Big Data Analytics with Applications in Insider Threat Detection

6

Data Mining and Insider Threat Detection

6.1 Introduction

The discussions in Chapters 2 through 5 provide the background for applying data mining for insider threat detection. Effective detection of insider threats requires monitoring mechanisms that are far more fine-grained than for external threat detection. These monitors must be efficiently and reliably deployable in the software environments where actions endemic to malicious insider missions are caught in a timely manner. Such environments typically include user-level applications, such as word processors, email clients, and web browsers for which reliable monitoring of internal events by conventional means is difficult.

To monitor the activities of the insiders, tools are needed ...