| Title | DANTE: Predicting Insider Threat using LSTM on system logs |
| Publication Type | Conference Paper |
| Year of Publication | 2020 |
| Authors | Ma, Qicheng, Rastogi, Nidhi |
| Conference Name | 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) |
| Date Published | dec |
| Keywords | Cancer, CERT dataset, data privacy, information and communication technology, insider threat, logs, LSTM, Measurement, Natural languages, Predictive models, privacy, pubcrawl, Recurrent neural networks, RNN, security, threat vectors |
| Abstract | Insider threat is one of the most pernicious threat vectors to information and communication technologies (ICT) across the world due to the elevated level of trust and access that an insider is afforded. This type of threat can stem from both malicious users with a motive as well as negligent users who inadvertently reveal details about trade secrets, company information, or even access information to malignant players. In this paper, we propose a novel approach that uses system logs to detect insider behavior using a special recurrent neural network (RNN) model. Ground truth is established using DANTE and used as baseline for identifying anomalous behavior. For this, system logs are modeled as a natural language sequence and patterns are extracted from these sequences. We create workflows of sequences of actions that follow a natural language logic and control flow. These flows are assigned various categories of behaviors - malignant or benign. Any deviation from these sequences indicates the presence of a threat. We further classify threats into one of the five categories provided in the CERT insider threat dataset. Through experimental evaluation, we show that the proposed model can achieve 93% prediction accuracy. |
| DOI | 10.1109/TrustCom50675.2020.00153 |
| Citation Key | ma_dante_2020 |
DANTE: Predicting Insider Threat using LSTM on system logs