An Insider Threat Investigation Method by Graph Analysis with Log Texts
Kexiong Fei, Jiang Zhou · 2024
In this research, we propose ITI, a new insider threat investigation method based on causal graph analysis, to help security personnel facing complex insider threat investigation work. This method first retrieves the corresponding alarm features and entities from alarm files through feature extraction. Second, we sorted alarms chronologically, merged them by entities, and folded repeated attack patterns to reduce the scale of the causal graph and make it more intuitive. Third, we use the scarcity of different values in the features to sort the causal graphs for all employees/users by the prioritization of risk. At last, security personnel can investigate employees‘ causal graphs in this order. Our validation and evaluation results confirm that ITI can greatly improve the performance of investigating insider threats compared to existing methods.