SlideShare a Scribd company logo

Machine Introduce for Beginner 5000-1222.ppt

Download as PPT, PDF
H
HafizulHassan9

Machine

Engineering
1 of 19
Download to read offline
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
www.syrres.com Copyright © 2004 A Multi-Disciplinary Approach for A Multi-Disciplinary Approach for Countering Insider Threats Countering Insider Threats Secure Knowledge Management (SKM 2004) September 23-24, 2004 Marriott Buffalo-Niagara Amherst, NY USA Robert DelZoppo, Eric Brown, Matt Downey: Syracuse Research Corporation Michael D’Eredita, Elizabeth D. Liddy, Joon S. Park, Anand Natarajan, Svetlana Symonenko, Shuyuan M. Ho : Syracuse University
www.syrres.com 2 Copyright © 2004 Insider Threat Mission-critical information = High-value target Threatens US Intelligence Community (IC), other Government organizations and large corporations Probability is low, but impact is severe Types of Threat posed by malicious insiders • Denial of service • Compromise of confidentiality • Compromise of integrity High complexity of problem • Increase in sharing of information, knowledge • Increased availability of corporate knowledge online • “Low and Slow” nature of malicious insiders
www.syrres.com 3 Copyright © 2004 Brian Patrick Regan: (1999-2001) •Compromise: Removed and hid over 800 pages of classified material, email contact to leaders in Iraq, Libya, and China •Impact: •Suspected acquisition of classified imagery and reports to Iraq •Cyber Activities: •Frequent need-to-know “violations” •High volume printing; Encrypted emails Robert Hanson: (1985-2001) •Compromise: Exfiltrated over 6000 pages of classified material •Impact: •Divulged Intel capabilities of FBI and other agencies •Identified three Soviet double agents (1 imprisoned, 2 killed) •Cyber Activities: •Frequent need-to-know “violations” •Frequent queries looking for signs of an investigation targeting him Malicious Insider, examples
www.syrres.com 4 Copyright © 2004 Characteristics of Malicious Insider Behavior (current, projected) Technically competent to highly-skilled Attempts to cover up, destroy evidence Sophisticated search / query techniques Abuses security clearance to gain access to information (violates “need to know”) Downloads data to new devices (e.g., USB thumb drive) Encrypts data Changes system logs to hide activity Uses “stealthy” techniques to communicate with handlers (e.g., encrypted email)
www.syrres.com 5 Copyright © 2004 Approach Staged: Detect anomalies in user behavior from cyber observables and, based on these anomalies, assess the risk of malicious insider behavior Multi-Perspective: Detect anomalies in user behavior considering user-to-user, user-to-content, user-to-resource relationships Multi-Disciplinary: • Social Network Analysis (SNA) - Apply concepts from SNA to detect anomalies in social behavior [user-to-user] • Semantic Analysis (SA)- Leverage Natural Language Processing (NLP) and machine learning techniques to analyze the textual data associated with insiders at a semantic (conceptual) level [user-to-content] • Composite, Role-based Monitoring (CRBM) – Analyze insider activity based on the organizational, application and operating system roles. [user- to-resource]
www.syrres.com 6 Copyright © 2004 Research Objectives Advance the state-of-art in Insider Threat Countermeasures by developing techniques to: • Model behavior of insiders operating in an IC-based context • Distinguish between expected and anomalous user behavior • Detect indicators of malicious insider behavior (MIB) • Assess indicators of MIB for potential threat to the confidentiality and integrity of information. To reduce the overall effort in countering threat from malicious insiders: • Reduce the size of the problem space to a manageable number of indicators a system security / assurance administrator would need to look at • Provide early awareness of risk elevating situations
www.syrres.com 7 Copyright © 2004 Research Objectives, cont’d Has Breadth Incorporates a wide range of observable types and can assess multiple types of risk Has depth Can analyze observables at fine-grained levels (e.g., semantics) Is scalable Can model behavior at multiple levels (e.g., insider, role) and is minimally impacted as # of insiders increases Is extensible Can be extended to incorporate new threat scenarios and other sources of indicators (e.g., anomaly detectors) Is reusable Modules could be reused in another system or context To provide a robust solution which:
www.syrres.com 8 Copyright © 2004 Assumptions Insiders with similar roles, goals and tasks will have similar behavior. Malicious insider behavior will differ, to a measurable degree, from behavior of typical insiders. Insiders’ actual behavior will be discernable through cyber-observations from sensors which currently exist or could be constructed. Anomaly-based or signature-based methods, by themselves, are insufficient for identification of Insider Threats.
