Improving the method of detecting insider attacks on the organization's information resources

Abstract

The article deals with the problem of detecting insider attacks on the organization's information resources. This article is a continuation of the authors' publication, which proposed a method for detecting malicious activity based on the statistical measure IDF (Inverse Document Frequency) and calculating the cosine similarity of two vector assets. The authors show that this similarity-based approach works well in organizations where employees' access rights to the organization's information resources do not overlap. However, in the case of using shared resources or masking the activity of an insider, this approach is not very effective. The authors of the article propose an improved method, the difference of which is the presence of two matrices: the matrix of permissions and the matrix of real access. The difference of such matrices expressed as a percentage of the user's total access to information assets makes it possible to calculate a measure of the user's malicious activity. Input data for the technique is information from IDS intrusion detection systems. The simulation results based on the given examples show that the improved method is more adequate compared to the cosine similarity method, which makes it possible to use it in a wide range of applications. The method allows you to determine the abnormal activity of users in the organization, which makes it possible to detect insider attacks at an early stage. The method can be used by information security administrators for further analysis of user activity.

Keywords

• eol>information asset
• information resource
• insider
• abnormal user behavior
• cosine similarity 1

1. Introduction

information systems of organizations by identifying and solving anomalies in their interaction with users.

2. Problem statement

The general problem of identifying anomalies in the interaction of users with the organization's information resources is that this task is complex and requires an integrated approach due to several key reasons: • • • • • •

Variety of Anomalies: Anomalous user behavior can take many forms, including unusual patterns of information access, unusual activity, unauthorized access attempts, or insider threats. The diversity of these anomalies makes their detection difficult.

Volume of data: Organizations have huge volumes of data generated as a result of user interaction with information systems. Analyzing these large volumes of data to detect anomalies requires powerful processing and analysis tools.

Dynamics of change: User behavior and the structure of information systems can change over time. What was normal yesterday may become an anomaly today. You need a system that can adapt to changes in the environment.

Data heterogeneity: User interaction data can be presented in different formats and sources. Combining them and processing them to detect anomalies can be difficult due to differences in data structures and types.

Need for accuracy: Anomaly detection requires high accuracy because misinterpretation can lead to misclassification of normal behavior as abnormal or vice versa.

Ensuring privacy: When detecting anomalies, the confidentiality and privacy of user data must be preserved, which can make it difficult to implement some analysis methods.

Since these problems are complex and diverse, the detection of anomalies in the interaction of users with information resources requires the use of various methods of data analysis, machine learning, and the development of specialized systems to effectively solve this problem.

3. Related works overview

Anomaly detection is a direction that is becoming more and more relevant every year. There are various ways of detecting anomalies in the activity of information system users. Most of them are based on the analysis of various technical indicators, such as network activity, use of peripheral devices, system load, intensity of interaction with information systems, etc.

In the article [ 1 ], we investigated the intrusion detection method based on the calculation of the similarity of user actions. The disadvantage of the previous study is that, despite its advantages, the proposed method is poorly protected against deception by unscrupulous users, as it is based on the calculation of the similarity coefficient of the user's actions using cosine similarity. This approach allows the attacker to easily imitate loyal activity, thereby leveling off his malicious activity. Our other paper [ 2 ] investigates the detection of insider attacks based on the time parameters of the protection system. In this publication, we conclude that detection of such an attack is possible only when the defense system is able to react faster than the attacker.

The article [ 3 ] provides a comprehensive review of the existing literature, which examines recent advances in anomaly detection methods for detecting security threats in cyber-physical systems. The authors analyze 296 articles devoted to the detection of anomalies and identify the shortcomings of various detection methods, including: limited resources, lack of standardized communication protocols, heterogeneity of technologies and protection systems, different information security policies. The authors of the article [ 4 ] propose approaches to the classification of anomaly detection methods in modern attack detection systems. It is shown that the methods of detecting anomalies in modern attack detection systems are not sufficiently elaborated in terms of the formal attack model, and, therefore, it is quite difficult for them to strictly evaluate such properties as computational complexity, correctness, and completeness.

