Insider attacks have become increasingly frequent and more difficult to detect. Modeling user activities to capture the temporal features and connections between activities can enhance the detection of insider threats. In this work, we present a novel insider activity modeling approach that uses effective representations of user activities to enhance the detection performance. The proposed activity modeling and detection system has been evaluated using log files from the CMU CERT r4.2 insider dataset that provides the activities of employees for eighteen working months. Our results have shown that the proposed system achieves high malicious activity identification performance with the proposed data modeling techniques.
Temporal Semantic Parsing for Insider Threat Activity Modeling and Detection
15.07.2024
983784 byte
Aufsatz (Konferenz)
Elektronische Ressource
Englisch
Grammar-Constrained Neural Semantic Parsing with LR Parsers
Deutsches Zentrum für Luft- und Raumfahrt (DLR) | 2021
|A new breed of anti-fraud software aims to curb the insider threat
British Library Online Contents | 2009
Online Contents | 2002