TWC: Medium: Collaborative: Data is Social: Exploiting Data Relationships to Detect Insider Attacks

在国防、金融和银行等关键领域，内部攻击带来了极其严重、普遍和代价高昂的安全问题。准确的内部威胁检测已被证明是一个非常具有挑战性的问题。该项目通过分析数据库搜索，探索在银行环境中检测内部威胁。本研究通过制定和设计基于机器学习的解决方案来解决关系数据库管理系统（RDBMS）的内部攻击问题，这些系统无处不在，极易受到内部攻击。特别是，该研究使用了一种新的数据库来源通用模型，该模型捕获了用户活动访问或修改的数据值，并总结了计算路径和这些数据值之间的潜在关系。来源模型自然导致了一种通过标记超图分布和马尔可夫网络（其因子表示数据关系）对用户活动建模的方法。理论上研究的关键权衡是在来源模型的表达性和复杂性之间。通过与一家大型金融机构密切合作，在其现有的RDBMS上构建一个内部威胁检测引擎原型，对研究结果进行了验证和评估。特别是，在金融机构安全团队的帮助下，研究团队解决了系统评估和部署期间出现的数据库性能、学习可伸缩性和软件工具开发问题。研究成果通过技术论文报告，并通过会议和期刊传播，通过UB的国家安全局和国土安全部认证的信息保障卓越中心（CAE）的新研究网页，以及该中心未来的研讨会。

Insider attacks present an extremely serious, pervasive and costly security problem under critical domains such as national defense and financial and banking sector. Accurate insider threat detection has proved to be a very challenging problem. This project explores detecting insider threats in a banking environment by analyzing database searches. This research addresses the challenge by formulating and devising machine learning-based solutions to the insider attack problem on relational database management systems (RDBMS), which are ubiquitous and are highly susceptible to insider attacks. In particular, the research uses a new general model for database provenance, which captures both the data values accessed or modified by a user's activity and summarizes the computational path and the underlying relationship between those data values. The provenance model leads naturally to a way to model user activities by labeled hypergraph distributions and by a Markov network whose factors represent the data relationships. The key tradeoff being studied theoretically is between the expressivity and the complexity of the provenance model. The research results are validated and evaluated by intimately collaborating with a large financial institution to build a prototype insider threat detection engine operating on its existing operational RDBMS. In particular, with the help of the security team from the financial institution, the research team addresses database performance, learning scalability, and software tool development issues arising during the evaluation and deployment of the system. Research results are reported via technical papers and disseminated through conferences and journals, through a new research webpage at the UB's NSA- and DHS-certified center of excellence (CAE) in Information Assurance, and at the center's future workshops.