Knowing who to watch: Identifying attackers whose actions are hidden within false alarms and background noise

Insider attacks are often subtle and slow, or preceded by behavioral indicators such as organizational rule-breaking which provide the potential for early warning of malicious intent; both these cases pose the problem of identifying attacks from limited evidence contained within a large volume of event data collected from multiple sources over a long period. This paper proposes a scalable solution to this problem by maintaining long-term estimates that individuals or nodes are attackers, rather than retaining event data for post-facto analysis. These estimates are then used as triggers for more detailed investigation. We identify essential attributes of event data, allowing the use of a wide range of indicators, and show how to apply Bayesian statistics to maintain incremental estimates H. Chivers (B) · P. Nobles · S. A. Shaikh Department of Informatics and Sensors, Cranfield University, Shrivenham, UK e-mail: [email protected], [email protected] P. Nobles e-mail: [email protected] S. A. Shaikh e-mail: [email protected] J. A. Clark · H. Chen Department of Computer Science, University of York, York, UK J. A. Clark e-mail: [email protected] H. Chen e-mail: [email protected] without global updating. The paper provides a theoretical account of the process, a worked example, and a discussion of its practical implications. The work includes examples that identify subtle attack behaviour in subverted network nodes, but the process is not networkspecific and is capable of integrating evidence from other sources, such as behavioral indicators, document access logs and financial records, in addition to events identified by network monitoring.