title: Specializing network analysis to detect anomalous insider actions.
abstract: Collaborative information systems (CIS) enable users to coordinate efficiently over shared tasks in complex distributed environments. For flexibility, they provide users with broad access privileges, which, as a side-effect, leave such systems vulnerable to various attacks. Some of the more damaging malicious activities stem from internal misuse, where users are authorized to access system resources. A promising class of insider threat detection models for CIS focuses on mining access patterns from audit logs, however, current models are limited in that they assume organizations have significant resources to generate label cases for training classifiers or assume the user has committed a large number of actions that deviate from "normal" behavior. In lieu of the previous assumptions, we introduce an approach that detects when specific actions of an insider deviate from expectation in the context of collaborative behavior. Specifically, in this paper, we introduce a specialized network anomaly detection model, or SNAD, to detect such events. This approach assesses the extent to which a user influences the similarity of the group of users that access a particular record in the CIS. From a theoretical perspective, we show that the proposed model is appropriate for detecting insider actions in dynamic collaborative systems. From an empirical perspective, we perform an extensive evaluation of SNAD with the access logs of two distinct environments: the patient record access logs a large electronic health record system (6,015 users, 130,457 patients and 1,327,500 accesses) and the editing logs of Wikipedia (2,394,385 revisors, 55,200 articles and 6,482,780 revisions). We compare our model with several competing methods and demonstrate SNAD is significantly more effective: on average it achieves 20-30% greater area under an ROC curve.
authors: Department of Biomedical Informatics, School of Medicine, Vanderbilt University, Nashville, TN, 37203, USA.
authors: You
authors: Y
authors: Chen
authors: Steve
authors: S
authors: Nyemba
authors: Wen
authors: W
authors: Zhang
authors: Bradley
authors: B
authors: Malin
keywords: Insider threat; access logs; anomaly detection; collaborative information system; electronic health record; specialized network
references: CODASPY. 2011;2011:63-74
references: 25485309
references: Health Aff (Millwood). 2005 Sep-Oct;24(5):1103-17
references: 16162551
references: J Am Med Inform Assoc. 2011 Jul-Aug;18(4):498-505
references: 21672912
references: ISI. 2011 Jul;2011:119-124
references: 25621314
references: J Biomed Inform. 2008 Dec;41(6):1028-40
references: 18511349
references: J Biomed Inform. 2011 Apr;44(2):333-42
references: 21277996
references: AMIA Annu Symp Proc. 2008 Nov 06;:874
references: 18998818
references: J Med Syst. 2006 Jun;30(3):159-68
references: 16848129
references: IEEE Trans Vis Comput Graph. 2010 Mar-Apr;16(2):178-91
references: 20075480
references: IEEE Secur Priv. 2011;9(5):48-55
references: 22034582