www.syrres.com 9 Copyright © 2004 Approach/Methodology Expected Behavior Model communicate - Analyst search - information container consume - information instance Analyst send information instance - Analyst Insider receive collaboration request - Analyst communicate - Analyst search - information container consume - information instance Linguist send information instance - Analyst receive collaboration request - Analyst communicate - Analyst search - information container consume - information instance Subject Matter Expert send information instance - Analyst receive collaboration request - Analyst •Hierarchically organized by role/goal/task (RGT) •Allows for computation of non-deterministic behavior (e.g., multitasking) •Provides scoping mechanism •Can be used for both pattern matching and data generation Analyze Collect communicate - SME receive collection request - CRM launch - search application launch - search application launch – analysis application search - information container communicate - collection manager consume - information instance communicate - senior reporter communicate - senior reporter effect - $doc: information instance search - information container communicate - SME communicate - linguist Report Analyst communicate - senior reporter communicate - senior reporter communicate - senior reporter Collect Analyze Question communicate - SME communicate - CRM send collaboration request - SME receive collection request - CRM launch - search application search - information container search - information container communicate - collection manager request collection - collection manager communicate - collection manager consume - information instance consume - information instance Review Available Data Request Collection
www.syrres.com 10 Copyright © 2004 Approach/Methodology: Risk Assessment Observables Anomalies Indicators Risk “collector” behavior pattern Confidentiality compromise (High) atypical access to system high-degree of off-topic consumption low-degree of expected interaction Risk is identified as indicators are asserted; indicators are asserted from the anomalies detected
www.syrres.com 11 Copyright © 2004 System Overview Expected Behavior Model Observable Activity Risks & Alerts Risk Assessor Social Network Analysis Semantic Analysis Composite Role-Based Analysis Anomaly Detectors black boxed sensor input such as: •web logs •print logs •email monitors •phone logs •system access logs •Host sensor logs •card key readers •etc.
www.syrres.com 12 Copyright © 2004 Current Work: Relational Matrix Analysis Tool (user-to-user, user-to-resource)  Generate Relational Matrices • Based on insider (constrained by RGT) versus a hierarchy of resources, goals, and interaction methods • Comparison level: specific (explicit resource) or generic (resource type)  Perform Outlier Analysis Relational Matrix Analysis Tool Insider Restrictions: role, TOI, AOI, task Resource Restrictions: TOI, AOI, task Method Restrictions Insider vs. Resource Matrix Outlier Indicators and Analysis Observables (from Scenario) <Observable> <Name>Terry</Name> <Role>analyst</Role> <Toi>Biological Weapons</Toi> <Aoi>Russia</Aoi> <Task>Report</Task> <Method>leave VM</Method> <ResourceLabel>Smith</ResourceLabel> <ResourceType>senior reporter</ResourceType> <Time>1071032734</Time> </Observable> Given:  Observables  Method Restrictions  Insider Restrictions  Resource Restrictions
www.syrres.com 13 Copyright © 2004 Current Work: Semantic Analyses (user-to-content) Document clustering, based on geographic area-of-interest
www.syrres.com 14 Copyright © 2004 Current Work: Semantic Analyses (user-to-content) Document clustering, based on topic-of-interest
www.syrres.com 15 Copyright © 2004 System Architecture Observable Archive Expected Behavior Model Risk Assessor XML interface COTS R&D Leverage ARDA Risk Policy Scenario Generator CPN Tools IC Workflow Model Social Network Monitor JUNG Semantic Analysis Monitor CNLP Technology Composite Role-based Monitor Risk Assessment Display i2 Analyst Notebook MS Excel Controller / Rule Engine JESS Document Collection Document Collection Role-based Research
www.syrres.com 16 Copyright © 2004 Scalability of Solution High Scalability / Extensibility • Other anomaly detectors can be added to provide additional indicators • Risk Assessment Policy provides a means for writing new rules and sets of rules Generalizability • Methodology provides abstraction mechanisms for managing complexity • Approach can be generalized to other domains Reusability / Interoperability • Anomaly detectors can provide indicators to other types of systems • XML-based interfaces – provide “loose” couplings between modules
www.syrres.com 17 Copyright © 2004 Limitations/Vulnerabilities Non-cyber activities • Mitigation: Security Administrator Application for entering / managing non-cyber indicators Undetected cyber observables: • Most non-textual media (Images, Audio, Video) » Example: Communications analyst inappropriately retrieving images unrelated to task » Mitigation: Analyze image meta-data to provide basic analysis of image content • Anonymous user behavior – Guest, and other potentially anonymous activities such as access through web-based applications » Mitigation: Can still monitor to identify risk • Account “masquerading” » Mitigation: Focus on individual insiders; detect shifts in behavior
www.syrres.com 18 Copyright © 2004 Summary Currently under experimentation using controlled simulation with synthetic data sets (scenarios): • Baseline scenario – observables under normal conditions • “Threat” scenarios – baseline scenario with anomaly injection • Includes supporting UNCLASSIFIED document collections on a variety of topics (e.g., Terrorism/WMD) Preliminary results indicate • Role-Goal-Task-orientation of Expected Behavior Model provides a basis for modeling context-dependent behavior • Relational Matrix approach very well suited to anomaly detection in entity-to-entity interaction • Semantic Analysis approach works well to identify off-topic information access
www.syrres.com 19 Copyright © 2004 Acknowledgements Advanced Research and Development Activity (ARDA) Advanced Countermeasures for Insider Threat (ACIT) Program (sponsor) Other ARDA Programs • Cyber Indications & Warning (CIW) Workshop (MITRE, Aug 03) • Advanced Question & Answering for Intelligence (AQUAINT) • Novel Intelligence from Massive Data (NIMD) Mitigating the Insider Threat to Information Systems - #2; Workshop Proceedings (RAND, Aug 00)

