Informatics and Applications
2017, Volume 11, Issue 4, pp 65-69
THE MODEL OF THE SET OF INFORMATION SPACES IN THE PROBLEM OF INSIDER DETECTION
- A. A. Grusho
- M. I. Zabezhailo
- D. V. Smirnov
- E. E. Timonina
Abstract
In the problem of insider detection, the approach to combining compromising data observed in different information spaces is developed. Accumulation of information in each space is considered as a random process. The considered approach is based on bans and semibans of probability measures in different information spaces. Boolean variables communicate with the help of sequences of events observed in the information spaces. Appearance of semibans corresponds to value " 1 " of the appropriate Boolean variables. Sequences of Boolean variables in different information spaces easily communicate by means of logical expressions. The expressions describe dangerous tendencies observed in different information spaces.
[+] References (14)
- General Services Administration. 22.10.2010. Anomaly Detection at Multiple Scales (ADAMS). Available at: https: //www.fbo.gov/download/2f6/2f6289e99a0c0494 2bbd89ccf242fb4c/DARPA-BAA-ll-04_ADAMS.pdf (accessed May 12, 2011).
- Yu, R., X. He, and Y Liu. 1940. GLAD: Group anomaly detection in social media analysis. Available at: arXiv:1410.1940 (accessed October 7, 2014).
- Senator, T, H. G. Goldberg, A. Memory, et al. 2013. Detecting insider threats in a real corporate database of computer usage activity. 19th ACM SIGKDD Conference (International) on Knowledge Discovery and Data Mining Proceedings. New York, NY: ACM. 1393-1401.
- Grusho, A., N. Grusho, and E. Timonina. 2015. Quality of tests defined by bans. 16th Applied Stochastic Models and Data Analysis Conference (International) Proceedings. - Piraeus, Greece: ISAST, 2015. P. 289-295.
- Grusho, A., N. Grusho, and E. Timonina. 2017. Modelling for ensuring information security of the distributed information systems. 31th European Conference on Mod-elling and Simulation Proceedings. Germany: Digitaldruck Pirrot GmbHP Dudweiler. 656-660.
- Martyanov, E. A. 2017. Vozmozhnost' vyyavleniya insay- dera statisticheskimi metodami [Possibility of insider de-tection by statistical techniques]. Sistemy i Sredstva Infor- matiki - Systems and Means of Informatics 27(2):41-47.
- Bourbaki, N. 1940. Topologie gemrale. Ch. 1: Structures topologiques. Ch. 2: Structures uniformes. Paris: Hermann. 129 p.
- Prokhorov, Yu.V., and Yu.A. Rozanov. 1993. Teoriya veroyatnostey [Theory of probabilities]. Moscow: Nauka. 496 p.
- Grusho, A., and E. Timonina. 2013. Consistent sequences of tests defined by bans. Optimization theory, decision making, and operations research applications. Eds. A. Migdalas, A. Sifaleras, C. K. Gorgiadis, et al. Springer proceedings in mathematics & statistics ser. New York - Heidelberg - Dordrecht - London: Springer-Verlag. 31:281-291.
- Grusho, A., N. Grusho, and E. Timonina. 2014. Vklyu- chenie novykh zapretov v sluchaynye posledovatel'nosti [Switching on of new bans in random sequences]. Infor-matika i ee Primeneniya - Inform. Appl. 8(4):48-54.
- Sheyner, S., J. Haines, S. Jha, R. Lippmann, and J. M. Wing. 2002. Automated generation and analysis of attack graphs. IEEE Symposium on Security and Privacy Proceedings. 273-284.
- Grusho, A., N. Grusho, and E. Timonina. 2016. Detection of anomalies in non-numerical data. 8th Congress (International) on Ultra Modern Telecommunications and Control Systems and Workshops Proceedings. - Piscataway, NJ: IEEE. 273-276.
- Grusho, A.A., N.A. Grusho, M.I. Zabezhailo, and E. E. Timonina. 2016. Integratsiya statisticheskikh i de- terministskikh metodov analiza informatsionnoy bezopas- nosti [Integration of statistical and deterministic methods of information security analysis]. Informatika i ee Primeneniya - Inform. Appl. 10(3):19-25.
- Grusho, A. 2017. Data mining and information security Computer network security. Eds. J. Rak, J. Bay, I. Kotenko, et al. Lecture notes in computer science ser. Springer. 10446:28-33.
[+] About this article
Title
THE MODEL OF THE SET OF INFORMATION SPACES IN THE PROBLEM OF INSIDER DETECTION
Journal
Informatics and Applications
2017, Volume 11, Issue 4, pp 65-69
Cover Date
2017-12-30
DOI
10.14357/19922264170408
Print ISSN
1992-2264
Publisher
Institute of Informatics Problems, Russian Academy of Sciences
Additional Links
Key words
information security; insider; bans and semibans of probability measures; architecture of combining information sources
Authors
A. A. Grusho  , M. I. Zabezhailo ,
D. V. Smirnov  , and E. E. Timonina
Author Affiliations
Institute of Informatics Problems, Federal Research Center "Computer Science and Control" of the Russian Academy of Sciences, 44-2 Vavilov Str., Moscow 119333, Russian Federation
Sberbank of Russia, 19 Vavilov Str., Moscow 117999, Russian Federation
|