Design of Intrusion Detection System Preventing Insider Attack

Abstract

Recent reports show that the loss from the malicious in-trusion by insiders is more serious than by outsiders. Despite that thevarious attacks are occurred by insiders and outsiders, most work hasbeen focused on the intrusion detection against outsider attacks. In thispaper, we improve the Wang et al.’s insider predection model andpropose the combined model with access control for the efficient insiderintrusion detection. We delegate the role of insider intrusion detectionto users that reduces the malicious trial of insiders and the overhead onthe centralized intrusion detection system. We also define the separatedaccess privilege that requires insiders to find the witness for accessingthe information. We show that the combination of the concept of accesscontrol enables more practical deployment of insider intrusion detectionsystem.