2009 Articles

Designing Host and Network Sensors to Mitigate the Insider Threat

Bowen, Brian M.; Ben Salem, Malek; Hershkop, Shlomo; Keromytis, Angelos D.; Stolfo, Salvatore

Insider attacks--that is, attacks by users with privileged knowledge about a system--are a growing problem for many organizations. To address this threat, the authors have designed an architecture for insider threat detection that combines an array of complementary monitoring and auditing techniques.