More Related Content

PDF
Automatic Insider Threat Detection in E-mail System using N-gram Technique
IRJET Journal
 
PDF
Anomaly Threat Detection System using User and Role-Based Profile Assessment
ijtsrd
 
PDF
System Dynamics Based Insider Threats Modeling
IJNSA Journal
 
PDF
Insider Threat Detection Recommendations
AlienVault
 
PPTX
insider threat research
Asma Al-maskaria
 
PPTX
Insider Threats Detection in Cloud using UEBA
Lucas Ko
 
PPT
ch20uejdudyujdhjeo8jshbrujsjuukpsnnue.ppt
asjadzaki2021
 
PDF
IQ4 Final Presentation (1)
Chathura Wickramage
 
Automatic Insider Threat Detection in E-mail System using N-gram Technique
IRJET Journal
 
Anomaly Threat Detection System using User and Role-Based Profile Assessment
ijtsrd
 
System Dynamics Based Insider Threats Modeling
IJNSA Journal
 
Insider Threat Detection Recommendations
AlienVault
 
insider threat research
Asma Al-maskaria
 
Insider Threats Detection in Cloud using UEBA
Lucas Ko
 
ch20uejdudyujdhjeo8jshbrujsjuukpsnnue.ppt
asjadzaki2021
 
IQ4 Final Presentation (1)
Chathura Wickramage
 

Similar to Machine Introduce for Beginner 5000-1222.ppt (20)

PDF
Ht t17
SelectedPresentations
 
PPTX
Assessing Quality in Cyber Risk Forecasting
Jack Freund, PhD
 
PDF
SplunkLive! Stockholm 2015 breakout - Analytics based security
Splunk
 
PDF
SplunkLive! Amsterdam 2015 - Analytics based security breakout
Splunk
 
PDF
CNIT 50: 9. NSM Operations
Sam Bowne
 
DOCX
Presented at the University of Louisville Cyber Securitys Day,.docx
ChantellPantoja184
 
