Probabilistic Graphical Model on Detecting Insiders: Modeling with SGD-HMM

Ahmed Saaudi, Yan Tong, Csilla Farkas

2019

Abstract

This paper presents a novel approach to detect malicious behaviors in computer systems. We propose the use of varying granularity levels to represent users’ log data: Session-based, Day-based, and Week-based. A user’s normal behavior is modeled using a Hidden Markov Model. The model is used to detect any deviation from the normal behavior. We also propose a Sliding Window Technique to identify malicious activity effectively by considering the near history of user activity. We evaluated our results using Receiver Operating Characteristic curves (or ROC curves). Our evaluation shows that the results are superior to existing research by improving the detection ability and reducing the false positive rate. Combining sliding window technique with session-based system gives a fast detection performance.

Paper Citation

in Harvard Style

Saaudi A., Tong Y. and Farkas C. (2019). Probabilistic Graphical Model on Detecting Insiders: Modeling with SGD-HMM.In Proceedings of the 5th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-359-9, pages 461-470. DOI: 10.5220/0007404004610470

in Bibtex Style

@conference{icissp19,
author={Ahmed Saaudi and Yan Tong and Csilla Farkas},
title={Probabilistic Graphical Model on Detecting Insiders: Modeling with SGD-HMM},
booktitle={Proceedings of the 5th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,},
year={2019},
pages={461-470},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0007404004610470},
isbn={978-989-758-359-9},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 5th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,
TI - Probabilistic Graphical Model on Detecting Insiders: Modeling with SGD-HMM
SN - 978-989-758-359-9
AU - Saaudi A.
AU - Tong Y.
AU - Farkas C.
PY - 2019
SP - 461
EP - 470
DO - 10.5220/0007404004610470