Two-Steps Insider Threat Detection Protocol (2S-ITDP) Based on Computer Usage Pattern Analysis

2.1 One time password

The onetime password (OTP) technique [9] is applied to enhance log-on protocol security. The server and client do not need to be responsible clients for login name and password preservation. Instead, the password will be randomly generated, then sent to both the server and client for communicate message encryption.

2.2 One-time-password-authenticated key exchange

The authors [10] present the OTP generating by using a pseudo random generator based on time-dependent. The OTP is generated and performed in the task sequence based on password-authenticated key exchange protocol (PAKE). The practical OTP based on PAKE can support mutual authentication for both the client and server.

2.3 Authentication and password storing improvement using SXR algorithm with a hash function

Polpong and Wuttidittachotti [11] suggest four steps for user password modification. First, the user password is hashed. Second, the ratio and number of iterations are calculated from the user's secret key. Third, the hashed password is split into two pieces based on a ratio. Fourth, each piece hashed are performed the exclusive function with number rounds. Finally, these two pieces are concatenated and kept in the database as the user's new secure password.

2.4 Data sequential pattern mining

Data sequential pattern analysis [12] is the technique that is used to determine the pattern of sequential transactions of the individual or many entities. All transactions will be sorted by trade occurring time. Each transaction may consist of one or many items that simultaneously occurred. This set of transaction elements may be presented in n-item form, such as one item, two items, two items together, three items, and so forth.

The support of (n) item occurring must meet the minimum careful subjective defined criteria. All the combinations of support passed (n) items shall illustrate the data sequence pattern structure. These pattern structures can implement as the architecture of pattern sequences [13]. In general, the pattern sequence of each one is quite different from the other one. The derived sequence pattern presents the presence of each client’s working pattern. Thus if his working pattern resembles his prior supported patterns, then it can identify as being normal working. The similarity of comparing can measure from the frequency of the pattern occurring. Two entities will be similar if they all have the same most frequent pattern [14]. The measurement of similarity or level of clients' usual (typical) working (LUW) can calculate from the total hit elements devised by total access items.

$L U W=\frac{\text { total_match_access_item }}{\text { (total_match_access_item }+ \text { total_ummatch_access_item) }} * 100$          (1)

While; total_match_access_item is the amount of on-accessing n-item pattern that matched to prior n-item pattern, and total_unmatch_access_item is the amount of on-accessing n-item pattern that unmatched to previous n-item pattern. For example, if CL’s sequence data item is <ACEBD(AC)B>. If the prior derived data pattern is “A, B, C, BC”, thus there are four access items, under underline (<A C E B D (AC) B>), matched this prior data sequence pattern. Three access items, with underline <A C E B D (AC) B>, that are unmatched by the prior data sequence pattern. Therefore, LUW is 57.14% (4/(4+3)).

The threshold of LUW is the essential criterion that must be repetitive experimental resetting to reduce the problem of type I and II error classification.

2.5 Sensitive data

The sensitive data [15] is the organizational data that must be accessed and updated by only the authorized party. These data should cause the organization’s severe effects if there are disclosures of malicious intentions. If the unauthorized party accesses an unauthorized party accesses the defined organizational sensitive data, then privacy or confidence will be reached. In a difficult situation where the unauthorized can change the sensitive data, thus the organization's data are integrity losing. Some data, databases, application programs, etc., may be interrupted an attacked, which leads to a loss of availability. Therefore, organization must carefully define the significant sensitive data in many classifications of sensitive data.

There are many types of sensitive data. The first is public or low-sensitive data, for example, staff organization, published papers, general organization news, or public activity. This kind of data is not sensitive data since there are not cause the organization's endurance. The second class is moderate data sensitive, for example, building architecture, customer records, customer service information, etc. With deep study and other coverage information, this information may present data that can accidentally reach some organization privacy data. The third class is highly sensitive or confidential data, for example, social security numbers, customer transactions, health information, business deep or secret strategic plans, etc. These data-sensitive classes are directly practical to someone, organization data privacy. It should directly harm the data owner.

