Applying one-class algorithms for data stream-based insider threat detection

Registro completo de metadados
MetadadosDescriçãoIdioma
Autor(es): dc.contributorUniversity of Brasília, Department of Computer Science-
Autor(es): dc.contributorUniversity of Brasília, Department of Computer Science-
Autor(es): dc.contributorUniversity of Brasília, Department of Computer Science-
Autor(es): dc.creatorPeccatiello, Rafael Bruno-
Autor(es): dc.creatorGondim, João José Costa-
Autor(es): dc.creatorGarcia, Luís Paulo Faina-
Data de aceite: dc.date.accessioned2024-07-22T12:02:02Z-
Data de disponibilização: dc.date.available2024-07-22T12:02:02Z-
Data de envio: dc.date.issued2024-05-22-
Data de envio: dc.date.issued2024-05-22-
Data de envio: dc.date.issued2022-
Fonte completa do material: dc.identifierhttp://repositorio2.unb.br/jspui/handle/10482/48114-
Fonte completa do material: dc.identifierhttps://orcid.org/0009-0001-9075-7028-
Fonte completa do material: dc.identifierhttps://orcid.org/0000-0002-5873-7502-
Fonte completa do material: dc.identifierhttps://orcid.org/0000-0003-0679-9143-
Fonte: dc.identifier.urihttp://educapes.capes.gov.br/handle/capes/794518-
Descrição: dc.descriptionAn insider threat is anyone who has legitimate access to a particular organization’s network and uses that access to harm that organization. Insider threats may act with or without intent, but when they have an intention, they usually also have some specific motivation. This motivation can vary, including but not limited to personal discontent, financial issues, and coercion. It is hard to face insider threats with traditional security solutions because those solutions are limited to the signature detection paradigm. To overcome this restriction, researchers have proposed using Machine Learning which can address Insider Threat issues more comprehensively. Some of them have used batch learning, and others have used stream learning. Batch approaches are simpler to implement, but the problem is how to apply them in the real world. That is because real insider threat scenarios have complex characteristics to address by batch learning. Although more complex, stream approaches are more comprehensive and feasible to implement. Some studies have also used unsupervised and supervised Machine Learning techniques, but obtaining labeled samples makes it hard to implement fully supervised solutions. This study proposes a framework that combines different data science techniques to address insider threat detection. Among them are using semi-supervised and supervised machine learning, data stream analysis, and periodic retraining procedures. The algorithms used in the implementation were Isolation Forest, Elliptic Envelop, and Local Outlier Factor. This study evaluated the results according to the values obtained by the precision, recall, and F1-Score metrics. The best results were obtained by the ISOF algorithm, with 0.78 for the positive class (malign) recall and 0.80 for the negative class (benign) recall.-
Descrição: dc.descriptionInstituto de Ciências Exatas (IE)-
Descrição: dc.descriptionDepartamento de Ciência da Computação (IE CIC)-
Descrição: dc.descriptionPrograma de Pós-Graduação em Computação Aplicada, Mestrado Profissional-
Formato: dc.formatapplication/pdf-
Idioma: dc.languageen-
Publicador: dc.publisherIEEE-
Direitos: dc.rightsAcesso Aberto-
Direitos: dc.rightsThis work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 License. For more information, see https://creativecommons.org/licenses/by-nc-nd/4.0/-
Palavras-chave: dc.subjectAlgoritmos-
Palavras-chave: dc.subjectAmeaças cibernéticas-
Palavras-chave: dc.subjectAnálise de dados-
Palavras-chave: dc.subjectAprendizagem de máquina-
Título: dc.titleApplying one-class algorithms for data stream-based insider threat detection-
Aparece nas coleções:Repositório Institucional – UNB

Não existem arquivos associados a este item.