Spelling suggestions: "subject:"genetration testing (eomputer security)"" "subject:"genetration testing (aomputer security)""
1 |
A Privacy-Preserving, Context-Aware, Insider Threat prevention and prediction model (PPCAITPP)Tekle, Solomon Mekonnen 07 1900 (has links)
The insider threat problem is extremely challenging to address, as it is committed by insiders who are
trusted and authorized to access the information resources of the organization. The problem is further
complicated by the multifaceted nature of insiders, as human beings have various motivations and
fluctuating behaviours. Additionally, typical monitoring systems may violate the privacy of insiders.
Consequently, there is a need to consider a comprehensive approach to mitigate insider threats. This
research presents a novel insider threat prevention and prediction model, combining several approaches,
techniques and tools from the fields of computer science and criminology. The model is a Privacy-
Preserving, Context-Aware, Insider Threat Prevention and Prediction model (PPCAITPP). The model is
predicated on the Fraud Diamond (a theory from Criminology) which assumes there must be four elements
present in order for a criminal to commit maleficence. The basic elements are pressure (i.e. motive),
opportunity, ability (i.e. capability) and rationalization. According to the Fraud Diamond, malicious
employees need to have a motive, opportunity and the capability to commit fraud. Additionally, criminals
tend to rationalize their malicious actions in order for them to ease their cognitive dissonance towards
maleficence. In order to mitigate the insider threat comprehensively, there is a need to consider all the
elements of the Fraud Diamond because insider threat crime is also related to elements of the Fraud
Diamond similar to crimes committed within the physical landscape.
The model intends to act within context, which implies that when the model offers predictions about threats,
it also reacts to prevent the threat from becoming a future threat instantaneously. To collect information
about insiders for the purposes of prediction, there is a need to collect current information, as the motives
and behaviours of humans are transient. Context-aware systems are used in the model to collect current
information about insiders related to motive and ability as well as to determine whether insiders exploit any
opportunity to commit a crime (i.e. entrapment). Furthermore, they are used to neutralize any
rationalizations the insider may have via neutralization mitigation, thus preventing the insider from
committing a future crime. However, the model collects private information and involves entrapment that
will be deemed unethical. A model that does not preserve the privacy of insiders may cause them to feel
they are not trusted, which in turn may affect their productivity in the workplace negatively. Hence, this
thesis argues that an insider prediction model must be privacy-preserving in order to prevent further
cybercrime. The model is not intended to be punitive but rather a strategy to prevent current insiders from
being tempted to commit a crime in future.
The model involves four major components: context awareness, opportunity facilitation, neutralization
mitigation and privacy preservation. The model implements a context analyser to collect information related
to an insider who may be motivated to commit a crime and his or her ability to implement an attack plan.
The context analyser only collects meta-data such as search behaviour, file access, logins, use of keystrokes
and linguistic features, excluding the content to preserve the privacy of insiders. The model also employs
keystroke and linguistic features based on typing patterns to collect information about any change in an
insider’s emotional and stress levels. This is indirectly related to the motivation to commit a cybercrime.
Research demonstrates that most of the insiders who have committed a crime have experienced a negative
emotion/pressure resulting from dissatisfaction with employment measures such as terminations, transfers
without their consent or denial of a wage increase. However, there may also be personal problems such as a
divorce. The typing pattern analyser and other resource usage behaviours aid in identifying an insider who
may be motivated to commit a cybercrime based on his or her stress levels and emotions as well as the
change in resource usage behaviour. The model does not identify the motive itself, but rather identifies those
individuals who may be motivated to commit a crime by reviewing their computer-based actions. The model
also assesses the capability of insiders to commit a planned attack based on their usage of computer
applications and measuring their sophistication in terms of the range of knowledge, depth of knowledge and
skill as well as assessing the number of systems errors and warnings generated while using the applications.
The model will facilitate an opportunity to commit a crime by using honeypots to determine whether a
motivated and capable insider will exploit any opportunity in the organization involving a criminal act.
Based on the insider’s reaction to the opportunity presented via a honeypot, the model will deploy an
implementation strategy based on neutralization mitigation. Neutralization mitigation is the process of
nullifying the rationalizations that the insider may have had for committing the crime. All information about
insiders will be anonymized to remove any identifiers for the purpose of preserving the privacy of insiders.
The model also intends to identify any new behaviour that may result during the course of implementation.
This research contributes to existing scientific knowledge in the insider threat domain and can be used as a
point of departure for future researchers in the area. Organizations could use the model as a framework to
design and develop a comprehensive security solution for insider threat problems. The model concept can
also be integrated into existing information security systems that address the insider threat problem / Information Science / D. Phil. (Information Systems)
|
2 |
Renforcement de la sécurité à travers les réseaux programmablesAbou El Houda, Zakaria 09 1900 (has links)
La conception originale d’Internet n’a pas pris en compte les aspects de sécurité du réseau; l’objectif prioritaire était de faciliter le processus de communication. Par conséquent, de nombreux protocoles de l’infrastructure Internet exposent un ensemble de vulnérabilités. Ces dernières peuvent être exploitées par les attaquants afin de mener un ensemble
d’attaques. Les attaques par déni de service distribué (Distributed Denial of Service ou DDoS) représentent une grande menace et l’une des attaques les plus dévastatrices causant des dommages collatéraux aux opérateurs de réseau ainsi qu’aux fournisseurs de services Internet.
Les réseaux programmables, dits Software-Defined Networking (SDN), ont émergé comme
un nouveau paradigme promettant de résoudre les limitations de l’architecture réseau actuelle
en découplant le plan de contrôle du plan de données. D’une part, cette séparation permet
un meilleur contrôle du réseau et apporte de nouvelles capacités pour mitiger les attaques
par déni de service distribué. D’autre part, cette séparation introduit de nouveaux défis en
matière de sécurité du plan de contrôle.
L’enjeu de cette thèse est double. D’une part, étudier et explorer l’apport de SDN
à la sécurité afin de concevoir des solutions efficaces qui vont mitiger plusieurs vecteurs
d’attaques. D’autre part, protéger SDN contre ces attaques. À travers ce travail de
recherche, nous contribuons à la mitigation des attaques par déni de service distribué sur
deux niveaux (intra-domaine et inter-domaine), et nous contribuons au renforcement de
l’aspect sécurité dans les réseaux programmables. / The original design of Internet did not take into consideration security aspects of the
network; the priority was to facilitate the process of communication. Therefore, many of the
protocols that are part of the Internet infrastructure expose a set of vulnerabilities that can
be exploited by attackers to carry out a set of attacks. Distributed Denial-of-Service (DDoS)
represents a big threat and one of the most devastating and destructive attacks plaguing
network operators and Internet service providers (ISPs) in a stealthy way.
Software defined networks (SDN), an emerging technology, promise to solve the limitations
of the conventional network architecture by decoupling the control plane from the data
plane. On one hand, the separation of the control plane from the data plane allows for more
control over the network and brings new capabilities to deal with DDoS attacks. On the
other hand, this separation introduces new challenges regarding the security of the control
plane.
This thesis aims to deal with various types of attacks including DDoS attacks while
protecting the resources of the control plane. In this thesis, we contribute to the mitigation
of both intra-domain and inter-domain DDoS attacks, and to the reinforcement of security
aspects in SDN.
|
Page generated in 0.1616 seconds