Towards effective defense against insider attacks: The establishment of defender's reputation

Nan Zhang; Wei Yu; Xinwen Fu; Sajal K. Das

doi:10.1109/ICPADS.2008.85

Towards effective defense against insider attacks: The establishment of defender's reputation

Nan Zhang, Wei Yu, Xinwen Fu, Sajal K. Das

College of Information Sciences and Technology

Research output: Contribution to journal › Conference article › peer-review

2 Scopus citations

Abstract

We address issues related to the establishment of defender's reputation in anomaly detection against insider attacks. We consider two types of attackers: smart insiders, which learn from historic attacks and adapt their strategies to avoid detection/punishment, and naïve attackers, which blindly launch their attacks. We introduce two novel reputation-establishment algorithms for systems with solely smart insiders and systems with both smart insiders and naïve attackers, respectively. Theoretical analysis and simulation results show that our reputation-establishment algorithms can significantly improve the performance of anomaly detection against insider attacks in terms of the tradeoff between detection and false positives.

Original language	English (US)
Article number	4724358
Pages (from-to)	501-508
Number of pages	8
Journal	Proceedings of the International Conference on Parallel and Distributed Systems - ICPADS
DOIs	https://doi.org/10.1109/ICPADS.2008.85
State	Published - 2008
Event	2008 14th IEEE International Conference on Parallel and Distributed Systems, ICPADS'08 - Melbourne, VIC, Australia Duration: Dec 8 2008 → Dec 10 2008

All Science Journal Classification (ASJC) codes

Hardware and Architecture

Access to Document

10.1109/ICPADS.2008.85

Cite this

@article{3823656575814148bef71643e6756c74,

title = "Towards effective defense against insider attacks: The establishment of defender's reputation",

abstract = "We address issues related to the establishment of defender's reputation in anomaly detection against insider attacks. We consider two types of attackers: smart insiders, which learn from historic attacks and adapt their strategies to avoid detection/punishment, and na{\"i}ve attackers, which blindly launch their attacks. We introduce two novel reputation-establishment algorithms for systems with solely smart insiders and systems with both smart insiders and na{\"i}ve attackers, respectively. Theoretical analysis and simulation results show that our reputation-establishment algorithms can significantly improve the performance of anomaly detection against insider attacks in terms of the tradeoff between detection and false positives.",

author = "Nan Zhang and Wei Yu and Xinwen Fu and Das, {Sajal K.}",

year = "2008",

doi = "10.1109/ICPADS.2008.85",

language = "English (US)",

pages = "501--508",

journal = "Proceedings of the International Conference on Parallel and Distributed Systems - ICPADS",

issn = "1521-9097",

note = "2008 14th IEEE International Conference on Parallel and Distributed Systems, ICPADS'08 ; Conference date: 08-12-2008 Through 10-12-2008",

}

TY - JOUR

T1 - Towards effective defense against insider attacks

T2 - 2008 14th IEEE International Conference on Parallel and Distributed Systems, ICPADS'08

AU - Zhang, Nan

AU - Yu, Wei

AU - Fu, Xinwen

AU - Das, Sajal K.

PY - 2008

Y1 - 2008

N2 - We address issues related to the establishment of defender's reputation in anomaly detection against insider attacks. We consider two types of attackers: smart insiders, which learn from historic attacks and adapt their strategies to avoid detection/punishment, and naïve attackers, which blindly launch their attacks. We introduce two novel reputation-establishment algorithms for systems with solely smart insiders and systems with both smart insiders and naïve attackers, respectively. Theoretical analysis and simulation results show that our reputation-establishment algorithms can significantly improve the performance of anomaly detection against insider attacks in terms of the tradeoff between detection and false positives.

AB - We address issues related to the establishment of defender's reputation in anomaly detection against insider attacks. We consider two types of attackers: smart insiders, which learn from historic attacks and adapt their strategies to avoid detection/punishment, and naïve attackers, which blindly launch their attacks. We introduce two novel reputation-establishment algorithms for systems with solely smart insiders and systems with both smart insiders and naïve attackers, respectively. Theoretical analysis and simulation results show that our reputation-establishment algorithms can significantly improve the performance of anomaly detection against insider attacks in terms of the tradeoff between detection and false positives.

UR - http://www.scopus.com/inward/record.url?scp=60649109009&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=60649109009&partnerID=8YFLogxK

U2 - 10.1109/ICPADS.2008.85

DO - 10.1109/ICPADS.2008.85

M3 - Conference article

AN - SCOPUS:60649109009

SN - 1521-9097

SP - 501

EP - 508

JO - Proceedings of the International Conference on Parallel and Distributed Systems - ICPADS

JF - Proceedings of the International Conference on Parallel and Distributed Systems - ICPADS

M1 - 4724358

Y2 - 8 December 2008 through 10 December 2008

ER -

Towards effective defense against insider attacks: The establishment of defender's reputation

Abstract

All Science Journal Classification (ASJC) codes

Access to Document

Other files and links

Fingerprint

Cite this