AZALIA: an A to Z Assessment of the Likelihood of Insider Attack

Citation

M. Bishop, C. Gates, D. Frincke, and F. Greitzer, “AZALIA: an A to Z Assessment of the Likelihood of Insider Attack,” Proceedings of the 2009 IEEE International Conference on Technologies for Homeland Security pp. 385–392 (May 2009).

Paper

• Published version web page, paper paywalled at IEEE Explore: [DOI] [URL]
• Authors’ final version:
  • Local: [PDF] [PS]
  • UC Repository: [eScholarship]

Abstract

The insider threat problem is increasing, both in terms of the number of incidents and their financial impact. To date, solutions have been developed to detect specific instances of insider attacks (e.g., fraud detection) and therefore use very limited information for input. In this paper we describe an architecture for an enterprise-level solution that incorporates data from multiple sources. The unique aspects of this solution include the prioritization of resources based on the business value of the protected assets, and the use of psychological indicators and language affectation analysis to predict insider attacks. The goal of this architecture is not to detect that insider abuse has occurred, but rather to determine how to prioritize monitoring activities, giving priority to scrutinizing those whose background includes access to key combinations of assets as well as those psychological/other factors that have in the past been associated with malicious insiders.

Bibliographic Information: [BibTeX] [RIS]
DOI: 10.1109/THS.2009.5168063