A Scalable Predicting Model for Insider Threat
Hui Wang · Chinese Journal of Computers · 2006
Network threat confronting organizations comes from not only outsider threat, but also insider threat. Nowadays, insider threat is widely recognized as an issue of utmost importance for security management. However, insider attack modeling and threat analysis tools have not been evolved at the same rate. This paper presents a novel insider threat model. Based on the encapsulated user intent, the customized minimal attack tree can be generated. By monitoring the user’s ongoing activities, it can predict and detect insider attack. This paper introduces an estimator of attack probability, and it can help system administrators make sound decision by a quantitative approach.