Towards Process Mining Utilization in Insider Threat Detection from Audit Logs

Logo poskytovatele

Varování

Publikace nespadá pod Filozofickou fakultu, ale pod Ústav výpočetní techniky. Oficiální stránka publikace je na webu muni.cz.
Autoři

MACÁK Martin VANÁT Ivan MERJAVÝ Michal JEVOČIN Tomáš BÜHNOVÁ Barbora

Rok publikování 2020
Druh Článek ve sborníku
Konference 2020 Seventh International Conference on Social Networks Analysis, Management and Security (SNAMS)
Fakulta / Pracoviště MU

Ústav výpočetní techniky

Citace
www https://ieeexplore.ieee.org/document/9336573
Doi http://dx.doi.org/10.1109/SNAMS52053.2020.9336573
Klíčová slova process mining; insider threat; audit log
Popis Nowadays, insider threats are one of the most significant cybersecurity threats. They are much more difficult to detect than external threats since insiders are authorized employees with legitimate access to the organization's resources. Malicious insider knows the organization and can act inconspicuously. Furthermore, threats do not even have to be intentional. Therefore, there can be a complicated background of malicious insider behavior, making it challenging to react adequately to these threats. In this paper, we propose to utilize process mining for insider threat detection using the organization's audit logs. We present the three different types of process mining utilization for insider threat detection from audit logs and discuss their usefulness, namely visual analysis, conformance checking, and declarative conformance checking. Lastly, we give recommendations for future work in this area based on our experience.
Související projekty:

Používáte starou verzi internetového prohlížeče. Doporučujeme aktualizovat Váš prohlížeč na nejnovější verzi.