Insider threat detection enabled by converting user applications into fractal fingerprints and autonomously detecting anomalies

Holger M. Jaenisch; James Handley

doi:10.1117/12.914849

7 May 2012 Insider threat detection enabled by converting user applications into fractal fingerprints and autonomously detecting anomalies

Holger M. Jaenisch, James Handley

Author Affiliations +

Proceedings Volume 8408, Cyber Sensing 2012; 840802 (2012) https://doi.org/10.1117/12.914849
Event: SPIE Defense, Security, and Sensing, 2012, Baltimore, Maryland, United States

Abstract

We demonstrate insider threat detection for determining when the behavior of a computer user is suspicious or different from his or her normal behavior. This is accomplished by combining features extracted from text, emails, and blogs that are associated with the user. These sources can be characterized using QUEST, DANCER, and MenTat to extract features; however, some of these features are still in text form. We show how to convert these features into numerical form and characterize them using parametric and non-parametric statistics. These features are then used as input into a Random Forest classifier that is trained to recognize whenever the user's behavior is suspicious or different from normal (off-nominal). Active authentication (user identification) is also demonstrated using the features and classifiers derived in this work. We also introduce a novel concept for remotely monitoring user behavior indicator patterns displayed as an infrared overlay on the computer monitor, which the user is unaware of, but a narrow pass-band filtered webcam can clearly distinguish. The results of our analysis are presented.

Citation Download Citation

Holger M. Jaenisch and James Handley "Insider threat detection enabled by converting user applications into fractal fingerprints and autonomously detecting anomalies", Proc. SPIE 8408, Cyber Sensing 2012, 840802 (7 May 2012); https://doi.org/10.1117/12.914849

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available