GraphCH: A Deep Framework for Assessing Cyber-Human Aspects in Insider Threat Detection

Roy, Krishna C.; Chen, Guenevere

doi:10.1109/tdsc.2024.3353929

GraphCH: A Deep Framework for Assessing Cyber-Human Aspects in Insider Threat Detection

Journal Article · Sun Jan 14 23:00:00 EST 2024 · IEEE Transactions on Dependable and Secure Computing

DOI:https://doi.org/10.1109/tdsc.2024.3353929· OSTI ID:2283230

^[1]; ^[2]

New Mexico Institute of Mining and Technology, Socorro, NM (United States); University of Texas at San Anton
University of Texas at San Antonio, TX (United States)

Insider threat is one of the most damaging cyber attacks that could cause the loss of intellectual property and enterprise data security breaches. Action sequence data such as host logs are used to investigate such threats and develop anomaly-based AI detectors. However, insider threat actions are similar to legitimate user activities, causing AI detectors to fail and suffer from high false alarm rates. Therefore, user cyber activity logs are inadequate to fully unfold insider threats. In this study, we adopt human psychological principles of risk-taking and impulsiveness along with host data to assess the influence and usefulness of human behavioral aspects in insider threat detection. Here, we hypothesize that individuals' impulsive and risk-taking behavior correlates with cyberspace activities. To validate our hypothesis, we conducted an IRB-approved study recruiting 35 participants who work in a large U.S. university and collected their cyber and psychological data for 90 days. Host and human-behavioral data analysis and mapping indicate that impulsive and risk-taking users trigger more system errors causing (un)intentional insider threats and are susceptible to attackers' social engineering and cognitive hacking. Utilizing cyber-human aspects, we introduce a Cyber-Human Graph Neural Network (GNN) based framework GraphCH to identify abnormal user behaviors and detect insider threats.

View Accepted Manuscript (DOE)

Research Organization:: University of Texas at San Antonio, TX (United States)

Sponsoring Organization:: USDOE Office of Nuclear Energy (NE); USDOE National Nuclear Security Administration (NNSA)

Grant/Contract Number:: NA0003985

OSTI ID:: 2283230

Alternate ID(s):: OSTI ID: 2283237

Journal Information:: IEEE Transactions on Dependable and Secure Computing, Journal Name: IEEE Transactions on Dependable and Secure Computing Journal Issue: 5 Vol. 21; ISSN 1545-5971

Publisher:: IEEECopyright Statement

Country of Publication:: United States

Language:: English

References (30)

