Mitigating the Insider Threat Using High-Dimensional Search and Modeling
Eric van den Berg, Shambhu Uphadyaya, Phi H. Ngo, Muthu Muthukrishnan, Rajago Palan · 2006
In this project a system was built aimed at mitigating insider attacks centered around a high-dimensional search engine for correlating the large number of monitoring streams necessary for detecting insider attacks. Further accomplishments in this project include an insider attack modeling and analysis tool called MAPIT, developed by SUNY Buffalo, and a novel sketch-based anomaly detection sensor developed by Rutgers University, which can be used for detecting anomalies in IP source/destination addresses, as well as for defining small-space user profiles, e.g., file accesses.