviour. These initial tests improve on existing research and may provide a useful approach in addressing this part of the insider-threat challenge. Insider threat; Anomaly detection system; Machine learning Organisational computer systems are increasingly threatened by insiders. The Breach Level Index, which tracks publicly disclosed breaches, shows that almost 40% of data breaches are attributed to malicious insiders or accidental loss due to insiders [6] . It is evident that insider threats now represent a significant portion of the cyber-attacks an organisation faces, even if we do not take into account the unreported incidents. In addition, they are often the most costly type of attack [14] due to the elevated level of trust and access that an insider is afforded. As insider threats have become more prevalent, there have been numerous advances in both industry and research towards attack prevention and detection. At the programme level, the CERT division at CMU maintains a comprehensive research directive on insider threats, and are considered pioneers in the field [2] . One of the major tools used in exploring insider threat by CERT is System Dynamics diagrams, which aid in defining relationships between different precursors and factors indicative of an attack. Instead of sepaPermission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from permissions@acm.org. rately modelling different types of insider attacks as done in the CERT models, a unifying framework to characterise insider attacks has been presented in [11] . The framework is particularly powerful for analysing cases, in order to understand behaviours that may lead to an attack, the reasons for an attack, the types of attacks that may be launched, and most importantly, to compare this data across other cases. The U.S. Department of Homeland Security published a report in 2014: "Combating the Insider Threat" [4] . The report is primarily concerned with the behavioural aspects of the insider threat, and how certain traits can indicate an increased likelihood of a threat. The authors suggest that one of the best prevention measures is educating individuals to report certain behaviours that they observe in their peers. These "Characteristics of Insiders at Risk of Becoming a Threat" are vague (Ethical Flexibility, Introversion, etc.) and can often be hard to quantify. In the report they also provide a short list of behavioural indicators which could signal an insider threat, such as "Remotely accesses the network while on vacation, sick or at odd times", which are easier to observe. Underscoring all of this advice is the concept of a baseline of normal behaviour, which is a prerequisite in attempting to observe significant levels of deviation of a certain behaviour. Machine learning-based approaches have been central to work on insider-threat detection. The actions that an employee takes over a period of time on a system (e.g., logging on/off, file accesses, etc.) can be modelled as a sequence. The sequences that are seen often or on a usual basis, can then be considered as the user's normal behaviour. Observed actions which do not resemble those normal sequences can be regarded as anomalous behaviour, which then may indicate a potential insider threat or at least an event to be investigated. This is the approach proposed by Parveen and Thuraisingham [13] . They extend this line of reasoning, and introduce "concept-drift", which is the gradual change in a user's actions over time. They postulate that this more accurately detects anomalous behaviour, since a user's actions often change over time (due to increasing skill or responsibility), and these changes would be regarded as anomalous in a model which did not account for the drift. This is a sensible assumption to make as it strictly generalises the static behavioural approach, and also introduces the flexibility and adaptability that is expected of machine learning. In addition to using data collected on a user's actions, the literature on characterising the insider threat suggests that behavioural and personality characteristics are equally (if not more) important. Brdiczka et al. [1] , combine structural 47
The work of REF applies another well-known machine learning technique, Hidden Markov Models, to the detection of insider threats.
A New Take on Detecting Insider Threats: Exploring the Use of Hidden Markov Models
MIST '16
Computer Science