Distance Measurement Methods for Improved Insider Threat Detection

Lo, Owen; Buchanan, William J.; Griffiths, Paul; Macfarlane, Richard

Abstract

Insider threats are a considerable problem within cyber security and it is often difficult to detect these threats using signature detection. Increasing machine learning can provide a solution, but these methods often fail to take into account changes of behaviour of users. This work builds on a published method of detecting insider threats and applies Hidden Markov method on a CERT data set (CERT r4.2) and analyses a number of distance vector methods (Damerau–Levenshtein Distance, Cosine Distance, and Jaccard Distance) in order to detect changes of behaviour, which are shown to have success in determining different insider threats.

Citation

Lo, O., Buchanan, W. J., Griffiths, P., & Macfarlane, R. (2018). Distance Measurement Methods for Improved Insider Threat Detection. Security and Communication Networks, 2018, 1-18. https://doi.org/10.1155/2018/5906368

• Journal Article Type: Article
• Acceptance Date: Dec 13, 2017
• Online Publication Date: Jan 17, 2018
• Publication Date: 2018
• Deposit Date: Jan 5, 2018
• Publicly Available Date: Jul 25, 2019
• Journal: Society and Communication Networks
• Print ISSN: 1939-0114
• Electronic ISSN: 1939-0122
• Publisher: Wiley
• Peer Reviewed: Peer Reviewed
• Volume: 2018
• Pages: 1-18
• DOI: https://doi.org/10.1155/2018/5906368
• Keywords: Insider threat, distance measurement,
• Public URL: http://researchrepository.napier.ac.uk/Output/1023221
• Contract Date: Jan 5, 2018