Research of predicting insider threat based on Bayesian network
Hui Wang, Yang Guangcan, Dongmei Han · Jisuanji yingyong yanjiu · 2013
Internal network brings convenience for corporate office,but increasing threats are also brought into enterprises.Insider threat causes great harm to enterprises,and is difficult to detect,so it is urgently to be solved.This paper put forward a predictive model of insider threat based on Bayesian network attack graphs.It considered the behaviors in attacking process as research objects,and considered the resources and operation sequence as nodes,established Bayesian network attack graphs.It described the different attack paths and attack state in the process of attacking by Bayesian network attack graphs,and used Bayesian network inference algorithm to calculate the risk probability of insider threat.In Bayesian network attack graphs,the concepts of meta-operation,atomic attack and intrusion evidence were defined,and node variable,its value and conditional probability distribution were quantified.Based on the improved likelihood weighted algorithm,the calculation of Bayesian network parameters is easier,and the prediction of insider threat is more accurate.Ultimately,by simulation experiment,it is proved that the modeling speed is fast,the process of calculation is simple,the result is exact,and it is valid and applicative in predicting insider threat.