DMCA
Detecting the Misappropriation of Sensitive Information through Bottleneck Monitoring
BibTeX
@MISC{Goan_detectingthe,
author = {Terrance Goan and Matthew Broadhead},
title = {Detecting the Misappropriation of Sensitive Information through Bottleneck Monitoring},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
The insider threat has proved a tough nut to crack. Previous work in this area has been dominated by efforts to model normal user behavior through statistical measures and then detect substantial anomalies. Unfortunately, while these methods have shown some ability in the detection of masqueraders, broader applications have proved ineffectual due to extremely high false alarm rates. In this paper we describe an alternative approach (SL-SAFE) that can achieve high levels of accuracy in detecting the unauthorized access and distribution of sensitive/proprietary information by insiders – the single most costly type of computer crime. SL-SAFE succeeds in this task by means of a stochastic sampling of bottlenecks through which information must flow in order to be useful to the malicious insider. Further, it achieves a low (and shrinking) false alarm rate by validating its suspicions through public information sources and eliciting feedback from the information owner. 1.
Keyphrases
sensitive information bottleneck monitoring sensitive proprietary information substantial anomaly alternative approach high level stochastic sampling normal user behavior statistical measure computer crime public information source costly type false alarm rate high false alarm rate previous work information owner unauthorized access insider threat tough nut malicious insider
