By the same authors

From the same journal

Knowing Who to Watch: Efficiently Identifying Subtle Attackers

Research output: Contribution to journalArticle



Publication details

JournalInformation Systems Frontiers
DatePublished - Mar 2010
Issue number1
Number of pages18
Pages (from-to)17-34
Original languageEnglish


Insider attacks are often subtle and slow, or preceded by behavioral indicators such as organizational rulebreaking which provide the potential for early warning of malicious intent; both these cases pose the problem of identifying attacks from limited evidence contained within a large volume of event data collected from multiple sources over a long period. This paper proposes a scalable solution to this problem by maintaining long-term estimates that individuals or nodes are attackers, rather than retaining event data for post-facto analysis. These estimates are then used as triggers for more detailed investigation. We identify essential attributes of event data, allowing the use of a wide range of indicators, and show how to apply Bayesian statistics to maintain incremental estimates without global updating. The paper provides a theoretical account of the process, a worked example, and a discussion of its practical implications. The work includes examples that identify subtle attack behaviour in subverted network nodes, but the process is not network-specific and is capable of integrating evidence from other sources, such as behavioral indicators, document access logs and financial records, in addition to events identified by network monitoring.

Bibliographical note

This extended journal paper was invited to the special edition of the journal.

Discover related content

Find related publications, people, projects, datasets and more using interactive charts.

View graph of relations