Designing Host and Network Sensors to Mitigate the Insider Threat
Brian M. Bowen, Malek Ben Salem, Shlomo Hershkop, Angelos D. Keromytis, Salvatore J. Stolfo · IEEE Security & Privacy · 2009
Insider attacks-that is, attacks by users with privileged knowledge about a system-are a growing problem for many organizations. To address this threat, the authors have designed an architecture for insider threat detection that combines an array of complementary monitoring and auditing techniques.