At Northrop Grumman IT, we believe that there are other available measurements that exist that when viewed in their entirety can potentially declare an insider attack and can perform that analysis in real time.  Measures of user activity can be fused in real-time with, for example, timecard, premises, and other sensor authentication information that is available in real time, to augment the declaration process and offer fidelity and certainty into the accuracy of the prediction.  This implies that additional and empirical measures can be taken and used as “cyber evidence”.

By way of an example, consider an excessive amount of read-write cycle activity along with a high amount of copy commands, all being done from a user workstation that has profiled that workstations users.  This might generate an alert, but by itself this is not conclusive.  The user, who normally only generates text files and is now accessing substantial graphics files may be legitimately working on a presentation, so further filtering and checks are needed.  This is where the fusion adds additional identification information.  Let’s add in three other sensors. These are three sensors you probably have available right now. They are premises entry systems, the timecard/attendance system and the network system logons.  Now the other three systems are queried.  It turns out that the premises entry system reports that the administrator is on site, and a record of which entry was used is recorded.  The timecard system shows that the administrator is not currently on vacation and the logon system shows that the administrator is currently on that workstation.  Fusing this information shows that the administrator was most likely a legitimate user.   But, for example, the timecard system shows the administrator on vacation, premises entry has no record of entry but the logon system shows that the administrator is logged on, and then an alert with a fair degree of certainty can be sounded.  And most importantly, that alert can be sounded in real time.

What Can We Conclude?

Cyber sensor fusion will offer an additional level of real-time intrusion detection that is performance based.  This concept offers a great deal of promise not only in the development of a unique approach for insider detection, but also in the transition of this technology to applications within systems.  This is primarily because the additional filtering components are commercially available and are operationally accepted.   By being able to distinguish between legitimate system resources use and misuse, we can now maintain electronic fingerprints and relate those fingerprints to all users in the system.  When those fingerprint events get out of range, the additional real-time checks are used to decide if a “triggered response” is warranted.

Courses of action can now include a number of real-time choices: closing off the system to the intruder, gathering forensic evidence on the intruder and/or employing deception against the intruder.