Author Email: molotov.linar@mail.ru
Abstract
Insider threats are among the most frequent and dangerous for modern organizations. Therefore, the problem of timely detection of internal information security incidents is relevant. Due to the fact that many of the approaches to protection against insider attacks are not effective enough, recently an approach based on identifying anomalous user behaviour has often been used to solve the problem of identifying internal incidents. The use of this approach involves the construction of a reference profile of user behaviour and the further identification of facts of “atypical” behaviour. This work is devoted to solving the actual problem of detecting events in computer systems. These events occur when the access control rules are violated when an attacker tries to enter the system, posing as another user. Data mining technology is used to build profiles of the user’s reference behaviour and to identify anomalies. Hidden patterns in user behaviour are revealed using the decision tree construction algorithms C4.5, search for associative rules FPGrowth, sequential data analysis. The types of internal incidents and ways to determine their criticality are determined. The developed technology is implemented in the tool complex of programs. It was tested on the example of solving the problem of detecting anomalies in the behaviour of users working with programs running the Windows operating system. In this case, the attacker did not try to hide his actions when working in the system. Identified system errors when recognizing an intruder. The error of the first kind was 20%, and the error of the second kind – 10%.
Introduction
Currently, the main trend of global economic development is the development of the digital economy. The basic foundations of this economy are e-commerce and e-business. In this connection, the urgency of the task of developing information systems of organizations on the basis of digital economy technologies and their integration with ecommerce systems is increasing [1,2]. The emergence of the digital economy is inextricably linked with the development of risks in various subject areas, in particular, in the tasks of ensuring information security (IS). In this case, an urgent task is the timely detection and investigation of incidents related to the violation of the security of a computer system (CS). This is due to the fact that organizations often experience significant problems due to IS incidents, mainly related to disruptions in the functioning of the IT infrastructure, reputational costs and financial losses.
Conclusion
The proposed approach makes it possible to identify particularly critical information security incidents in computer systems that are associated with the compromise of a legal user account. The application of the obtained results in practice can significantly increase the degree of protection of computer systems from internal violators.
1,414 total views, no views today