The organization has to classify its information asset into three classes. After that, each interest-specific sensitive data will be deep study in its data processing scenario. All activities about this sensitive data must be carefully considered on all its activity such as creating, appending, updating, deleting, backup, and recovery. The organization must set these activities the specific rights, authority, and responsibility to whom, when, where, and what. These assignments will be used to produce the access control list: ACL assigned to the responsible CL (client). The CL's ACL can be used to monitor whether the client is performing as his given rights in ACL.

2.6 “The blockchain technologies in healthcare: Prospects, obstacles, and future recommendations; Lessons learned from digitalization”

Blockchain technology [16] supports healthcare data management systems in patient medical records manipulation. The advantages of Blockchain are data privacy, flexibility in data access, integrity, authentication, etc. Moreover, the recorded data can support data analytics.

2.7 “Security aware information classification in health care big data”

The authors [17] present word extraction, mapping into normal and sensitive data, and defines weighting. Then, the gathered information are used to classify the data if it is exposed or not.

2.8 Behavior analysis (“User behavior analytics for insider threat detection using deep learning”)

The user's usage [18] on the fixed window was trained by one class training to construct the user behavior. Gated recurrent unit base auto encoders are used to model the user behavior per day. Thus this model is used to detect the anomaly working of specific users. The experiment dataset is computer emergency response team r 4.2. The classification value is positive, and the true negative rate is about 79.8%.

2.9 “Classification of mobile customers behavior and usage patterns using self-organizing neural networks”

Today mobile network technology efficiently supports the rapid growth of many mobile applications. However, customers have different usage patterns for portable application use. Thus, the classification of customers based on customers' data from the mobile operator will present the customers' behavior segments [19]. Self-organizing-map is the technique used to show behavior. The information helps to increase efficient mobile application marketing.

2.10 “An insider threat detection method based on user behavior analysis”

Jiang et al. [20] have tried to extract the significant features that often cause organization information loss (attack) from much-related research. The “XGBoost” algorithm is used to identify the insider threat by aggregating the proposed significant feature with user behavior simultaneously. The F-measure of classification is about 99.96%.

Research direction: the literature review on behavior analysis research (presented on Table 1) shows that using techniques could present a client’s static activities. However, it can't detect the sequence of clients' activity. Therefore, this research chose to observe the client’s activities (behavior) using a generalized sequential pattern (GSP) algorithm. The computer using a pattern of each client will be used to detect whether they are working as usual. The unusual working client will be carefully observed whether he is an insider threat.

Table 1. The summary of related research and proposed solution

1.jpg

Figure 1. Research framework scenario

This section will explain the detail of the experiment and their results as following topics.

4.1 CL’s computer usage (behavior) collection

The client’s computer usage log sequence pattern analysis for prior and during computer access is conducted by DAS. The research context is about the education sector computer systems. The experiment project was created and tested during 2020-2021. There were 146 students and 28 staff participated in this experiment. The sample observations were fifty chosen students, the fourth-year undergraduate majoring in computer technology. The sample transaction will present only one client’s behavior to quickly understand the CL’s usage behavior analysis. The transaction of item access (or purchase) data were collected at least six weeks. Then it was set as the first usage sequence pattern. This firstly usage sequence will be implemented as the starting accumulate sequence pattern. The collection of the CL’s item purchasing on each working day, the information system section actual purchasing items are shown in Table 7. There are two types of purchase items (1.routine works and 2.not routine works), and each type compose of five tasks (item code). These works, called items, are coded as {A, B, C, D, E, F, G, H, I, J}.

Table 7. The purchasing items definition

For example, CL’s sample computer usage was collected Monday through Friday. The time duration is divided into five durations. The actual working hours are code “2” and “3”. This information should help DAS compare the current usage pattern with similar dates and times so that the analytic result will increase the classification accuracy. Time duration of data collection table look-up attributes are time durations, and their code;{‘6.00-8.59 .am.’:‘1’,’9.00-12.00 am.’:‘2’,‘12.01-12.59 am.’: ‘3’,‘13.00-17.00 am.’: ‘4’,‘17.01-18.00 am.’: ‘5’}. The sample of experimental CL’s computer usage (presenting just one week of data) transaction is shown in Table 8.