PDF
Ch11 NetSec5e_Intruders and intruderssss
sumit621242
 
PPT
Accidental Insider
Barry Caplin
 
PPTX
IBM QRadar UBA
IBM Security
 
PDF
[Bucharest] Attack is easy, let's talk defence
OWASP EEE
 
PDF
SplunkLive Wellington 2015 - Splunk for Security
Splunk
 
PDF
SplunkLive Auckland 2015 - Splunk for Security
Splunk
 
PDF
Splunk for Security
Gabrielle Knowles
 
PPTX
The Insider Threat January.pptx
BertrandRussell6
 
PPT
Chapter No 20- Network and Security-by-MIT.ppt
KamranHussainAwan
 
PDF
Webinar: Get Ready to Detect, Respond & Recover from a Cyber Attack
Aujas
 
PPTX
3.IS@Mohsin.pptx,.,,........,.............
salmannawaz6566504
 
PPTX
Insider threat v3
Lancope, Inc.
 
PPT
Firewalls in cryptography
T7Unknown
 
PPTX
ASIS NYC InT Presentation
Daniel McGarvey
 
Ht t17
SelectedPresentations
 
Assessing Quality in Cyber Risk Forecasting
Jack Freund, PhD
 
SplunkLive! Stockholm 2015 breakout - Analytics based security
Splunk
 
SplunkLive! Amsterdam 2015 - Analytics based security breakout
Splunk
 
CNIT 50: 9. NSM Operations
Sam Bowne
 
Presented at the University of Louisville Cyber Securitys Day,.docx
ChantellPantoja184
 
Ch11 NetSec5e_Intruders and intruderssss
sumit621242
 
Accidental Insider
Barry Caplin
 
IBM QRadar UBA
IBM Security
 
[Bucharest] Attack is easy, let's talk defence
OWASP EEE
 
SplunkLive Wellington 2015 - Splunk for Security
Splunk
 
SplunkLive Auckland 2015 - Splunk for Security
Splunk
 
Splunk for Security
Gabrielle Knowles
 
The Insider Threat January.pptx
BertrandRussell6
 
Chapter No 20- Network and Security-by-MIT.ppt
KamranHussainAwan
 
Webinar: Get Ready to Detect, Respond & Recover from a Cyber Attack
Aujas
 
3.IS@Mohsin.pptx,.,,........,.............
salmannawaz6566504
 
Insider threat v3
Lancope, Inc.
 
Firewalls in cryptography
T7Unknown
 
ASIS NYC InT Presentation
Daniel McGarvey
 
Ad

Recently uploaded (20)

PDF
Categorization of Factors Affecting Classification Algorithms Selection
IJDKP
 
PDF
Artificial Superintelligence (ASI) Alliance Vision Paper.pdf
SonaliPatil325517
 
PPTX
M Tech Sem 1 Civil Engineering Environmental Sciences.pptx
ShriNRPrasad
 
PPTX
Infosys Presentation by1.Riyan Bagwan 2.Samadhan Naiknavare 3.Gaurav Shinde 4...
bapushinde7218
 
PPTX
UNIT 4 Total Quality Management .pptx
gokuld13012005
 
PPT
introduction to datamining and warehousing
ssuser4ab3a2
 
PPTX
Current and future trends in Computer Vision.pptx
Subramanyam Natarajan
 
PDF
A SYSTEMATIC REVIEW OF APPLICATIONS IN FRAUD DETECTION
IJNSA Journal
 
PDF
PREDICTION OF DIABETES FROM ELECTRONIC HEALTH RECORDS
ijaia
 
PPTX
FINAL REVIEW FOR COPD DIANOSIS FOR PULMONARY DISEASE.pptx
rubeshbme
 
PDF
BIO-INSPIRED HORMONAL MODULATION AND ADAPTIVE ORCHESTRATION IN S-AI-GPT
ijaia
 
PPT
Introduction, IoT Design Methodology, Case Study on IoT System for Weather Mo...
MariaRufina4
 
PPTX
6ME3A-Unit-II-Sensors and Actuators_Handouts.pptx
anukaranugi
 
PPTX
Artificial Intelligence
dikshendrasarpate2
 
PPTX
Safety Seminar civil to be ensured for safe working.
DILJEETKUMAR8
 
PDF
Automation-in-Manufacturing-Chapter-Introduction.pdf
pcmth867
 
PPT
Project quality management in manufacturing
BarMusaTetik
 
PPTX
Fundamentals of Mechanical Engineering.pptx
MdMowdudAhmed
 
PDF
Mitigating Risks through Effective Management for Enhancing Organizational Pe...
IJAEMSJORNAL
 
