Attack-Centric Autonomic Detector of Insider Adversaries (ACADIA)

Most state-of-the-art cyber security systems focus primarily on detecting and remediating external threats and do not address insider attacks. Any user who can log into a network locally or remotely constitutes an insider on that network. Such trusted entities often have access to details of their network’s infrastructure and security systems and can easily plan activities to subvert these systems. To address threats from insider adversaries we propose an Attack Centric Autonomic Detector of Insider Adversaries (ACADIA) that prevents insider attacks using multi-layered policy mechanisms, monitors insider activity using statistical and policy-based user modeling, detects insider threats using correlation algorithms, and responds to insider attacks using policy rule enforcement and data forensics via a multi-agent architecture. Our approach consists of a hierarchical collection of Bayesian belief networks (BN) for insider modeling, complex event processing (CEP) and prediction of insider attack; a configuration engine and cyber security architecture to support policy maintenance and accountability; a correlation engine comprised of statistical and BN learning algorithms for insider modeling, monitoring, and anomaly detection; and a network of autonomic agents to execute policy, aggregate network and host-based event data, and perform response and remediation.