The authors of the publication [5] evaluate anomaly detection methods based on the aspect of their applicability to various systems with the minimization of the user input. The obtained results show that the most effective method of detecting anomalies, which can be transferred to different systems and minimizes the user's work, are systems based on machine learning. The publication [6] defines three main methodological areas for diagnosing anomalies (machine learning, deep learning, statistical approaches) and summarizes exactly how the corresponding models are used to detect anomalies. In addition, the authors explain which specific application areas are typically addressed by anomaly detection in the context of cloud computing environments and which relevant public datasets are often used for evaluation.

In [ 7 ], the authors propose an intelligent system for detecting anomalies and identifying smart home devices using collective communication. The concept of the system's operation is based on obtaining benefits from the integration of smart homes into a social network in terms of increasing the security of both a single smart home and the entire social network of connected smart homes. Publication [ 8 ] proposes an unsupervised method that was developed to detect anomalies when information is not labeled or classified. Information extraction approaches based on machine learning, developed for the implementation of the anomaly detection system, were used. implemented in the practice of organizations. Their work is based on the use of a database of attack patterns (signatures) and machine learning methods. In addition, such systems can register a set of data characterizing the interaction of employees with the organization's information assets and have proven themselves well in solving the problem of detecting anomalies.

The article [ 9 ] describes a study of log mining in the field of microservices technologies with the detection of anomalies from logs, that is, events that require deeper inspection by analysts. The authors propose a new approach to finding numerical representations of computer logs without making assumptions about the format of the underlying data and without requiring programming knowledge. The article [ 10 ] presents a distributed approach for real-time anomaly detection in largescale environments. The method has the ability to detect consistent and quantitative anomalies within a multi-source streaming log.

The purpose of this article is to improve the previously proposed method of detecting anomalies of user interaction with the organization's information resources, which would allow using the results of modern intrusion detection systems (IDS) and would be simple enough for practical implementation by information security administrators. 4. The method of detecting insider attacks on the organization's information resources

4.1. General approach

As before, we will take as a basis the methodology based on the use of a bipartite graph [ 1, 11 ] to display the interaction of users (employees of the organization) with assets (information systems) on the basis of network data collected by the IDS system.

The set of users will be denoted by = { 1, … , }, the information assets will be defined as the set = { 1, … , }, and the set of users who accessed to assets over a certain period of time will be defined as the set . We denote as , where the value of the weight between pairs of vertices is the value of similarity.

A bipartite graph reflecting the fact of users' access to assets is denoted by a binary matrix . At the same time ( , ) = 1, if the user accesses the asset, and ( , ) = 0 if not. It is suggested 181 to use the statistical measure IDF (Inverse Document Frequency) to assess the connection of users with assets. As a measure of IDF , it is suggested to take a sigmoidal function in the form: ( ) = where = (1,1, … ,1) is unit vector of dimension ; | | is a power of set ; is a column -user of the matrix (access vector); is a sensitivity coefficient of the function.

The matrix obtained after the transformation will be denoted by . The similarity between pairs of users can be obtained based on their access vectors. To measure the similarity of two vector assets, it is suggested to use cosine similarity [12]: ( , ) = ‖ ( )× ( ) ( )‖×‖ ( )‖ =

∑ =1 ( , )×

( , ) √∑ =1(

2 ( , )) ×√∑ =1( ( , )) 2

Given two feature vectors and , the cosine similarity can be represented using the scalar product and the norm. When a user interacts with an organization's information assets, the cosine similarity of two users ranges from 0 to 1, since the angle between the two frequency vectors cannot be greater than 90°. Cosine similarity is effective as an evaluation measure, especially for sparse vectors, since only non-zero values are taken into account [ 10 ].

