Towards thwarting cyber corporate espionage by predicting its victims

点击翻译按钮获取中文摘要

When enterprise computers or individual devices of employees are compromised, they become stepping stones in larger infiltrations of organizational assets. The rise of the Internet and computer networks has expanded the range and detail of information available and the ease of access for the purpose of cyber, corporate espionage. Malware and spyware are used as tools for corporate espionage for transmitting digital copies of trade secrets, customer information, business plans, and contacts. Current means of securing desktops, laptops, tablets, and smartphones of employees are not effective, so companies are increasingly keeping important information off the network. The costs of detecting compromised devices, performing forensics, recovering data, cleaning up, and securing them are high. The UK Government has recently estimated that cybercrime costs the country nearly £27 billion per year and, according to recent estimates, the global cost is $1 trillion every year. In this research, we plan to collaborate with TELUS in order to investigate techniques for early-detection of employee devices that would likely fall victims to cyber espionage and other security incidents. We will focus on machine learning and data mining algorithms to develop an early warning system, with the aim towards high accuracy and scalability, benefiting both TELUS and the larger research community. We will investigate machine learning techniques for developing a classifier that will use traces and logs of various observable actions performed by individual devices for identifying likely victims of security attacks, including phishing, Trojan horses, drive-by-downloads, etc. We will follow the understand-prototype-diagnose methodology.