TIIS (한국인터넷정보학회)
Current Result Document :
| 한글제목(Korean Title) |
A study on Classification of Insider threat using Markov Chain Model |
| 영문제목(English Title) |
A study on Classification of Insider threat using Markov Chain Model |
| 저자(Author) |
Dong-Wook Kim
Sung-Sam Hong
Myung-Mook Han
|
| 원문수록처(Citation) |
VOL 12 NO. 04 PP. 1887 ~ 1898 (2018. 04) |
한글내용
(Korean Abstract) |
|
영문내용
(English Abstract) |
In this paper, a method to classify insider threat activity is introduced. The internal threats help detecting anomalous activity in the procedure performed by the user in an organization. When an anomalous value deviating from the overall behavior is displayed, we consider it as an inside threat for classification as an inside intimidator. To solve the situation, Markov Chain Model is employed. The Markov Chain Model shows the next state value through an arbitrary variable affected by the previous event. Similarly, the current activity can also be predicted based on the previous activity for the insider threat activity. A method was studied where the change items for such state are defined by a transition probability, and classified as detection of anomaly of the inside threat through values for a probability variable. We use the properties of the Markov chains to list the behavior of the user over time and to classify which state they belong to. Sequential data sets were generated according to the influence of n occurrences of Markov attribute and classified by machine learning algorithm. In the experiment, only 15% of the Cert: insider threat dataset was applied, and the result was 97% accuracy except for NaiveBayes. As a result of our research, it was confirmed that the Markov Chain Model can classify insider threats and can be fully utilized for user behavior classification.
|
| 키워드(Keyword) |
Insider threat
Markov Chain
Classification
|
| 파일첨부 |
PDF 다운로드
|
