• KSII Transactions on Internet and Information Systems
    Monthly Online Journal (eISSN: 1976-7277)

Indicator-based Behavior Ontology for Detecting Insider Threats in Network Systems

Vol. 11, No.10, October 31, 2017
10.3837/tiis.2017.10.020, Download Paper (Free):

Abstract

Malicious insider threats have increased recently, and methods of the threats are diversifying every day. These insider threats are becoming a significant problem in corporations and governments today. From a technology standpoint, detecting potential insider threats is difficult in early stage because it is unpredictable. In order to prevent insider threats in early stage, it is necessary to collect all of insiders’ data which flow in network systems, and then analyze whether the data are potential threat or not. However, analyzing all of data makes us spend too much time and cost. In addition, we need a large repository in order to collect and manage these data. To resolve this problem, we develop an indicator-based behavior ontology (IB2O) that allows us to understand and interpret insiders’ data packets, and then to detect potential threats in early stage in network systems including social networks and company networks. To show feasibility of the behavior ontology, we developed a prototype platform called Insider Threat Detecting Extractor (ITDE) for detecting potential insider threats in early stage based on the behavior ontology. Finally, we showed how the behavior ontology would help detect potential inside threats in network system. We expect that the behavior ontology will be able to contribute to detecting malicious insider threats in early stage.


Statistics

Show / Hide Statistics

Statistics (Cumulative Counts from December 1st, 2015)
Multiple requests among the same browser session are counted as one view.
If you mouse over a chart, the values of data points will be shown.


Cite this article

[IEEE Style]
Janghyuk Kauh, Wongi Lim, Koohyung Kwon, Jong-Eon Lee, Jung-Jae Kim, Minwoo Ryu and Si-Ho Cha, "Indicator-based Behavior Ontology for Detecting Insider Threats in Network Systems," KSII Transactions on Internet and Information Systems, vol. 11, no. 10, pp. 5062-5079, 2017. DOI: 10.3837/tiis.2017.10.020

[ACM Style]
Kauh, J., Lim, W., Kwon, K., Lee, J., Kim, J., Ryu, M., and Cha, S. 2017. Indicator-based Behavior Ontology for Detecting Insider Threats in Network Systems. KSII Transactions on Internet and Information Systems, 11, 10, (2017), 5062-5079. DOI: 10.3837/tiis.2017.10.020