As a result of the calculations, a similarity matrix of user interaction with information assets will be obtained. It is assumed that if one of the users is an intruder, then his actions will be reflected in the similarity matrix. Around each asset, an individual group of users is formed who work with it and refer to it. To calculate the similarity between groups of users, it is necessary to calculate the average similarity between all pairs of users (total user similarity): | |×

2

( ) = ∑ =1 ∑ =1 ( , ) , ∀ ≠ ∈ −1 ∀ , where | | is number of users in the group.

Building sets of users and assets.

Construction of a bipartite interaction graph. Calculation of the statistical measure of IDF. Calculation of the similarity matrix of user actions. Calculation of the overall similarity of user actions.

Detection of abnormal actions.

If ( ) has a high value, it means that users have a strong engagement with asset . To detect anomalous user actions, it is necessary to determine the average similarity for the subgroup ( ), ∀ ∨ = , in which a single user is compared with other users, and to determine the rating of this user relative to the average value for the organization: the more likely that user 's access to assets is abnormal.

The proposed technique for detecting abnormal user actions based on network data analysis can be presented in the form of a sequence of steps: (1) (2) (3) (4) 4.2. Algorithm for detecting anomalies in the interaction of users with the organization's information assets (Algorithm of similarity) 1,1 ,1

1, ⋯ ⋱ ⋯ , 1. ← [ ⋮ 2. ← 3.

= 4. = 5. ← (1, … , 1 ) 6.

( ) = 7. ( ) = ℎ[ ] ℎ[ ] [

− the matrix of sigmoidal functions. 8. ( , ) = 9. ( ) = 10. ( ) =

actions. 11. ( , ) = individual users. similarity matrix for user actions. actions of individual users.

1

∑ =1 ( ) ⋮ ] forming a matrix of user access to assets. [ , = 1, ( ) , 0] , { , }, { , }]

∑ =1 ( ) , × ( ) , √∑ =1( ( ) , )2×√∑ =1( ( ) , ) 2

, { , }, { , }] ⋮ ]. The elements of this matrix denote: ( , ) = 1, if the user is granted access The actual access of users to assets will still be determined by the matrix = [ (

) − ( ) to asset , and ( , ) = 0, if not.

4.3. Improvement of the method (Advanced method)

Despite the obvious advantages, such an approach, which is based on determining the similarity of the actions of individual users, has significant disadvantages, in particular: 1. The approach works well in those organizations where information resources are clearly demarcated between employees. That is, sets of information resources of individual employees do not overlap. 2. In this model, the impact of suspicious employee access to the organization's resources can be neutralized by the appropriate combination of access to authorized resources. In order to avoid the mentioned shortcomings, it is suggested to improve the method as follows. To control user access to the organization's resources, we introduce an access matrix = In the situation , when user #5 tries to bypass the protection system, for which he does not use one of the permitted resources, for example, asset #1, when calculating the abnormality of the behavior of user #5, the algorithm will give an erroneous result (Figure 2) . In this case, for user #5, the degree of abnormality will be only 1.9% and therefore, against the background of general indicators from 4.0% to 2.8%, it will be impossible to recognize an insider attack [ 16 ].

In the same situation, when applying the improved methodology, in both cases (when user #5 access is attempted without bypassing the protection system and with the protection system bypassed), we get a result that clearly indicates the anomalous behavior of user #5 (Figure 3).

5.2. Scenario 2

In the previous scenario, the organization's information assets were clearly demarcated between users. However, this situation in most organizations is the exception rather than the rule. As a rule, when performing tasks, employees of organizations very often use common resources. In this case, the application of the method based on the similarity matrix [ 17 ] gives extremely contradictory results that cannot be interpreted.

