Enhancing Insider Threat Detection through Integrated Behavioral, Signature and Anomaly based Detection Methods
Keerthana Palaparthy
Computer Science and Engineering (Cyber Security)
Institute of Aeronautical Engineering
Dundigal, Hyderabad 21951A6214@iare.ac.in
Y. Manohar Reddy Asst. Professor
Computer Science and Engineering (Cyber Security)
Institute of Aeronautical Engineering
Dundigal, Hyderabad y.manoharreddy@iare.ac.in
Jatoth Victor Paul
Computer Science and Engineering (Cyber Security)
Institute of Aeronautical Engineering
Dundigal, Hyderabad 21951A6260@iare.ac.in
S Raju
Computer Science and Engineering (Cyber Security)
Institute of Aeronautical Engineering
Dundigal, Hyderabad 22955A6204@iare.ac.in
Abstract— Insider threats present substantial risks to organizational security, as malicious actors exploit their authorized access to systems, networks, or data to perpetrate harmful activities. These threats encompass various forms, including data theft, sabotage, fraud, or espionage, leading to significant financial losses, reputational damage, or regulatory penalties. Traditional approaches to insider threat detection, such as anomaly-based, signature-based, and behavioral analysis methods, have inherent limitations, including high false positives, reliance on known patterns, and lack of contextual understanding. These approaches often fail to classify insider threats accurately, potentially leading to innocent insiders being mislabeled as malicious. In this project, a unified insider threat detection system is proposed, integrating anomaly-based, signature- based, and behavioral analysis methods using Support Vector Machines (SVMs). By combining these methods and leveraging the strengths of SVMs, the aim is to address the limitations of individual approaches and enhance detection accuracy. Weighted voting is employed to fuse the output of each detection method, providing a comprehensive likelihood estimate of insider threats. This integrated approach enables organizations to better identify and mitigate insider threats, safeguarding sensitive assets and maintaining a robust security posture.
Keywords— Insider threat, Insider threat detection, Signature- based detection, Anomaly-based detection, Behavior analysis, False positives, Detection accuracy, Weighted Voting Mechanism.