PDF
Level 2 – IBM Data and AI Fundamentals (1)_v1.1.PDF
KSRIHARISASANKA
 
Categorization of Factors Affecting Classification Algorithms Selection
IJDKP
 
Artificial Superintelligence (ASI) Alliance Vision Paper.pdf
SonaliPatil325517
 
M Tech Sem 1 Civil Engineering Environmental Sciences.pptx
ShriNRPrasad
 
Infosys Presentation by1.Riyan Bagwan 2.Samadhan Naiknavare 3.Gaurav Shinde 4...
bapushinde7218
 
UNIT 4 Total Quality Management .pptx
gokuld13012005
 
introduction to datamining and warehousing
ssuser4ab3a2
 
Current and future trends in Computer Vision.pptx
Subramanyam Natarajan
 
A SYSTEMATIC REVIEW OF APPLICATIONS IN FRAUD DETECTION
IJNSA Journal
 
PREDICTION OF DIABETES FROM ELECTRONIC HEALTH RECORDS
ijaia
 
FINAL REVIEW FOR COPD DIANOSIS FOR PULMONARY DISEASE.pptx
rubeshbme
 
BIO-INSPIRED HORMONAL MODULATION AND ADAPTIVE ORCHESTRATION IN S-AI-GPT
ijaia
 
Introduction, IoT Design Methodology, Case Study on IoT System for Weather Mo...
MariaRufina4
 
6ME3A-Unit-II-Sensors and Actuators_Handouts.pptx
anukaranugi
 
Artificial Intelligence
dikshendrasarpate2
 
Safety Seminar civil to be ensured for safe working.
DILJEETKUMAR8
 
Automation-in-Manufacturing-Chapter-Introduction.pdf
pcmth867
 
Project quality management in manufacturing
BarMusaTetik
 
Fundamentals of Mechanical Engineering.pptx
MdMowdudAhmed
 
Mitigating Risks through Effective Management for Enhancing Organizational Pe...
IJAEMSJORNAL
 
