Informatics and Applications
2019, Volume 13, Issue 3, pp 3-8
METHODS OF IDENTIFICATION OF "WEAK" SIGNS OF VIOLATIONS OF INFORMATION SECURITY
- A. A. Grusho
- N. A. Grusho
- E. E. Timonina
Abstract
New approach of identification of "weak" signs of violations of information security is suggested. Initial information for identification of "weak" signs of violations of information security by the insider-malefactor are the observed potential purposes of the insider-malefactor. Emergence of new valuable information, in which the insider-malefactor is interested, will cause behavioral reaction of the insider-malefactor in some information spaces. Methods of searching of such reactions in various information spaces are the purpose of this work. The probability model of a reaction of an insider-malefactor in case of repeated emergence of a purpose is constructed.
It is shown that usage of many information spaces significantly increases possibilities of identification of influence of a purpose on behavior of an insider-malefactor
[+] References (14)
- Cappelli, D., A. Moore, and R. Trzeciak. 2012. The CERT guide to insider threats: How to prevent, detect, and respond to information technology crimes (theft, sabotage, fraud). Addison-Wesley Professional. 430 p.
- Band, S., D. Cappelli, L. Fischer, A. Moore, E. Shaw, and R. Trzeciak. 2006. Comparing insider IT sabotage and espionage: A model-based analysis. CMU/SEI-
2006-TR-026. Software Engineering Institute, Carnegie Mellon University. 108 p. Available at: http://resources. sei.cmu.edu/library/asset-view.cfm? AssetID=8163 (accessed June 20, 2019).
- Timonina, E. E. 2004. Analiz ugroz skrytykh kanalov i metody postroeniya garantirovanno zashchishchennykh raspredelennykh avtomatizirovannykh sistem [The analysis of threats of covert channels and methods of creation of guaranteed protected distributed automated systems]. Moscow: Russian State University for the Humanities. D.Sc. Diss. 204 p.
- Anomaly Detection at Multiple Scales (ADAMS). 2011. Available at: https://info.publicintelligence.net/DARPA- ADAMS.pdf (accessed June 20, 2019).
- Senator, T E., H.G. Goldberg, A. Memory, et al. 2013. Detecting insider threats in a real corporate database of computer usage activity. 19th ACM SIGKDD Conference (Internationl) on Knowledge Discovery and Data Mining Proceedings. New York, NY: ACM. 1393-1401.
- Grusho, A. A., N.A. Grusho, M. I. Zabezhailo,
D. V. Smirnov, and E. E. Timonina. 2018. Parametrizatsiya v prikladnykh zadachakh poiska empiricheskikh prichin [Parametrization in applied problems of search of the em-pirical reasons]. Informatika i ee Primeneniya - Inform. Appl. 12(3):62-66.
- Grusho, A.A., M.I. Zabezhailo, D.V. Smirnov, and
E. E. Timonina. 2017. Model' mnozhestva informatsion- nykh prostranstv v zadache poiska insaydera [The model of the set of information spaces in the problem of insider detection]. Informatika i ee Primeneniya - Inform. Appl. 11(4):65-69.
- Grusho, A., and E. Timonina. 2011. Prohibitions in discrete probabilistic statistical problems. Discrete Math. Appl. 21(3):275-281.
- Axelsson, S. 1999. The base-rate fallacy and its implications for the difficulty of intrusion detection. 6th ACM Conference on Computer and Communications Proceedings. New York, NY: ACM. 1-7.
- Finn, V. K. 2011. Iskusstvennyy intellekt: metodologiya, primeneniya, filosofiya [Artificial intelligence: Methodology, applications, philosophy]. Moscow: KRASAND. 448 p.
- Tukey, J. W 1977. Exploratory data analysis. Addison Wes-ley Pub. Co., Inc. 711 ð.
- Feller, W 1950. An introduction to probability theory and its applications. 2nd ed. New York, NY: John Wiley and Sons, Inc. Vol. 1. 520 p.
- Kolchin, V. F, B.A. Sevastyanov, and V. P. Chistyakov. 1978. Random allocations. Washington, DC: V. H. Winston & Sons. 270 p.
- Shiryaev, A. N. 2004. Veroyatnost' [Probability]. Moscow: MTsNMO. 521 p.
[+] About this article
Title
METHODS OF IDENTIFICATION OF "WEAK" SIGNS OF VIOLATIONS OF INFORMATION SECURITY
Journal
Informatics and Applications
2019, Volume 13, Issue 3, pp 3-8
Cover Date
2019-09-30
DOI
10.14357/19922264190301
Print ISSN
1992-2264
Publisher
Institute of Informatics Problems, Russian Academy of Sciences
Additional Links
Key words
information security; information spaces; behavioral signs of a violator of information security
Authors
A. A. Grusho  , N. A. Grusho , and E. E. Timonina
Author Affiliations
Institute of Informatics Problems, Federal Research Center "Computer Science and Control" of the Russian Academy of Sciences, 44-2 Vavilov Str., Moscow 119333, Russian Federation
|