Detection of anomalous insiders in collaborative environments via relational analysis of access logs

摘要: Collaborative information systems (CIS) are deployed within a diverse array of environments, ranging from the Internet to intelligence agencies healthcare. It is increasingly case that such applied manage sensitive information, making them targets for malicious insiders. While sophisticated security mechanisms have been developed detect insider threats in various file systems, they neither designed model nor monitor collaborative environments which users function dynamic teams with complex behavior. In this paper, we introduce community-based anomaly detection system (CADS), an unsupervised learning framework based on recorded access logs environments. CADS observation typical tend form community structures, low affinity communities indicative anomalous and potentially illicit The consists two primary components: relational pattern extraction detection. For extraction, infers structures CIS logs, subsequently derives communities, serve as core. then uses formal statistical measure deviation inferred predict anomalies. To empirically evaluate threat model, perform analysis six months real electronic health record large medical center, well publicly available dataset replication purposes. results illustrate can distinguish simulated context user behavior high degree certainty significant performance gains comparison several competing models.