Skip to main content

Research Repository

Advanced Search

Insider Threats: Identifying Anomalous Human Behaviour in Heterogeneous Systems Using Beneficial Intelligent Software (Ben-ware)

McGough, A. Stephen; Wall, David; Brennan, John; Theodoropoulos, Georgios; Ruck-Keene, Ed; Arief, Budi; Gamble, Carl; Fitzgerald, John; van Moorsel, Aad

Authors

A. Stephen McGough

David Wall

John Brennan

Georgios Theodoropoulos

Ed Ruck-Keene

Budi Arief

Carl Gamble

John Fitzgerald

Aad van Moorsel



Abstract

In this paper, we present the concept of "Ben-ware" as a beneficial software system capable of identifying anomalous human behaviour within a 'closed' organisation's IT infrastructure. We note that this behaviour may be malicious (for example, an employee is seeking to act against the best interest of the organisation by stealing confidential information) or benign (for example, an employee is applying some workaround to complete their job). To help distinguish between users who are intentionally malicious and those who are benign, we use human behaviour modelling along with Artificial Intelligence. Ben-ware has been developed as a distributed system comprising of probes for data collection, intermediate nodes for data routing and higher nodes for data analysis. This allows for real-time analysis with low impact on the overall infrastructure, which may contain legacy and low-power resources. We present an analysis of the appropriateness of the Ben-ware system for deployment within a large closed organisation, comprising of both new and legacy hardware, to protect its essential information. This analysis is performed in terms of the memory footprint, disk footprint and processing requirements of the different parts of the system.

Citation

McGough, A. S., Wall, D., Brennan, J., Theodoropoulos, G., Ruck-Keene, E., Arief, B., …van Moorsel, A. (2015). Insider Threats: Identifying Anomalous Human Behaviour in Heterogeneous Systems Using Beneficial Intelligent Software (Ben-ware). In 7th ACM CCS International Workshop on Managing Insider Security Threats, MIST '15, 12-16 October 2015, Denver, Colorado ; proceedings (1-12). https://doi.org/10.1145/2808783.2808785

Conference Name Proceedings of the 7th ACM CCS International Workshop on Managing Insider Security Threats - MIST '15
Conference Location Denver, USA
Publication Date Jan 1, 2015
Deposit Date Nov 18, 2015
Publicly Available Date Mar 28, 2024
Publisher Association for Computing Machinery (ACM)
Pages 1-12
Book Title 7th ACM CCS International Workshop on Managing Insider Security Threats, MIST '15, 12-16 October 2015, Denver, Colorado ; proceedings.
DOI https://doi.org/10.1145/2808783.2808785
Keywords Insider threats, Detection, Anomalous behaviour, Human behaviour, Artificial intelligence, Assistive tool, Ethics

Files

Accepted Conference Proceeding (0)
PDF

Copyright Statement
© 2015 ACM. This is the author's version of the work. It is posted here by permission of ACM for your personal use. Not for redistribution. The definitive version was published in 7th ACM CCS International Workshop on Managing Insider Security Threats, MIST '15, 12-16 October 2015, Denver, Colorado ; proceedings, 2015, http://dx.doi.org/10.1145/2808783.2808785




You might also like



Downloadable Citations