DETECTING AUTOMATED AGENTS BASED INSIDER ATTACKS THROUGH ADJACENCY MATRIX ANALYSIS

DETECTING AUTOMATED AGENTS BASED INSIDER ATTACKS THROUGH ADJACENCY MATRIX ANALYSIS

Abstract

An insider attack is an attack to an organization that comes from people in the organization, namely insiders. Since insiders are often familiar with the organization’s data and intellectual property and have legitimate access to the organization’s internal network, insider attacks could be very subtle and more difficult to detect than attacks from outsiders.

We focus on an emerging type of insider attacks, which are taken out by automated software agents (not humans) that have legitimate access to the organization’s information systems. The software agents impersonate legitimate users and are commanded to conduct malicious actions. Insider attacks based on software agents can hardly be detected using host-based Intrusion Detection Systems (IDS), e.g. Snort and Samhain, due to the heterogeneity of software agents in different cases. Some of the existing research works address single-actor insider attacks, in each of which only one malicious user or software agent is involved.

In this thesis, we go beyond the single-actor scenario and investigate the insider attack detection in multi-agent colluding scenarios. The software agents take charge of different aspects of an attack, and collaborate to accomplish the attack. Since the malicious actions are dispersed to many software agents, the multi-agent insider attacks from the angle of computer actions could be extremely subtle. The unpredictability of the attack missions further hampers the detection. We make an observation that the collaboration among the software agents adds to the normal collaboration among users, and the activities of the software agents are reflected on the change of collaboration structure within the organization. Based on the observation, we propose to use adjacency matrix analysis to study the collaboration among users, and detect the insider attacks through identifying the anomalous collaboration caused by the software agents. We evaluate the performance of our approach using a data set generated by a high-fidelity simulator. The advantages and limitations of this approach are discussed in detail, and practical insights on applying it in real-world environments are provided.

 

Chapter 1 |

Introduction

An insider attack is an attack that comes from people in the organization, namely insiders. The 2014 US state of cybercrime survey shows that 26% of the cyber security incidents come from insiders [1] [2] . Insider threats have been recognized as a top cyber-security problem, due to its widespreadness and damaging aftermath [3] . To avoid detection and achieve the designated goals, an insider mission can be accomplished through installation of automated software agents (e.g., malware and spyware) inside the organization. The malicious insider can then command these agents to carry out the insider mission and launch passive or active attacks against the organization’s information system.

In general, insider attacks are difficult to detect due to the following reasons.

Insider attacks are often unpredictable and different case by case. Existing IDSs rely on the patterns extracted from known exploits to detect the occurrence of attacks. They can only detect the attacks that have the same patterns with known attacks. Since insider attacks are often different case by case [4] , the existing rule based IDSs are ineffective in detecting them.

Automated agents might obfuscate their behaviors to avoid detection. Although the malicious actions might deviate from the normal behavior patterns, the agents mix the malicious actions with normal behaviors and thus avoid detection. By behavior, we mean the cyberspace events generated by the execution of automated agents or the actions of human users.

Previously, research on insider attack detection mainly focused on attacks launched by human attackers, such as masquerader attacks [5–10] . A masquerader is typically a person who successfully steals the credentials of a legitimate user account and impersonates the victim to conduct malicious activities. These approaches assume that the masqueraders’ behavior patterns are different from those of the victims, and have no knowledge about the victims’ behavior patterns and thus cannot mimic the victims. Under this assumption, it is possible to detect malicious masqueraders through detecting abnormal behaviors that deviate from users’ historical behaviors.

Different from masquerader attacks, software-agent based multi-dimensional insider attacks have the following characteristics. In an attack of such type, different dimensions of the attack mission are dispersed to a number of automated agents, and be obfuscated to look significantly less abnormal. For example, a successful insider mission would include several dimensions including, in addition to conducting malicious actions, doing preparations such as reconnaissance, monitoring after malicious actions in order to confirm success, evasion actions such as removing traces, etc. Different automated agents work on different dimensions of the insider mission to achieve the malicious goals and evade detection.

This type of insider attacks is difficult to detect due to the following reasons. First, in such multi-dimensional insider attacks, malicious actions of each automated agent are more likely to be overlooked. Each automated agent might compromise one or more accounts to conduct malicious actions. Since each agent only conducts a small portion of the attack mission, its actions might seem irrelevant to any malicious goals and get ignored. Due to this reason, traditional masquerader attack detection techniques are unsuitable for detecting such attacks. Secondly, the behavior patterns of heterogeneous accounts are complicated and difficult to model. It is nontrivial to model the normal behavior patterns and define the criteria of outliers. Finally, the automated agents might obfuscate the malicious actions, e.g. through mixing malicious actions with normal actions, to avoid detection. Due to these reasons, software-agent based multi-dimensional insider missions are hard to detect. Ulrich Flegel et al [11] examined the technical and legal requirements for multi-dimensional insider mission detection. But to our best knowledge, there is no published approach for detecting software-agent based multi-dimensional insider attacks, and our work is the first attempt to approach this problem in a computational way.

Our work focuses on software-agent based multi-dimensional insider attacks in workflow (aka business processes) oriented organizations. We propose to detect this type of attacks through detecting the anomalous collaboration among accounts caused by malicious software agents. In a workflow oriented work environment, such as banks or credit card companies, different accounts of the information systems have access to different aspects of the systems. In each workflow, several accounts work on different steps or procedures and collaborate to keep the business running. Usually, the collaboration structure stays stable as long as the role of each account does not change. When insider attacks happen, the collaboration caused by software agents adds to the normal collaboration structure.

Through identifying the deviation of collaboration structure, we can detect the happening of insider attacks. In particular, we split the event list of an organization, which is simulated by a high-fidelity simulation engine, into a number of time windows, and extract the adjacency matrix of each time window to capture the collaboration structure. The value of adjacency measures the strength of collaboration between two accounts. We then transform the extracted adjacency matrices to remove noises, and obtain a list of vectors, each of which characterizes the collaboration structure of a time window. Finally, we train a probability density model based on the training vectors, and use the model to detect time windows where insider attacks happen. The time windows with low probability density are identified as anomalous.

Our main contributions are as follows.

We model the detection of software-agent based multi-dimensional attacks as an outlier detection problem.

We propose a scheme to model the collaboration between user-accounts using adjacency matrices.

We convert the matrices, extracted from time windows, into feature vectors to facilitate statistical analysis.

We evaluate effects of various factors on the detection accuracy.

The rest of the paper is organized as follows. In section 2, we introduce the motivation of this work, and the models and assumptions used in this work. In section 3, we describe the details of the adjacency matrix analysis approach for insider attack detection. In section 4, we present the evaluation of our approach. We introduce the related works in section 5. We discuss some limitations and insights in section 6, and conclude our paper in section 7.

DETECTING AUTOMATED AGENTS BASED INSIDER ATTACKS THROUGH ADJACENCY MATRIX ANALYSIS

Sharing is caring!