As in Scenario 1, we denote the access rights of users to the assets of the organization by the matrix . The fact of user access to assets is denoted by the access matrix . In the matrix of actual access, let's mark with red symbols "1" attempts of users to gain unauthorized access to assets, and with "0" symbols in brown

authorized assets that were not used by users. In this case, the matrices and , as an example, can have the form = 1

0 , = 1 0 0 1 1 0 0 1 1 1 0 0 0 0 0 1 1

1 0 0 1 1 0 0 1 1 1 0 0 0 [1 1 1 0 1 1 0 1 1 1 0 0 0 0 1 1 0 1 0 1 0 0 0 1 1 1 1 0 1 1 0 0 1 1 1 1 1 0 1 1 1 0 0 1 1 1 0 1 1 0 0 1 1 0 1 1 0 1 1 1 1 0 0 1 0 0 1 1 1 0 0 0 0 0 0 0 1 1 0 1 1 1 1 1 1 0 0 0 1 1 0 1 0 1 1 1 1 1 1 0 1 0 0 0 0 0 0 1 1 1 1 1 1 0 . (6)

We simulate the situation described by matrices (6) using the similarity algorithm and the improved method. The results of modeling using the similarity algorithm and the improved method are shown in Figure 4 and Figure 5.

As we can see from Figure 4, in the case when the access rights of different users overlap (when users can use shared resources), the similarity algorithm gives results that do not unambiguously indicate anomalies in user behavior. At the same time, the results in Figure 5 fully reproduce the pattern of malicious activity described by the matrix . At the same time, the system can also determine the level of malicious activity [ 18, 19 ]. In particular, the matrix of formula (6) shows that attempts to gain unauthorized access to the organization's assets were made by users #1, #2, #4, #6, #9. At the same time, user #6 made 2 such attempts, and user #9 made three such attempts. The results of the application of the improved technique give indicators for user #6 at the level of 22.2%, and for #9 33.3%. At the same time, for other malicious actions of users #1, #2, #4, the result is within 9.09...14.3%, which clearly distinguishes more dangerous users against the background of less dangerous ones. The separation of suspicious activity into different levels is important from the point of view of identifying real insiders, because in this case it is possible to reject those users who make unintentionally erroneous actions with information assets. In this way, the system will be more protected against false alarms.

6. Conclusions

The improved method given in this article makes it possible to unambiguously determine that the user's interaction with some information asset of the organization is anomalous. This, in turn, may indicate a possible insider attack. The results of the application of the improved method may be transferred to the information security administrator for further analysis and action. It is assumed that in some cases such an approach will not allow to reliably determine whether a given activity is a malicious activity, since such an analysis does not take into account the context of interaction and the reason for its occurrence, in addition, other, personal characteristics of a specific user are not taken into account. In any case, the application of this technique is advisable in combination with the analysis of other indicators that allow determining the presence of the user's propensity for malicious activity, for example, taking into account the loyalty of the staff.

By integrating real-time monitoring and behavior profiling, the technique can serve as an early warning system, flagging users whose actions deviate significantly from established norms. This can allow security administrators to intervene promptly, reducing response times and minimizing potential damage. Moreover, combining this method with context-aware analysis and psychological profiling could provide a more holistic approach to insider threat management, balancing technological detection with an understanding of human factors.

Future research in this area could explore the integration of machine learning techniques with the proposed method to enhance the detection of insider threats in more complex organizational environments. Specifically, incorporating predictive analytics and anomaly detection algorithms could improve the system's ability to identify patterns of malicious behavior even when insiders attempt to mask their activity.

Declaration on Generative AI

The authors have not employed any Generative AI tools. [5]

References

[1] V. Savchenko , E. Smolev , D. Gamza , The method of detecting anomalies of user interaction with the organization's information resources , Modern information security 4 ( 56 ) ( 2023 ) 6 12 . doi: 10 .31673/ 2409 - 7292 . 2023 . 030101 .

[2] V. Savchenko , V. Savchenko , T. Dzyuba , O. Matsko , I. Novikova , I. Havryliuk , V. Polovenko , Time Aspect of Insider Threat Mitigation, Advances in Military Technology 19 ( 1 ) ( 2024 ) 149 - 164 . doi: 10 .3849/aimt. 01830 .

