Visualizing the insider threat: Challenges and tools for identifying malicious user activity

Legg, Philip

Abstract

One of the greatest challenges for managing organisational cyber security is the threat that comes from those who operate within the organisation. With entitled access and knowledge of organisational processes, insiders who choose to attack have the potential to cause serious impact, such as financial loss, reputational damage, and in severe cases, could even threaten the existence of the organisation. Security analysts therefore require sophisticated tools that allow them to explore and identify user activity that could be in- dicative of an imminent threat to the organisation. In this work, we discuss the challenges associated with identifying insider threat activity, along with the tools that can help to combat this problem. We present a visual analytics approach that incorporates multiple views, including a user selection tool that indicates anomalous behaviour, an interactive Principal Component Analysis (iPCA) tool that aids the analyst to assess the reasoning behind the anomaly detection results, and an activity plot that visualizes user and role activity over time. We demonstrate our approach using the Carnegie Mellon University CERT Insider Threat Dataset to show how the visual analytics workflow supports the Information-Seeking mantra.

Citation

Legg, P. (2015, October). Visualizing the insider threat: Challenges and tools for identifying malicious user activity. Paper presented at IEEE Symposium on Visualization for Cyber Security, Chicago, Illinois, USA

• Presentation Conference Type: Conference Paper (unpublished)
• Conference Name: IEEE Symposium on Visualization for Cyber Security
• Conference Location: Chicago, Illinois, USA
• Start Date: Oct 26, 2015
• End Date: Oct 26, 2015
• Acceptance Date: Sep 1, 2015
• Publication Date: Oct 26, 2015
• Publicly Available Date: Jun 5, 2019
• Journal: IEEE Symposium on Visualization for Cyber Security
• Peer Reviewed: Peer Reviewed
• Keywords: insider threat, behavioural analysis, model visualization
• Public URL: https://uwe-repository.worktribe.com/output/804397
• Publisher URL: http://dx.doi.org/10.1109/VIZSEC.2015.7312772
• Related Public URLs: http://www.vizsec.org
• Additional Information: Title of Conference or Conference Proceedings : IEEE Symposium on Visualization for Cyber Security