Insider threat analysis using information-centric modeling

Duc Ha; Shambhu Upadhyaya; Hung Ngo; Suranjan Pramanhik; Ramkumar Chinchani; Sunu Mathew

doi:10.1007/978-0-387-73742-3_4

Insider threat analysis using information-centric modeling

Duc Ha
, Shambhu Upadhyaya
, Hung Ngo
, Suranjan Pramanhik
, Ramkumar Chinchani
, Sunu Mathew

Department of Computer Science and Engineering

SUNY Buffalo
Cisco Systems

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

15 Scopus citations

Abstract

Capability acquisition graphs (CAGs) provide a powerful framework for modeling insider threats, network attacks and system vulnerabilities. However, CAG-based security modeling systems have yet to be deployed in practice. This paper demonstrates the feasibility of applying CAGs to insider threat analysis. In particular, it describes the design and operation of an information-centric, graphics-oriented tool called ICMAP. ICMAP enables an analyst without any theoretical background to apply CAGs to answer security questions about vulnerabilities and likely attack scenarios, as well as to monitor network nodes. This functionality makes the tool very useful for attack attribution and forensics.

Original language	English
Title of host publication	Advances in Digital Forensics III
Subtitle of host publication	IFIP International Conference on Digital Forensics, National Centre for Forensic Science, Orlando, Florida, January 28-January 31, 2007
Editors	Philip Craiger, Sujeet Shenoi
Pages	55-73
Number of pages	19
DOIs	https://doi.org/10.1007/978-0-387-73742-3_4
State	Published - 2007

Publication series

Name	IFIP International Federation for Information Processing
Volume	242
ISSN (Print)	1571-5736

Keywords

Capability acquisition graphs
Insider threats
Key challenge graphs

Access to Document

10.1007/978-0-387-73742-3_4

Cite this

Ha, D., Upadhyaya, S., Ngo, H., Pramanhik, S., Chinchani, R., & Mathew, S. (2007). Insider threat analysis using information-centric modeling. In P. Craiger, & S. Shenoi (Eds.), Advances in Digital Forensics III: IFIP International Conference on Digital Forensics, National Centre for Forensic Science, Orlando, Florida, January 28-January 31, 2007 (pp. 55-73). (IFIP International Federation for Information Processing; Vol. 242). https://doi.org/10.1007/978-0-387-73742-3_4

Ha, Duc ; Upadhyaya, Shambhu ; Ngo, Hung et al. / Insider threat analysis using information-centric modeling. Advances in Digital Forensics III: IFIP International Conference on Digital Forensics, National Centre for Forensic Science, Orlando, Florida, January 28-January 31, 2007. editor / Philip Craiger ; Sujeet Shenoi. 2007. pp. 55-73 (IFIP International Federation for Information Processing).

@inproceedings{f201460473844ba997c2d9e251f70465,

title = "Insider threat analysis using information-centric modeling",

abstract = "Capability acquisition graphs (CAGs) provide a powerful framework for modeling insider threats, network attacks and system vulnerabilities. However, CAG-based security modeling systems have yet to be deployed in practice. This paper demonstrates the feasibility of applying CAGs to insider threat analysis. In particular, it describes the design and operation of an information-centric, graphics-oriented tool called ICMAP. ICMAP enables an analyst without any theoretical background to apply CAGs to answer security questions about vulnerabilities and likely attack scenarios, as well as to monitor network nodes. This functionality makes the tool very useful for attack attribution and forensics.",

keywords = "Capability acquisition graphs, Insider threats, Key challenge graphs",

author = "Duc Ha and Shambhu Upadhyaya and Hung Ngo and Suranjan Pramanhik and Ramkumar Chinchani and Sunu Mathew",

year = "2007",

doi = "10.1007/978-0-387-73742-3\_4",

language = "English",

isbn = "9780387737416",

series = "IFIP International Federation for Information Processing",

pages = "55--73",

editor = "Philip Craiger and Sujeet Shenoi",

booktitle = "Advances in Digital Forensics III",

}

Ha, D, Upadhyaya, S, Ngo, H, Pramanhik, S, Chinchani, R & Mathew, S 2007, Insider threat analysis using information-centric modeling. in P Craiger & S Shenoi (eds), Advances in Digital Forensics III: IFIP International Conference on Digital Forensics, National Centre for Forensic Science, Orlando, Florida, January 28-January 31, 2007. IFIP International Federation for Information Processing, vol. 242, pp. 55-73. https://doi.org/10.1007/978-0-387-73742-3_4

Insider threat analysis using information-centric modeling. / Ha, Duc; Upadhyaya, Shambhu; Ngo, Hung et al.
Advances in Digital Forensics III: IFIP International Conference on Digital Forensics, National Centre for Forensic Science, Orlando, Florida, January 28-January 31, 2007. ed. / Philip Craiger; Sujeet Shenoi. 2007. p. 55-73 (IFIP International Federation for Information Processing; Vol. 242).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Insider threat analysis using information-centric modeling

AU - Ha, Duc

AU - Upadhyaya, Shambhu

AU - Ngo, Hung

AU - Pramanhik, Suranjan

AU - Chinchani, Ramkumar

AU - Mathew, Sunu

PY - 2007

Y1 - 2007

N2 - Capability acquisition graphs (CAGs) provide a powerful framework for modeling insider threats, network attacks and system vulnerabilities. However, CAG-based security modeling systems have yet to be deployed in practice. This paper demonstrates the feasibility of applying CAGs to insider threat analysis. In particular, it describes the design and operation of an information-centric, graphics-oriented tool called ICMAP. ICMAP enables an analyst without any theoretical background to apply CAGs to answer security questions about vulnerabilities and likely attack scenarios, as well as to monitor network nodes. This functionality makes the tool very useful for attack attribution and forensics.

AB - Capability acquisition graphs (CAGs) provide a powerful framework for modeling insider threats, network attacks and system vulnerabilities. However, CAG-based security modeling systems have yet to be deployed in practice. This paper demonstrates the feasibility of applying CAGs to insider threat analysis. In particular, it describes the design and operation of an information-centric, graphics-oriented tool called ICMAP. ICMAP enables an analyst without any theoretical background to apply CAGs to answer security questions about vulnerabilities and likely attack scenarios, as well as to monitor network nodes. This functionality makes the tool very useful for attack attribution and forensics.

KW - Capability acquisition graphs

KW - Insider threats

KW - Key challenge graphs

UR - https://www.scopus.com/pages/publications/36448974950

U2 - 10.1007/978-0-387-73742-3_4

DO - 10.1007/978-0-387-73742-3_4

M3 - Conference contribution

AN - SCOPUS:36448974950

SN - 9780387737416

T3 - IFIP International Federation for Information Processing

SP - 55

EP - 73

BT - Advances in Digital Forensics III

A2 - Craiger, Philip

A2 - Shenoi, Sujeet

ER -

Ha D, Upadhyaya S, Ngo H, Pramanhik S, Chinchani R, Mathew S. Insider threat analysis using information-centric modeling. In Craiger P, Shenoi S, editors, Advances in Digital Forensics III: IFIP International Conference on Digital Forensics, National Centre for Forensic Science, Orlando, Florida, January 28-January 31, 2007. 2007. p. 55-73. (IFIP International Federation for Information Processing). doi: 10.1007/978-0-387-73742-3_4

Insider threat analysis using information-centric modeling

Abstract

Publication series

Keywords

Access to Document

Other files and links

Fingerprint

Cite this