Research ArticleOpen AccessGoogle Scholar indexed
Cybersecurity Risk Management through Behavior-Based Contextual Analysis of Online Logs
School of Cybersecurity & Privacy, Georgia Institute of Technology, Atlanta, GA, USA
School of Cybersecurity & Privacy, Georgia Institute of Technology, Atlanta, GA, USA
- 1 School of Cybersecurity & Privacy, Georgia Institute of Technology, Atlanta, GA, USA
- 2 School of Cybersecurity & Privacy, Georgia Institute of Technology, Atlanta, GA, USA
Journal of Software Engineering and Applications·Volume 17 (2024)·Pages 487–507·Published 7 June 2024·DOI10.4236/jsea.2024.176027
Copy link · social · email
Abstract
This paper studies cyber risk management by integrating contextual log analysis with User and Entity Behavior Analytics (UEBA). Leveraging Python scripting and PostgreSQL database management, the solution enriches log data with contextual and behavioral information from Linux system logs and semantic datasets. By incorporating Common Vulnerability Scoring System (CVSS) metrics and customized risk scoring algorithms, the system calculates Insider Threat scores to identify potential security breaches. The integration of contextual log analysis and UEBA <a href="#ref1">[1]</a> offers a proactive defense against insider threats, reducing false positives and prioritizing high-risk alerts.
KeywordsCyber RiskUEBACVSS
- Exabeam (2023) What Is UEBA and Why It Should Be an Essential Part of Your Incident Response. https://www.exabeam.com/explainers/ueba/what-is-ueba-and-why-it-should-be-an-essential-part-of-your-incident-response/
- Crawford, M. and Peterson, G. (2013) Insider Threat Detection Using Virtual Machine Introspection. 2013 46 th Hawaii International Conference on System Sciences , Wailea, HI, 7-10 January 2013, 1821-1830. https://doi.org/10.1109/HICSS.2013.278 https://ieeexplore.ieee.org/abstract/document/6480061
- Findley, S., Singh, G., Shaffer, A., et al . (2019) A Statistical Analysis Framework for Detecting Insider Threat Activities on Cyber Systems. 2019 International Conf e rence on Computational Science and Computational Intelligence (CSCI), Las Vegas, NV, 5-7 December 2019, 1-6. https://doi.org/10.1109/CSCI49370.2019.00008 https://ieeexplore.ieee.org/abstract/document/9071044
- Jiang, J., Chen, J., Gu, T., et al . (2019) Warder: Online Insider Threat Detection System Using Multi-Feature Modeling and Graph-Based Correlation. 2019 IEEE Military Communications Conference ( MILCOM ), Norfolk, VA, 12-14 November 2019, 1-6. https://doi.org/10.1109/MILCOM47813.2019.9020931 https://www.researchgate.net/publication/339760983
- GitHub Link to Linux Logs, GitHub Repository. https://github.com/logpai/loghub?tab=readme-ov-file
- Software Engineering Institute (2022) Common Sense Guide to Mitigating Insider Threats, Seventh Edition. https://insights.sei.cmu.edu/library/common-sense-guide-to-mitigating-insider-threats-seventh-edition/
- National Vulnerability Database. https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
- BeyondTrust (2022) Insider Threat Indicators: How to Identify & Mitigate Insider Attacks. https://www.beyondtrust.com/blog/entry/insider-threat-indicators-how-to-identify-mitigate-insider-attacks
- Insider Threat Guide (2024) Insider Threat: The Ultimate Guide. https://www.nextdlp.com/resources/blog/insider-threat-ultimate-guide
- (2022) ISO/IEC 27001:2022: Information Security, Cybersecurity and Privacy Protection—Information Security Management Systems—Requirements. https://www.iso.org/standard/27001
- Ekran System (2021) Portrait of Malicious Insiders: Types, Characteristics, and Indicators. https://www.ekransystem.com/en/blog/portrait-malicious-insiders
- Axelsson, S. (2000) The Base-Rate Fallacy and the Difficulty of Intrusion Detection, ACM Transactions on Information and Systems Security , 3, 186-205. https://doi.org/10.1145/357830.357849