Document-Centric Insider Threat Detection in a University Laboratory Using Windows NTFS USN Change Journal

초록

University and public research laboratories are collaborative research and development environments where legitimate insiders may exfiltrate sensitive research documents. However, heavy monitoring (e.g., network/proxy telemetry and user-and-entity behavior analytics telemetry) is often impractical due to privacy, cost, and operational constraints. This paper presents a case study of document-centric insider threat detection using only Windows new technology file system (NTFS) update sequence number (USN) logs (i.e., the NTFS Change Journal), a lightweight forensic artifact available on commodity endpoints. The USN events are aggregated into host-by-hour slots and mapped to three high-risk behaviors: off-hour access, short-term input/output volume spikes, and suspicious renaming, using interpretable document-centric features. A calibrated gradient-boosting detector is evaluated under temporal holdout and cross-host transfer between two laboratory hosts. The proposed model achieves a receiver operating characteristic–area under the curve value of up to 0.86 and an F1-score of 0.77 ( y f i n a l ) while maintaining a low, stable alert budget quantified by two human-centric operational metrics: triage load per analyst (0.1 to 0.4 alerts/host/day) and Alert Stability Index (approximately 1.2 to 1.4). These results suggest that USN-only, document-centric telemetry can support deployable insider threat triage in resource-constrained research laboratories while preserving user privacy. Moreover, this work discusses the limitations and practical mitigation strategies for extreme class imbalance and transfer drift.

키워드