Table 8. The sample of one experimental CL’s computer usages sequence

After 1-item, 2-item, 3-item, 4-item, and n-items-together extraction based on support criterion equal or greater than ‘4’ (or about 80%) on six weeks of data collection, there are many derived data sequence patterns as shown in Table 9.

Table 9. The CL’s computer usage sequence pattern (of fifty experiment samples) at the whole date and time (support≥4)

In another case, suppose the support value is set to “≥5”, then it will derive the different generated data sequence pattern, as shown in Table 10. The met support criteria sequence pattern are reduced from nineteen to only five patterns. Since the transaction is classified as five working days, therefore at the support value “4”, the support criteria are 80% (4/5) is the suitable criteria.

Table 10. The CL’s computer usage sequence pattern at the whole date and time (support≥5)

The CL’s computer usage sequence pattern (support ≥4) could illustrate the sequence architecture as shown in Figure 3.

3.jpg

Figure 3. The computer usage sequence pattern architecture (support≥4)

For example, similarity calculation (consideration of the whole pattern of a week or five working days), suppose that the CL’s , on accessing, usage sequence transaction at current is <C(AC)BJCGDBH>. The measurement will count all items before or after n-item together occurring and all the possible matching to the prior derived usage patterns.

A.Case: support ≥4 (Table 8)

1-item matching is “C”, “A”, “C”, “B”, “C”, “B”. (<C (A C) b J C G D B H>.

2-item matching is none.

2-items together matching is “(AC)”. <C (AC) BJCGDBH>.

3-item matching is “CGD”. <C(AC)BJ CGD BH>.

The LUW value is about 80% (8/(8+2)).

B.Case: support =>5 (Table 9)

1-item matching is “A”, “B”, “G”, “B”. (<C (A C) B G D B H>.

2-2-item matching is none.

The LUW value is about 50% (4/(4+4)).

This result indicates that the matching item pattern is a low percentage since there are few n-item patterns. The n-item pattern will occur more in the low value of “n” (1, 2). Therefore, the suitable support criteria should be repetitively train and tested on the extensive data sequence to choose the best support criteria value. The experimental result shows that a high support data sequence pattern will not ensure a high percentage of CL’s item usage pattern matching. On the other hand, the lower support should cause the type I and II classifications.

4.2 The suggested authentication log on protocol

There are four sequenced tasks in the authentication log-on protocol scenario, as shown in Figure 4.

Step 1: The client sent a message “CL's identity, ESV's k-pub (CL's CA cert ID, n=1)” to the server for computer system access permission. The message is encrypted with SV’s public key so no one else can reveal the “CL's CA cert ID, N=1”.

Step 2: The server sent CL’s detail to CA to recheck whether CL is legitimate. The sending message is encrypted with CA’s public key to keep the message private. The message sequence is presented in the communication step by an integer number (‘N’), which will be increased in its value by step 1.

The N value is used to protect against replay attacks. SV's identity, ECA's k-pub(CL's CAcert-ID, N+1=1)

Step 3-4: CA reveals the sending message with CA’s private key. If there is CL's CA cert ID presented in “CA’s secure database”, then CA sends a message to both server (step 3rd) and the client (step 4th). These messages, CA will prepare the conventional key (K-con) with 3-Triple DES default for SA, and CL to use to encrypt their communication message. However, SA and CL may change the received K-con (by 3.2.3), and encryption algorithm to the agreed one to prevent message privacy attacks from CA.

4.3 Decision-making on client’s computer usage

DAS is the one that has the responsibility to detect the client’s usage behavior and conduct the decision-making about the CL’s computer access.

4.4 Evaluation

The suggested “Two-step insider threat detection protocol (2S-ITDP)” is evaluated for the accuracy of internal threat classification. The accuracy of classification is depended on the number of items usage coverage, the thorough of sensitive data covering, and the employee job mobility rate. Therefore, the research will consider just the technical aspect of the number of the items usage (definite on ten items about computer usage). The support value of the sequence pattern is defined at eighty percent (support ≥4). The resulting pattern is nineteen generated data sequence patterns. The level of CL’s normal working (LUW) is set to passing if the CL’s LUW is equal to or greater than seventy percent similarity. The test result shows that the general sequence pattern at support criteria similar to “4” should give more accuracy in classification, as shown in Table 11.