Insider attack and real-time data mining of user behavior

IBM Journal of Research and Development

Volumn 51, Issue 3-4, 2007, Pages 465-475

  Anderson, Gary F ^a   Selby, David A ^b   Ramsey, Mark ^a  

^a IBM   (United States)

^b IBM   (United Kingdom)

Author keywords

[No Author keywords available]

Indexed keywords

DECISION MAKING; FINANCE; MATHEMATICAL MODELS; PERSONNEL;

BEHAVIOR-ANOMALY-BASED SYSTEM; COMPOSITE FEATURE MODELING; IDENTITY RISK AND INVESTIGATION SOLUTION (IRIS); PEER-GROUP PROFILING; REAL-TIME STATISTICAL DATA MINING;

DATA MINING;

EID: 34547452580     PISSN: 00188646     EISSN: 00188646     Source Type: Journal    
DOI: 10.1147/rd.513.0465     Document Type: Article

References (11)

1. J. P. Anderson, "Computer Security Threat Monitoring and Surveillance," Technical Report, James P. Anderson Company, Fort Washington, PA, April 1980; see http://csrc.nist.gov/publications/ history/ande80.pdf.
2. A. H. Phyo and S. M. Furnell, "A Detection-Oriented Classification of Insider IT Misuse," Proceedings of the Third Security Conference, Las Vegas, NV, April 14-15, 2004.
3. D. E. Denning, "An Intrusion Detection Model," IEEE Trans. Software Eng. 13, No. 2, 222-232 (1987).
4. S. Kumar, "Classification and Detection of Computer Intrusions," Ph.D. Dissertation, Purdue University, Lafayette, IN, August 1995.
5. A. Lazarevic, L. Ertoz, V. Kumar, A. Ozgur, and J. Srivastava, "A Comparative Study of Anomaly Detection Schemes in Network Intrusion Detection," Proceedings of the Third SIAM Conference on Data Mining, San Francisco, CA, 2003; see http://www.siam.org/meetings /sdm03/proceedings/sdm03_03.pdf.
6. S. Berinato, "The Global State of Information Security 2005," September 15, 2005; see http://www.cio.com/archive/091505/ global.html.
7. CSO magazine,"2005 E-Crime Watche Survey, Summary of Findings"; see http://www.cert.org/archive/pdf/ ecrimesummary05.pdf.
8. M. Randazzo, M. Keeney, E. Kowalski, D. Cappelli, and A. Moore, "Insider Threat Study: Illicit Cyber Activity in the Banking and Finance Sector," Carnegie Mellon University Software Engineering Institute, Technical Report CMU/SEI-2004-TR-021, 2004; see http://www.sei.cmu.edu/publications/documents/04.reports/ 04tr021.html.
9. A. Litan, "ChoicePoint Fraud Case Shows Need for Security Controls," February 22, 2005, ID No. G00126448, Gartner, Inc.; see http://www.gartner.com/resources/126400/126448/ choicepoint_fra.pdf.
10. D. Yachin, "Combating Insider Threats: The Application-Level User Behavior Tracking Approach," IDC White Paper sponsored by Intellinx, 2006; see http://www.intellinx-sw.com/pdf/ IDC_White_Paper_Combating_Insider_Threats.pdf.
11. J. A. Brown, "A Development of APL2 Syntax," IBM J. Res. & Dev. 29, No. 1, 37-48 (1985).