Level 2 – IBM Data and AI Fundamentals (1)_v1.1.PDF
KSRIHARISASANKA
 
Ad

Machine Introduce for Beginner 5000-1222.ppt

  • 1. www.syrres.com Copyright © 2004 A Multi-Disciplinary Approach for A Multi-Disciplinary Approach for Countering Insider Threats Countering Insider Threats Secure Knowledge Management (SKM 2004) September 23-24, 2004 Marriott Buffalo-Niagara Amherst, NY USA Robert DelZoppo, Eric Brown, Matt Downey: Syracuse Research Corporation Michael D’Eredita, Elizabeth D. Liddy, Joon S. Park, Anand Natarajan, Svetlana Symonenko, Shuyuan M. Ho : Syracuse University
  • 2. www.syrres.com 2 Copyright © 2004 Insider Threat Mission-critical information = High-value target Threatens US Intelligence Community (IC), other Government organizations and large corporations Probability is low, but impact is severe Types of Threat posed by malicious insiders • Denial of service • Compromise of confidentiality • Compromise of integrity High complexity of problem • Increase in sharing of information, knowledge • Increased availability of corporate knowledge online • “Low and Slow” nature of malicious insiders
  • 3. www.syrres.com 3 Copyright © 2004 Brian Patrick Regan: (1999-2001) •Compromise: Removed and hid over 800 pages of classified material, email contact to leaders in Iraq, Libya, and China •Impact: •Suspected acquisition of classified imagery and reports to Iraq •Cyber Activities: •Frequent need-to-know “violations” •High volume printing; Encrypted emails Robert Hanson: (1985-2001) •Compromise: Exfiltrated over 6000 pages of classified material •Impact: •Divulged Intel capabilities of FBI and other agencies •Identified three Soviet double agents (1 imprisoned, 2 killed) •Cyber Activities: •Frequent need-to-know “violations” •Frequent queries looking for signs of an investigation targeting him Malicious Insider, examples
  • 4. www.syrres.com 4 Copyright © 2004 Characteristics of Malicious Insider Behavior (current, projected) Technically competent to highly-skilled Attempts to cover up, destroy evidence Sophisticated search / query techniques Abuses security clearance to gain access to information (violates “need to know”) Downloads data to new devices (e.g., USB thumb drive) Encrypts data Changes system logs to hide activity Uses “stealthy” techniques to communicate with handlers (e.g., encrypted email)
  • 5. www.syrres.com 5 Copyright © 2004 Approach Staged: Detect anomalies in user behavior from cyber observables and, based on these anomalies, assess the risk of malicious insider behavior Multi-Perspective: Detect anomalies in user behavior considering user-to-user, user-to-content, user-to-resource relationships Multi-Disciplinary: • Social Network Analysis (SNA) - Apply concepts from SNA to detect anomalies in social behavior [user-to-user] • Semantic Analysis (SA)- Leverage Natural Language Processing (NLP) and machine learning techniques to analyze the textual data associated with insiders at a semantic (conceptual) level [user-to-content] • Composite, Role-based Monitoring (CRBM) – Analyze insider activity based on the organizational, application and operating system roles. [user- to-resource]
  • 6. www.syrres.com 6 Copyright © 2004 Research Objectives Advance the state-of-art in Insider Threat Countermeasures by developing techniques to: • Model behavior of insiders operating in an IC-based context • Distinguish between expected and anomalous user behavior • Detect indicators of malicious insider behavior (MIB) • Assess indicators of MIB for potential threat to the confidentiality and integrity of information. To reduce the overall effort in countering threat from malicious insiders: • Reduce the size of the problem space to a manageable number of indicators a system security / assurance administrator would need to look at • Provide early awareness of risk elevating situations
  • 7. www.syrres.com 7 Copyright © 2004 Research Objectives, cont’d Has Breadth Incorporates a wide range of observable types and can assess multiple types of risk Has depth Can analyze observables at fine-grained levels (e.g., semantics) Is scalable Can model behavior at multiple levels (e.g., insider, role) and is minimally impacted as # of insiders increases Is extensible Can be extended to incorporate new threat scenarios and other sources of indicators (e.g., anomaly detectors) Is reusable Modules could be reused in another system or context To provide a robust solution which:
  • 8. www.syrres.com 8 Copyright © 2004 Assumptions Insiders with similar roles, goals and tasks will have similar behavior. Malicious insider behavior will differ, to a measurable degree, from behavior of typical insiders. Insiders’ actual behavior will be discernable through cyber-observations from sensors which currently exist or could be constructed. Anomaly-based or signature-based methods, by themselves, are insufficient for identification of Insider Threats.
