Insider Detection by Process Analysis

摘要: The insider threat is one of the most pernicious in computer security. Traditional approaches typically instrument systems with decoys or intrusion detection mechanisms to detect individuals who abuse their privileges (the quintessential ). Such an attack requires that these agents have access resources data order corrupt disclose them. In this work, we examine application process modeling and subsequent analyses problem. With modeling, first describe how a works formal terms. We then look at are carrying out particular tasks, perform different determine can be compromised, suggest countermeasures incorporated into model improve its resistance attack.