Insight into Insiders and IT: A Survey of Insider Threat Taxonomies, Analysis, Modeling, and Countermeasures

摘要: Insider threats are one of today's most challenging cybersecurity issues that not well addressed by commonly employed security solutions. Despite several scientific works published in this domain, we argue the field can benefit from proposed structural taxonomy and novel categorization research contribute to organization disambiguation insider threat incidents defense solutions used against them. The objective our is systematize knowledge research, while leveraging existing grounded theory method for rigorous literature review. depicts workflow among particular categories include: 1) Incidents datasets, 2) Analysis attackers, 3) Simulations, 4) Defense Special attention paid definitions taxonomies threat; present a incidents, which based on 5W1H questions information gathering problem. Our survey will enhance researchers' efforts domain threat, because it provides: a) contributes orthogonal classification defining scope them, b) an updated overview publicly available datasets be test new detection other works, c) references case studies frameworks modeling insiders' behaviors purpose reviewing or extending their coverage, d) discussion trends further directions reasoning domain.