  • 9. www.syrres.com 9 Copyright © 2004 Approach/Methodology Expected Behavior Model communicate - Analyst search - information container consume - information instance Analyst send information instance - Analyst Insider receive collaboration request - Analyst communicate - Analyst search - information container consume - information instance Linguist send information instance - Analyst receive collaboration request - Analyst communicate - Analyst search - information container consume - information instance Subject Matter Expert send information instance - Analyst receive collaboration request - Analyst •Hierarchically organized by role/goal/task (RGT) •Allows for computation of non-deterministic behavior (e.g., multitasking) •Provides scoping mechanism •Can be used for both pattern matching and data generation Analyze Collect communicate - SME receive collection request - CRM launch - search application launch - search application launch – analysis application search - information container communicate - collection manager consume - information instance communicate - senior reporter communicate - senior reporter effect - $doc: information instance search - information container communicate - SME communicate - linguist Report Analyst communicate - senior reporter communicate - senior reporter communicate - senior reporter Collect Analyze Question communicate - SME communicate - CRM send collaboration request - SME receive collection request - CRM launch - search application search - information container search - information container communicate - collection manager request collection - collection manager communicate - collection manager consume - information instance consume - information instance Review Available Data Request Collection
  • 10. www.syrres.com 10 Copyright © 2004 Approach/Methodology: Risk Assessment Observables Anomalies Indicators Risk “collector” behavior pattern Confidentiality compromise (High) atypical access to system high-degree of off-topic consumption low-degree of expected interaction Risk is identified as indicators are asserted; indicators are asserted from the anomalies detected
  • 11. www.syrres.com 11 Copyright © 2004 System Overview Expected Behavior Model Observable Activity Risks & Alerts Risk Assessor Social Network Analysis Semantic Analysis Composite Role-Based Analysis Anomaly Detectors black boxed sensor input such as: •web logs •print logs •email monitors •phone logs •system access logs •Host sensor logs •card key readers •etc.
  • 12. www.syrres.com 12 Copyright © 2004 Current Work: Relational Matrix Analysis Tool (user-to-user, user-to-resource)  Generate Relational Matrices • Based on insider (constrained by RGT) versus a hierarchy of resources, goals, and interaction methods • Comparison level: specific (explicit resource) or generic (resource type)  Perform Outlier Analysis Relational Matrix Analysis Tool Insider Restrictions: role, TOI, AOI, task Resource Restrictions: TOI, AOI, task Method Restrictions Insider vs. Resource Matrix Outlier Indicators and Analysis Observables (from Scenario) <Observable> <Name>Terry</Name> <Role>analyst</Role> <Toi>Biological Weapons</Toi> <Aoi>Russia</Aoi> <Task>Report</Task> <Method>leave VM</Method> <ResourceLabel>Smith</ResourceLabel> <ResourceType>senior reporter</ResourceType> <Time>1071032734</Time> </Observable> Given:  Observables  Method Restrictions  Insider Restrictions  Resource Restrictions
  • 13. www.syrres.com 13 Copyright © 2004 Current Work: Semantic Analyses (user-to-content) Document clustering, based on geographic area-of-interest
  • 14. www.syrres.com 14 Copyright © 2004 Current Work: Semantic Analyses (user-to-content) Document clustering, based on topic-of-interest
  • 15. www.syrres.com 15 Copyright © 2004 System Architecture Observable Archive Expected Behavior Model Risk Assessor XML interface COTS R&D Leverage ARDA Risk Policy Scenario Generator CPN Tools IC Workflow Model Social Network Monitor JUNG Semantic Analysis Monitor CNLP Technology Composite Role-based Monitor Risk Assessment Display i2 Analyst Notebook MS Excel Controller / Rule Engine JESS Document Collection Document Collection Role-based Research
  • 16. www.syrres.com 16 Copyright © 2004 Scalability of Solution High Scalability / Extensibility • Other anomaly detectors can be added to provide additional indicators • Risk Assessment Policy provides a means for writing new rules and sets of rules Generalizability • Methodology provides abstraction mechanisms for managing complexity • Approach can be generalized to other domains Reusability / Interoperability • Anomaly detectors can provide indicators to other types of systems • XML-based interfaces – provide “loose” couplings between modules
  • 17. www.syrres.com 17 Copyright © 2004 Limitations/Vulnerabilities Non-cyber activities • Mitigation: Security Administrator Application for entering / managing non-cyber indicators Undetected cyber observables: • Most non-textual media (Images, Audio, Video) » Example: Communications analyst inappropriately retrieving images unrelated to task » Mitigation: Analyze image meta-data to provide basic analysis of image content • Anonymous user behavior – Guest, and other potentially anonymous activities such as access through web-based applications » Mitigation: Can still monitor to identify risk • Account “masquerading” » Mitigation: Focus on individual insiders; detect shifts in behavior
  • 18. www.syrres.com 18 Copyright © 2004 Summary Currently under experimentation using controlled simulation with synthetic data sets (scenarios): • Baseline scenario – observables under normal conditions • “Threat” scenarios – baseline scenario with anomaly injection • Includes supporting UNCLASSIFIED document collections on a variety of topics (e.g., Terrorism/WMD) Preliminary results indicate • Role-Goal-Task-orientation of Expected Behavior Model provides a basis for modeling context-dependent behavior • Relational Matrix approach very well suited to anomaly detection in entity-to-entity interaction • Semantic Analysis approach works well to identify off-topic information access
  • 19. www.syrres.com 19 Copyright © 2004 Acknowledgements Advanced Research and Development Activity (ARDA) Advanced Countermeasures for Insider Threat (ACIT) Program (sponsor) Other ARDA Programs • Cyber Indications & Warning (CIW) Workshop (MITRE, Aug 03) • Advanced Question & Answering for Intelligence (AQUAINT) • Novel Intelligence from Massive Data (NIMD) Mitigating the Insider Threat to Information Systems - #2; Workshop Proceedings (RAND, Aug 00)