A Layered Approach to Insider Threat Detection and Proactive Forensics

An insider threat is a menace to computer security as a result of unauthorized system misuse by users of an organization. A recent study jointly published by the United States Secret Service and Carnegie Mellon University [7] confirms the prevalence of computer crimes perpetrated by insiders across America’s organizations. Insider attacks can be more destructive and costly than attacks from the outside as a perpetrator often has deep understanding of and convenient accesses to a plethora of an organization’s computer resources. This paper discusses augmenting intrusion detection systems with forensics tools to enhance the discovery and prosecution of internal attacks. Our research follows two approaches: One is using intrusion detection systems (IDSs) [5] as black boxes and having them drive forensics tools. Likewise, we are looking at building our own statistical metrics for fleshing out long term changes in user behavior.