Insider threat detection and prevention using semantic score and dynamic multi-fuzzy classifier. (18th January 2023)

• Record Type: Journal Article
• Authors: Singh, Malvika; Sangeetha, S.; Mehtre, B.M.
• Is Part Of: International journal of ad hoc and ubiquitous computing. Volume 42:Number 2(2023)
• Page Start: 95
• Page End: 112
• Publication Date: 2023-01-18
• Subjects: insider threat detection -- ITD -- user behaviour analysis -- anomaly detection -- insider threat prevention -- ITP -- semantic analysis; Ubiquitous computing -- Periodicals; Embedded computer systems -- Periodicals; Electronic data processing -- Distributed processing -- Periodicals; Wireless communication systems -- Periodicals; Computer architecture -- Periodicals; 004.2
• Languages: English
• ISSNs: 1743-8225

Abstract

Insider threat detection methods are usually based on machine and deep learning techniques. They consider insider threat as an anomaly detection problem. These methods are sophisticated in detection, but result in high false positives, poor threat detection rates and do not prevent malicious insiders. In this paper, an automatic insider threat detection and prevention system is proposed. It involves: data pre-processing for removal of noise; isometric feature mapping to minimise information loss while extracting features from high dimensional space; the emperor penguin algorithm due to its effective exploitation and exploration for optimum feature selection; semantic score computation using a combination of SentiWordNet and deep-Q-learning; and use of multi-fuzzy classifier to handle a variety of features in parallel for fast processing. After detecting malicious insiders, further access to organisational resources is denied by performing authentication. The proposed method is tested on CMU-CERT r4.2 dataset and the results outperform the existing methods.