Event-Based Document Sensing for Insider Threats ; CU-CS-968-04
Kenneth Mark Anderson, Antonio Carzaniga, Dennis M. Heimbigner, Alexander L. Wolf · CU Scholar (University of Colorado Boulder) · 2004
In this report we describe a uniquely decentralized event-based system for online and offline tracking, analysis, and control of electronic document transactions in order to detect suspected insider misuse of those documents.Our system is focused on the problem of tracking and analyzing user's actions with respect to documents.On the user side, the proposed system will support the placing of document sensors into a heterogeneous collection of document editors (e.g., Microsoft Office) and browsers, including Web browsers.The system will provide a low entry barrier with respect to integrating new user-side tools.On the administrative side, the proposed system will support a dynamically changing set of online and offline analysis and control programs capable of providing such diverse capabilities as visualization, persistence, forensics, access control validation, and slicing of document access patterns based on, for example, user, or document, or transaction type, or time-line.The system as a whole will be portable, which we will demonstrate by providing integration of tools under both Linux and Windows.Our system makes novel use of hypermedia technology to support analyses that rely on historical traces of document transactions.This component, EventTrails, will provide persistent storage for captured events and will organize these events into trails.Additionally, it will provide access/query and visualization services over these trails.Events can be arranged in hierarchies to support analysis at different levels of granularity; a set of "keystroke events" can be aggregated into a single "edit" event, for instance.EventTrails also supports queries against particular event patterns.This is especially useful in defining signatures for suspicious activities.For instance, a pattern might be used to detect "cut-and-paste" events between documents that have different