[3] N. Jeffrey , Q. Tan , J. R. Villar , A Review of Anomaly Detection Strategies to Detect Threats to Cyber-Physical Systems , Electronics 12 ( 2023 ) 3283 . doi: 10 .3390/electronics12153283.

[4] I. V. Ruban , V. O. Martovytskyi , S. O. Partyka , Classification of anomaly detection methods in URL: 3rd Artificial Intelligence and Cloud Computing Conference (AICCC 2020) Kyoto, Japan 18 20.12 ( 2020 ). doi: 10 .1145/3442536.3442550

[7] A. O. Nicheporuk , A. A. Nicheporuk , O. S. Savenko , A. D. Kazantsev , An intelligent system for detecting anomalies and identifying smart home devices using collective communication , Electrical and computer systems 34(110) ( 2021 ) 50 - 61 . URL: https://eltecs.op.edu.ua/index.php/journal/article/download/3196/1118/

[8] H. L. Mezones Santana , T. E. Cobeña Macias , M. A. Quimiz Moreira , Anomaly Detection Method in Computer Systems by Means of Machine Learning , in: M. Zambrano Vizuete (Ed.), Innovation and Research A Driving Force for Socio-Econo-Technological Development, Lecture Notes in Networks and Systems , 511 ( 2022 ). doi: 10 .1007/978-3- 031 -11438-0_ 32 .

[9] M. Cinque , R. Della Corte , A. Pecchia, Micro2vec: Anomaly detection in microservices systems by mining numeric representations of computer logs , Journal of Network and Computer Applications 208 ( 2022 ) 103515 . doi: 10 .1016/j.jnca. 2022 . 103515 .

[10] -Based Anomaly Detection System for Cloud Engineering (ICDE) ( 2021 ). URL: https://ieeexplore.ieee. org/document/9458872. Society Technical Committee on Data Engineering 24 ( 4 ) ( 2001 ): 35 43 . URL: http://singhal.info/ieee2001.pdf.

[13] V. Savchenko , V. Akhramovych , T. Dzyuba , S. Laptiev , N. Lukova-Chuiko , and T. Laptieva . Theory (ATIT) , Kyiv, Ukraine, ( 2021 ) 99 105, doi: 10.1109/ATIT54053. 2021 . 9678599 .

[14] G. Saunders , M. Hitchens , V. Varadharajan , Role-Based Access Control and the Access Control Matrix , Operating Systems Review 35 ( 2003 ) 145 157. doi: 10 .1007/978-3- 540 -39927-8_ 14 .

[15] B. Viswanath , A. Bashir , M. Crovella , S. Guha , K. P. Gummadi , B. Krishnamurthy , and A. of the 23rd USENIX Security Symposium (USENIX Security) ( 2014 ) 223 238 . URL: https://www.researchgate.net/publication/310793105_Towards_ detecting_ anomalous_user_behavior_in_online_social_networks.

[16] L. Daubner , M. Macak , R. . Buhnova , S. . Pitner , Addressing insider attacks via forensic-ready risk management , Journal of Information Security and Applications 73 ( 2023 ) 103433 . doi: 10 .1016/j.jisa. 2023 . 103433 .

[17] P. Alves , C. Sales , M. Ashworth , Does outcome measurement of treatment for substance use disorder reflect the personal concerns of patients? A scoping review of measures recommended in Europe , Drug and Alcohol Dependence 179 ( 2017 ) 299 308. doi: 10 .1016/j.drugalcdep. 2017 . 05 .049.

[18] L. Ko , D. M. Divakaran , Y. Liau , V. Thing , Insider Threat Detection and its Future Directions, International Journal of Security and Networks 12 ( 2016 ). doi: 10 .1504/IJSN. 2017 . 10005217 .

[19] V. Sosnovyy , N. Lashchevska , Detection of malicious activity using a neural network for continuous operation , Cybersecurity: Education, Science, Technique 3 ( 2024 ) 213 224. doi: 10 .28925/ 2663 - 4023 . 2024 . 23 .213224.