A new take on detecting insider threats: Exploring the use of hidden Markov Models

Conference item

The threat that malicious insiders pose towards organisations is a significant problem. In this paper, we investigate the task of detecting such insiders through a novel method of modelling a user's normal behaviour in order to detect anomalies in that behaviour which may be indicative of an attack. Specifically, we make use of Hidden Markov Models to learn what constitutes normal behaviour, and then use them to detect significant deviations from that behaviour. Our results show that this approach is indeed successful at detecting insider threats, and in particular is able to accurately learn a user's behaviour. These initial tests improve on existing research and may provide a useful approach in addressing this part of the insider-threat challenge.

Authors: Rashid, T; Agrafiotis, I; Nurse, J

• Publication status: Published
• Peer review status: Peer reviewed
• Publisher: Association for Computing Machinery
• Host title: 8th ACM CCS International Workshop on Managing Insider Security Threats, Vienna, Asutria, October 28-28, 2016
• Journal: 8th ACM CCS International Workshop on Managing Insider Security Threats
• Publication date: 2016-10-28
• Acceptance date: 2016-09-10
• Event location: Vienna, Austria
• DOI: 10.1145/2995959.2995964
• Keywords: machine learning; anomaly detection system; insider threat