• KSII Transactions on Internet and Information Systems
    Monthly Online Journal (eISSN: 1976-7277)

Advanced insider threat detection model to apply periodic work atmosphere

Vol. 13, No.3, March 31, 2019
10.3837/tiis.2019.03.035, Download Paper (Free):

Abstract

We developed an insider threat detection model to be used by organizations that repeat tasks at regular intervals. The model identifies the best combination of different feature selection algorithms, unsupervised learning algorithms, and standard scores. We derive a model specifically optimized for the organization by evaluating each combination in terms of accuracy, AUC (Area Under the Curve), and TPR (True Positive Rate). In order to validate this model, a four-year log was applied to the system handling sensitive information from public institutions. In the research target system, the user log was analyzed monthly based on the fact that the business process is processed at a cycle of one year, and the roles are determined for each person in charge. In order to classify the behavior of a user as abnormal, the standard scores of each organization were calculated and classified as abnormal when they exceeded certain thresholds. Using this method, we proposed an optimized model for the organization and verified it.


Statistics

Show / Hide Statistics

Statistics (Cumulative Counts from December 1st, 2015)
Multiple requests among the same browser session are counted as one view.
If you mouse over a chart, the values of data points will be shown.


Cite this article

[IEEE Style]
Junhyoung Oh, Tae Ho Kim and Kyung Ho Lee, "Advanced insider threat detection model to apply periodic work atmosphere," KSII Transactions on Internet and Information Systems, vol. 13, no. 3, pp. 1722-1737, 2019. DOI: 10.3837/tiis.2019.03.035

[ACM Style]
Oh, J., Kim, T. H., and Lee, K. H. 2019. Advanced insider threat detection model to apply periodic work atmosphere. KSII Transactions on Internet and Information Systems, 13, 3, (2019), 1722-1737. DOI: 10.3837/tiis.2019.03.035