DeepRan: Attention-based BiLSTM and CRF for Ransomware Early Detection and Classification Roy, Krishna Chandra; Chen, Qian Information Systems Frontiers, Vol. 23, Issue 2 https://doi.org/10.1007/s10796-020-10017-4	journal	June 2020
Deep learning for insider threat detection: Review, challenges and opportunities Yuan, Shuhan; Wu, Xintao Computers & Security, Vol. 104 https://doi.org/10.1016/j.cose.2021.102221	journal	May 2021
Exposing the darkness within: A review of dark personality traits, models, and measures and their relationship to insider threats Harms, P. D.; Marbut, Alexander; Johnston, Allen C. Journal of Information Security and Applications, Vol. 71 https://doi.org/10.1016/j.jisa.2022.103378	journal	December 2022
Heroin addicts have higher discount rates for delayed rewards than non-drug-using controls. Kirby, Kris N.; Petry, Nancy M.; Bickel, Warren K. Journal of Experimental Psychology: General, Vol. 128, Issue 1 https://doi.org/10.1037/0096-3445.128.1.78	journal	March 1999
Evaluation of a behavioral measure of risk taking: The Balloon Analogue Risk Task (BART). Lejuez, C. W.; Read, Jennifer P.; Kahler, Christopher W. Journal of Experimental Psychology: Applied, Vol. 8, Issue 2 https://doi.org/10.1037/1076-898X.8.2.75	journal	January 2002
Insider Threat Detection via Hierarchical Neural Temporal Point Processes Yuan, Shuhan; Zheng, Panpan; Wu, Xintao 2019 IEEE International Conference on Big Data (Big Data) https://doi.org/10.1109/BigData47090.2019.9005589	conference	December 2019
Insider Threat Detection Based on Deep Belief Network Feature Representation Lin, Lingli; Zhong, Shangping; Jia, Cunmin 2017 International Conference on Green Informatics (ICGI) https://doi.org/10.1109/ICGI.2017.37	conference	August 2017
Automated Behavioral Analysis of Malware: A Case Study of WannaCry Ransomware Chen, Qian; Bridges, Robert A. 2017 16th IEEE International Conference on Machine Learning and Applications (ICMLA) https://doi.org/10.1109/ICMLA.2017.0-119	conference	December 2017
ExHPD: Exploiting Human, Physical, and Driving Behaviors to Detect Vehicle Cyber Attacks Chen, Qian; Romanowich, Paul; Castillo, Jorge IEEE Internet of Things Journal, Vol. 8, Issue 18 https://doi.org/10.1109/JIOT.2021.3069951	journal	September 2021
Multi-Domain Information Fusion for Insider Threat Detection Eldardiry, Hoda; Bart, Evgeniy 2013 IEEE Security and Privacy Workshops https://doi.org/10.1109/SPW.2013.14	conference	May 2013
Training regime influences to semi-supervised learning for insider threat detection Le, Duc C.; Zincir-Heywood, Nur; Heywood, Malcolm 2021 IEEE Security and Privacy Workshops (SPW) https://doi.org/10.1109/SPW53761.2021.00010	conference	May 2021
Platform-Dependent Computer Security Complacency: The Unrecognized Insider Threat Stafford, Thomas F. IEEE Transactions on Engineering Management, Vol. 69, Issue 6 https://doi.org/10.1109/TEM.2021.3058344	journal	December 2022
A Survey on Network Embedding Cui, Peng; Wang, Xiao; Pei, Jian IEEE Transactions on Knowledge and Data Engineering, Vol. 31, Issue 5 https://doi.org/10.1109/TKDE.2018.2849727	journal	May 2019
DANTE: Predicting Insider Threat using LSTM on system logs Ma, Qicheng; Rastogi, Nidhi 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) https://doi.org/10.1109/TrustCom50675.2020.00153	conference	December 2020
Insider Threat Detection Through Attributed Graph Clustering Gamachchi, Anagi; Boztas, Serdar 2017 IEEE Trustcom/BigDataSE/ICESS https://doi.org/10.1109/Trustcom/BigDataSE/ICESS.2017.227	conference	August 2017
Cyber security data sources for dynamic network research Kent, Alexander D. Dynamic Networks and Cyber-Security https://doi.org/10.1142/9781786340757_0002	book	March 2016
Unified Host and Network Data Set Turcotte, Melissa J. M.; Kent, Alexander D.; Hash, Curtis Security Science and Technology https://doi.org/10.1142/9781786345646_001	book	September 2018
DeepWalk: online learning of social representations Perozzi, Bryan; Al-Rfou, Rami; Skiena, Steven Proceedings of the 20th ACM SIGKDD international conference on Knowledge discovery and data mining - KDD '14 https://doi.org/10.1145/2623330.2623732	conference	January 2014
LINE: Large-scale Information Network Embedding Tang, Jian; Qu, Meng; Wang, Mingzhe WWW '15: 24th International World Wide Web Conference, Proceedings of the 24th International Conference on World Wide Web https://doi.org/10.1145/2736277.2741093	conference	May 2015
Malicious Behavior Detection using Windows Audit Logs Berlin, Konstantin; Slater, David; Saxe, Joshua Proceedings of the 8th ACM Workshop on Artificial Intelligence and Security https://doi.org/10.1145/2808769.2808773	conference	October 2015
Fraud Detection through Graph-Based User Behavior Modeling Beutel, Alex; Akoglu, Leman; Faloutsos, Christos Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security https://doi.org/10.1145/2810103.2812702	conference	October 2015
node2vec: Scalable Feature Learning for Networks Grover, Aditya; Leskovec, Jure Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining - KDD '16 https://doi.org/10.1145/2939672.2939754	conference	January 2016
metapath2vec Dong, Yuxiao; Chawla, Nitesh V.; Swami, Ananthram Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining https://doi.org/10.1145/3097983.3098036	conference	August 2017
Heterogeneous Graph Neural Networks for Malicious Account Detection Liu, Ziqi; Chen, Chaochao; Yang, Xinxing Proceedings of the 27th ACM International Conference on Information and Knowledge Management https://doi.org/10.1145/3269206.3272010	conference	October 2018
Heterogeneous Graph Neural Network Zhang, Chuxu; Song, Dongjin; Huang, Chao Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining https://doi.org/10.1145/3292500.3330961	conference	July 2019
Heterogeneous Graph Attention Network Wang, Xiao; Ji, Houye; Shi, Chuan The World Wide Web Conference https://doi.org/10.1145/3308558.3313562	conference	May 2019
Log2vec Liu, Fucheng; Wen, Yu; Zhang, Dongxue Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security https://doi.org/10.1145/3319535.3363224	conference	November 2019
Modeling Users’ Behavior Sequences with Hierarchical Explainable Network for Cross-domain Fraud Detection Zhu, Yongchun; Xi, Dongbo; Song, Bowen Proceedings of The Web Conference 2020 https://doi.org/10.1145/3366423.3380172	conference	April 2020
Graph Based Framework for Malicious Insider Threat Detection Gamachchi, Anagi; Sun, Li; Boztas, Serdar Proceedings of the Annual Hawaii International Conference on System Sciences https://doi.org/10.24251/hicss.2017.319	conference	January 2017
Modeling Human Behavior to Anticipate Insider Attacks Greitzer, Frank L.; Hohimer, Ryan E. Journal of Strategic Security, Vol. 4, Issue 2 https://doi.org/10.5038/1944-0472.4.2.2	journal	June 2011

Similar Records

Artificial Intelligence for Digital Security and Protections

Technical Report · Mon Nov 30 23:00:00 EST 2020 · OSTI ID:1847906

Analytic framework for the United States cyber deterrence strategy. Final draft, 2nd submission (20 May 2015]

Technical Report · Sun Jan 31 23:00:00 EST 2016 · OSTI ID:1762023

Related Subjects

97 MATHEMATICS AND COMPUTING
Graph neural network
heterogeneous information network
host data
human factors
insider threat

GraphCH: A Deep Framework for Assessing Cyber-Human Aspects in Insider Threat Detection

Citation Formats

References (30)

Similar Records

Related Subjects