Design of Intrusion Detection System Preventing Insider Attack
نویسندگان
چکیده
Recent reports show that the loss from the malicious intrusion by insiders is more serious than by outsiders. Despite that the various attacks are occurred by insiders and outsiders, most work has been focused on the intrusion detection against outsider attacks. In this paper, we improve the Wang et al.’s insider predection model [15] and propose the combined model with access control for the efficient insider intrusion detection. We delegate the role of insider intrusion detection to users that reduces the malicious trial of insiders and the overhead on the centralized intrusion detection system. We also define the separated access privilege that requires insiders to find the witness for accessing the information. We show that the combination of the concept of access control enables more practical deployment of insider intrusion detection system.
منابع مشابه
A New Intrusion Detection System to deal with Black Hole Attacks in Mobile Ad Hoc Networks
By extending wireless networks and because of their different nature, some attacks appear in these networks which did not exist in wired networks. Security is a serious challenge for actual implementation in wireless networks. Due to lack of the fixed infrastructure and also because of security holes in routing protocols in mobile ad hoc networks, these networks are not protected against attack...
متن کاملReal-Time intrusion detection alert correlation and attack scenario extraction based on the prerequisite consequence approach
Alert correlation systems attempt to discover the relations among alerts produced by one or more intrusion detection systems to determine the attack scenarios and their main motivations. In this paper a new IDS alert correlation method is proposed that can be used to detect attack scenarios in real-time. The proposed method is based on a causal approach due to the strength of causal methods in ...
متن کاملTowards a Conceptual Model and Reasoning Structure for Insider Threat Detection
The insider threat faced by corporations and governments today is a real and significant problem, and one that has become increasingly difficult to combat as the years have progressed. From a technology standpoint, traditional protective measures such as intrusion detection systems are largely inadequate given the nature of the ‘insider’ and their legitimate access to prized organisational data...
متن کاملFrontiers in Insider Threats and Data Leakage Prevention
Organizations continue to be plagued by information leaks caused by insiders with legitimate access to critical or proprietary information. Such unauthorized leaks may result in significant damage to competitiveness, reputation and finances, and organizations should consider proactive approaches to preventing, detecting, and responding to this threat. In this special issue, we have selected eig...
متن کاملPMFA: Toward Passive Message Fingerprint Attacks on Challenge-Based Collaborative Intrusion Detection Networks
To enhance the performance of single intrusion detection systems (IDSs), collaborative intrusion detection networks (CIDNs) have been developed, which enable a set of IDS nodes to communicate with each other. In such a distributed network, insider attacks like collusion attacks are the main threat. In the literature, challenge-based trust mechanisms have been established to identify malicious n...
متن کامل