Skip to main content

Research Repository

Advanced Search

Visualizing the insider threat: Challenges and tools for identifying malicious user activity

Legg, Philip

Visualizing the insider threat: Challenges and tools for identifying malicious user activity Thumbnail


Authors



Abstract

One of the greatest challenges for managing organisational cyber security is the threat that comes from those who operate within the organisation. With entitled access and knowledge of organisational processes, insiders who choose to attack have the potential to cause serious impact, such as financial loss, reputational damage, and in severe cases, could even threaten the existence of the organisation. Security analysts therefore require sophisticated tools that allow them to explore and identify user activity that could be in- dicative of an imminent threat to the organisation. In this work, we discuss the challenges associated with identifying insider threat activity, along with the tools that can help to combat this problem. We present a visual analytics approach that incorporates multiple views, including a user selection tool that indicates anomalous behaviour, an interactive Principal Component Analysis (iPCA) tool that aids the analyst to assess the reasoning behind the anomaly detection results, and an activity plot that visualizes user and role activity over time. We demonstrate our approach using the Carnegie Mellon University CERT Insider Threat Dataset to show how the visual analytics workflow supports the Information-Seeking mantra.

Presentation Conference Type Conference Paper (unpublished)
Conference Name IEEE Symposium on Visualization for Cyber Security
Start Date Oct 26, 2015
End Date Oct 26, 2015
Acceptance Date Sep 1, 2015
Publication Date Oct 26, 2015
Publicly Available Date Jun 5, 2019
Journal IEEE Symposium on Visualization for Cyber Security
Peer Reviewed Peer Reviewed
Keywords insider threat, behavioural analysis, model visualization
Public URL https://uwe-repository.worktribe.com/output/804397
Publisher URL http://dx.doi.org/10.1109/VIZSEC.2015.7312772
Related Public URLs http://www.vizsec.org
Additional Information Title of Conference or Conference Proceedings : IEEE Symposium on Visualization for Cyber Security

Files





You might also like



Downloadable Citations