Detection and prediction of insider threats to cyber security: a systematic literature review and meta-analysis

摘要: Cyber security is vital to the success of today’s digital economy. The major threats are coming from within, as opposed outside forces. Insider threat detection and prediction important mitigation techniques. This study addresses following research questions: 1) what trends in insider nowadays? 2) What challenges associated with prediction? 3) best-to-date algorithms? We conduct a systematic review 37 articles published peer-reviewed journals, conference proceedings edited books for period 1950–2015 address first two questions. Our survey suggests that game theoretic approach (GTA) popular source data; insiders’ online activities most widely used features prediction; papers use single point estimates likelihood; graph algorithms tools detecting predicting threats. key facing system include unbounded patterns, uneven time lags between activities, data nonstationarity, individuality, collusion attacks, high false alarm rates, class imbalance problem, undetected uncertainty, large number free parameters model. To identify algorithms, our meta-analysis excludes theoretical proposing conceptual selected resulting selection 13 papers. rank presented based on merits transparency information. determine significance sums, we perform “the Friedman two-way analysis variance by ranks” test “multiple comparisons groups or conditions” tests.