A Framework to Defense against Insider Attacks on Information Sources
Reza Asgari, Reza Ebrahimi Atani · International Journal of Managing Public Sector Information and Communication Technologies · 2013
As for development and growth of information systems and security organizations, protecting information against probable attacks is of great importance.External raids on these organizations, for the most part, are not practicable due to high defensive layers.Therefore to intrude on such organizations, insiders are employed.In this paper, by introducing consequence and necessity of recognition of insider attacks perils, we intend to propose a new framework for detecting and preventing from insider attacks on information systems.The suggested framework is defined according to ontology graphs, thus, a structure of so-called ontology is firstly explained.This composition represents data structure for saving and presenting information and is then practiced to detect user's behavioral patterns within such framework.The framework consists of three phases of construction, comparison and analysis such that it first receives a set of user's requests alongside with his legal access level and in case of encountering an attack it communicates an appropriate warning message to the organization administrative system.