접근 기록 분석 기반 적응형 이상 이동 탐지 방법론

초록

As data utilization and importance becomes important, data-related accidents and damages are gradually increasing. Esp ecially, insider threats are the most harmful threats. And these insider threats are difficult to detect by traditional security systems, so rule-based abnormal behavior detection method has been widely used. However, it has a lack of adapting fle xibly to changes in new attacks and new environments. Therefore, in this paper, we propose an adaptive anomaly movem ent detection framework based on a statistical Markov model to detect insider threats in advance. This is designed to mini mize false positive rate and false negative rate by adopting environment factors that directly influence the behavior, and le arning data based on statistical Markov model. In the experimentation, the framework shows good performance with a hig h F2-score of 0.92 and suspicious behavior detection, which seen as a normal behavior usually. It is also extendable to det ect various types of suspicious activities by applying multiple modeling algorithms based on statistical learning and enviro nment factors.

키워드