An Organizational Role-based Extrusion Detection Model with Profile Migration - Ghosh, Tirthankar; Abeykoon, Kasun; Abeykoon, Thusith (Discoveries in Agriculture and Food Sciences, 2014)
Intrusion detection and prevention systems play a crucial role in the overall information security implementation of today’s organizations. Traditionally, signature-based and anomaly-based detections have been the two main methods of detection and prevention techniques. Signature-based intrusion detection systems are excellent in detection and performance, but they are vulnerable to unknown threats like zero-day attacks. Extensive research have been conducted on anomaly detection and prevention based on users’ behavior profiling. However, as insider attacks increase, it has become equally important to monitor and analyze extrusion attempts. Behavior-based profile creation has a promising future in extrusion monitoring. However, profiling individual behavior has its limitations in that it tends to incorporate unintended behavior into the normal profile. In this study, user’s organizational role has been integrated into profile creation further reducing number of false positives. A prototype of the model is tested with three users belonging to three different roles. A profile migration scheme is proposed to import user profiles at various login location.