Insider threats is the most concerned cybersecurity problem which is poorly addressed by widely used security solutions. Despite the fact that there have been several scientific publications in this area, but from our innovative study classification and structural taxonomy proposals, we argue to provide the more information about insider threats and defense measures used to counter them. While adopting the current grounded theory method for a thorough literature evaluation, our categorization's goal is to organize knowledge in insider threat research. Along with an analysis of major recent studies on detecting insider threats, the major goal of the study is to develop a classification of current types of insiders, levels of access, motivations behind it, insider profiling, security properties, and methods they use to attack. This includes use of machine learning algorithm, behavior analysis, methods of detection and evaluation. Moreover, actual incidents related to insider attacks have also been analyzed.
翻译:内部威胁是最令人关切的网络安全问题,而广泛使用的安全解决办法却未能很好地解决。尽管在这一领域有若干科学出版物,但从我们的创新研究分类和结构分类建议中,我们主张提供更多关于内部威胁和用来对付这些威胁的防御措施的信息。在采用目前基于理论的方法进行彻底的文献评估的同时,我们分类的目的是组织内部威胁研究方面的知识。除了分析最近关于发现内部威胁的重要研究外,研究的主要目标是对内部威胁的当前类型、接触程度、背后的动机、内幕特征分析、安全性质和它们用来攻击的方法进行分类,其中包括机器学习算法、行为分析、探测和评估方法。此外,还分析了与内幕攻击有关的实际事件。