Detection of insider attacks using network behavour model

An attack is an information security threat that involves an attempt to gain unauthorized access to information resource or services, or to obtain, reveal, remove, alter or destroy sensitive information. There are two types of attacks as passive and active attacks. Passive attacks are used to get information without hurting system resources. Therefore, the detection of these attacks are pretty difficult. Generally, in this attack type network communication is eavesdropped to make a traffic analysis and release of message content. On the other hand, active attacks are used to change or remove information, alter or destroy system resources and prevent system operations. The most known active attacks are masquerade, modification of messages, repudiation, session replay, and denial of service. Information security is a growing concern and protection of the sensetive data has been becoming more difficult issue because of the ever-growing complex structures of information systems. A security vulnerability in any component of the system can cause serious security problems. Moreover, attackers who know these vulnerabilities can damage the system. Most institutions or organizations have been continuously damaged by attacks. Therefore, Information Technology (IT) security teams of institutions have focused on detecting attacks and stopping intruders from gaining access to assets on the corporate network. Attacks are categorized as an internal and external attack based on the identity of the attacker. External attacks are performed to find network vulnerabilities, gain access on information system and capture sensitive data by someone who is skilled and sophisticated from outside of the institution. On the other hand, internal attacks are performed by someone who is close to an organization with authorized access and misuses that access negatively to impact the organization's critical information or system. An insider can be a current or former employee, contractor, or business partner who has or had authorized access to the organization's network, systems, or data. Threat and attack are the two terms associated with internal attacks. Insider threat can be occur because of negligance of employee, so it is not referred as attack directly. It is called attack when someone tries to harm the system intentionally. In contrast, it is called insider threat when some error occurs unintentionally because of employee mistakes which creates a vulnerability on the system and puts a risk on it. Besides, operating system vulnerabilities which are currently published on Common Vulnerabilities and Exposures (CVE) are referred as threat for a system. Nowadays, it is seen that the attacks by authorized people or security vulnerabilities because of negligence or lack of knowledge of authorized people caused more damage than the external attacks. Institutions or organizations use common security solutions such as Data Loss Prevention (DLP), encryption, and identity and access management solutions to protect assets which are valuable to them. However, security solutions and environments have started to change as a result of the rise of advanced persistent threats (APT), increased attacks that bypass traditional security solutions and unknown malwares which can run without affecting the internal systems. For this reason, Intrusion Detection and Prevention Systems (IDS / IPS), log management and SIEM platforms have been developed and used by institutions to provide a better detection of insider threats and attacks. This study comprises of research and development to detect internal threats and attacks by focusing on intrusion detection systems. Traditional intrusion detection systems have been designed and developed using signature-based detection and anomaly-based detection approaches. Signature-based detection systems try to find defined patterns or signatures within the examined data. For this purpose, a database have been effectuated for patterns or signatures corresponding to known attacks. In these systems, although the rate of detection of the identified and known attacks is very high, it is insufficient to identify new and unknown attacks. Anomaly-based systems predicts the unusual behavior of the protected system and determines the deviation between the behavior that is observed at a given moment and the usual behavior. This approach also generates an unusual status warning when the observed deviation exceeds a predefined threshold. The most important advantage of these systems is the success in detecting unseen attacks. Signature-based detection and anomaly-based detection methods both examines each network packet and produces a result. In the situation that the packet has been missed or the correct result has not been produced, the threat on the network continues. Network Behaviour Analysis (NBA) approach is used in order to solve this problem. Network behavior analysis approach passively monitors the traffic on network and marks the new, unknown, or unusual situations which can be considered as an attack. The difference between this approach and the other detection methods is that it produces a result by examining the data flow generated by combining the network packets. Also this approach generally focuses on internal networks. In this study, we focused on the Network Behavior Anomaly Detection (NBAD) approach which detects new and unusual situations by using data flow information in order to detect internal threats. In order to advance the study, a data set that contains network traffic information is needed. In this context, the UNB ISCX IDS 2012 data set which was created by monitoring network traffic for seven days with Wireshark network monitoring tool have been used. Also, data flow that includes source IP, destination IP, source port number and destination port number as a key was created using network packets in this data set. After this process, deep learning approach which had been developed as a subset of machine learning have been used to detect the abnormalities. Deep learning includes artificial neural networks inspired by the structure and functionality of the human brain. For the training of artificial neural networks, a large number of data and computers with high processing capacity are needed. Therefore, although artificial neural networks are a formerly developed algorithm, its use has increased recently, especially with the development of the TensorFlow library. Within the scope of the study, 47 features were identified using the data set and a data flow that contains these attributes was created. In order to analyze the effect of these attributes on the model, a reduced data set which contains 19 feature was created using feature selection algorithm. By using this prepared data flows and artificial neural network algorithm, it is aimed to determine the model that produces the best result by changing the layer and neuron numbers of the algorithm. Consequently, the results obtained by changing the number of layers and neurons of the algorithm were compared and it was seen that the best result was produced as 98.44% accuracy result with the data set that contains 47 features and 3 hidden layer and 100-400-200 neuron/node values.