TY - GEN
T1 - Data-driven model-based detection of malicious insiders via physical access logs
AU - Cheh, Carmen
AU - Chen, Binbin
AU - Temple, William G.
AU - Sanders, William H.
N1 - Acknowledgements. This work was supported in part by the National Research Foundation (NRF), Prime Minister’s Office, Singapore, under its National Cybersecu-rity R&D Programme (Award No. NRF2014NCR-NCR001-31) and administered by the National Cybersecurity R&D Directorate, and supported in part by the research grant for the Human-Centered Cyber-physical Systems Programme at the Advanced Digital Sciences Center from Singapore’s Agency for Science, Technology and Research (A*STAR). This work was partly done when Carmen Cheh was a research intern at ADSC. We also want to thank the experts from SMRT Trains LTD for providing us data and domain knowledge.
PY - 2017
Y1 - 2017
N2 - The risk posed by insider threats has usually been approached by analyzing the behavior of users solely in the cyber domain. In this paper, we show the viability of using physical movement logs, collected via a building access control system, together with an understanding of the layout of the building housing the system’s assets, to detect malicious insider behavior that manifests itself in the physical domain. In particular, we propose a systematic framework that uses contextual knowledge about the system and its users, learned from historical data gathered from a building access control system, to select suitable models for representing movement behavior. We then explore the online usage of the learned models, together with knowledge about the layout of the building being monitored, to detect malicious insider behavior. Finally, we show the effectiveness of the developed framework using real-life data traces of user movement in railway transit stations.
AB - The risk posed by insider threats has usually been approached by analyzing the behavior of users solely in the cyber domain. In this paper, we show the viability of using physical movement logs, collected via a building access control system, together with an understanding of the layout of the building housing the system’s assets, to detect malicious insider behavior that manifests itself in the physical domain. In particular, we propose a systematic framework that uses contextual knowledge about the system and its users, learned from historical data gathered from a building access control system, to select suitable models for representing movement behavior. We then explore the online usage of the learned models, together with knowledge about the layout of the building being monitored, to detect malicious insider behavior. Finally, we show the effectiveness of the developed framework using real-life data traces of user movement in railway transit stations.
KW - Cyber-physical systems
KW - Insider threat
KW - Intrusion detection
KW - Physical access
KW - Physical movement
KW - User behavior
UR - https://www.scopus.com/pages/publications/85028638862
UR - https://www.scopus.com/pages/publications/85028638862#tab=citedBy
U2 - 10.1007/978-3-319-66335-7_17
DO - 10.1007/978-3-319-66335-7_17
M3 - Conference contribution
AN - SCOPUS:85028638862
SN - 9783319663340
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 275
EP - 291
BT - Quantitative Evaluation of Systems - 14th International Conference, QEST 2017, Proceedings
A2 - Bertrand, Nathalie
A2 - Bortolussi, Luca
PB - Springer
T2 - 14th International Conference on Quantitative Evaluation of Systems, QEST 2017
Y2 - 5 September 2017 through 7 September 2017
ER -