Human-Machine Decision Support Systems for Insider Threat Detection

摘要: Insider threats are recognised to be quite possibly the most damaging attacks that an organisation could experience. Those on inside, who have privileged access and knowledge, already in a position of great responsibility for contributing towards security operations organisation. Should individual choose exploit this privilege, perhaps due disgruntlement or external coercion from competitor, then potential impact can extremely damaging. There many proposals using machine learning anomaly detection techniques as means automated decision-making about which insiders acting suspicious malicious manner, form large scale data analytics. However, it is well poses challenges, example, how do we capture accurate representation normality assess against, within dynamic ever-changing organisation? More recently, there has been interest visual analytics incorporated with machine-based approaches, alleviate challenges support human reasoning through interactive interfaces. Furthermore, by combining active learning, capability analysts impart their domain expert knowledge back system, so iteratively improve decisions based analyst preferences. With combined human-machine approach threats, system begin more accurately rationale decision process, reduce false positives flagged system. In work, I reflect insider threat detection, look systems offer solutions this.