Ontology for Insider Threat Indicators

October 1, 2015

Carnegie Mellon University, Pittsburgh, Pennsylvania

The study of insider threat presents some of the most complex challenges in information security. Even defining the insider threat has proven difficult, with interpretations and scope varying depending on the problem space. Organizations have begun to acknowledge the importance of detecting and preventing insider threats, but there is a surprising lack of standards within the insider threat domain to assist in the development, description, testing, and sharing of these techniques. For many organizations, establishing an insider threat program and beginning to look for potentially malicious insider activity is a new business activity.

The primary goal of this effort is to support the creation, sharing, and analysis of indicators of insider threat. Because insider data is sensitive, insider threat teams often work only with data from inside their own organizations. These records frequently include documented employee behaviors, intellectual property, employee activity on networks, and information on organizational proprietary networks and information technology (IT) architecture. A shared ontology will allow teams to share indicators of insider threat without disclosing their own sensitive data. The desired outcome is to facilitate information sharing on effective indicators of malicious insider activity across organizations, with an emphasis on extensibility, semi-automation, and the ability for community members to benefit from investigations and analysis performed by others.

This work involves gathering and analyzing data from public (e.g., media reports, court documents, and other publications) and nonpublic (e.g., law enforcement investigations, internal investigations from other organizations, interviews with victim organizations, and interviews with convicted insiders) sources. This data collection primarily focuses on gathering information about three entities: the organizations involved, the perpetrator of the malicious activity, and the details of the incident. Each case in the insider incident repository contains a natural language description of the technical and behavioral observables of the incident. These descriptions were used as the primary data source for the ontology.

The top level of the ontology is composed of five classes: Actor, Action, Asset, Event, and Information. The Actor class contains subclasses for representing people, organizations, and organizational components such as departments. The Action class contains the subclasses that define the things that actors can perform. The Asset class provides subclasses that define the objects of actions. The Information class provides subclasses that provide support for modeling the information contained within some assets (examples include personally identifiable information, trade secrets, and classified information). The Event class provides support for multiple types of events of interest. Events are generally associated with one or more Actions.

The full framework of the ontology is meant to support detection of potential indicators of malicious insider activity that is then triaged. An effective implementation of the framework depends on the indicators it contains, and not all satisfied indicators necessarily warrant an investigation. The evaluation of specific instances of indicators requires expert analysis and investigation to remove false positives, assess severity of the satisfied indicator, and perform set and temporal analysis on the satisfied indicators. The framework can support a workflow-based analysis and incident escalation process. Specific implementations of the framework are expected to grow and change as the organization, its insider threat program, and the larger insider threat community and domain all do the same.

This work was done by Daniel L. Costa, Matthew L. Collins, Samuel J. Perl, Michael J. Albrethsen, George J. Silowash, and Derrick L. Spooner of Carnegie Mellon University for the Defense Advanced Research Projects Agency. DARPA-0015

---

More From SAE Media Group

Aerospace & Defense Tech Briefs

Developing and Validating Statistical Cyber Defenses

Aerospace & Defense Tech Briefs

Framework for Resilient Remote Monitoring

Aerospace & Defense Tech Briefs

Communication Protocol for CyAMS and the Cyber Fighter Associate Interface

Aerospace & Defense Tech Briefs

Industry Invited to Participate in AeroTech Aerospace and Defense Technical Program

More

Aerospace & Defense Tech Briefs

In-Network Processing on Low-Cost IoT Nodes for Maritime Surveillance

Aerospace & Defense Tech Briefs

Drone Swarms: A Transformational Technology

Aerospace & Defense Tech Briefs

Data Mining in Cyber Operations

Aerospace & Defense Tech Briefs

A New Approach to Counter-UAS Technology

Aerospace & Defense Tech Briefs

Counter-Drone Technology

Aerospace & Defense Tech Briefs

Real-Time, High-Fidelity Simulation of Autonomous Ground Vehicle Dynamics

Aerospace & Defense Tech Briefs

Investigation of Requirements and Capabilities of Next-Generation Mine Warfare Unmanned Underwater Vehicles

Aerospace & Defense Tech Briefs

Quality Management Experts Provide Guidance on AS9100 Standard, Equipment Calibration

Aerospace Manufacturing and Machining

How Augmented Reality Can Modernize Aerospace And Defense Manufacturing

Aerospace & Defense Tech Briefs

Supervisory Control State Diagrams to Depict Autonomous Activity

Aerospace & Defense Tech Briefs

Tourniquet Training System

Aerospace & Defense Tech Briefs

Autonomous Collaborative Platform

Aerospace & Defense Tech Briefs

DPA Countermeasures — Theory vs. Practice

Aerospace & Defense Tech Briefs

Effectiveness of Inter-Vehicle Communications and On-Board Processing for Close Unmanned Autonomous Vehicle Flight Formations

Aerospace & Defense Tech Briefs

Real Time Physiological Status Monitoring

Tech Briefs

University of Colorado Boulder

---

Aerospace & Defense Technology Magazine

This article first appeared in the October, 2015 issue of Aerospace & Defense Technology Magazine.

Read more articles from this issue here.

Read more articles from the archives here.

SUBSCRIBE