Misuse detection

Misuse Detection actively works against potential insider threats to vulnerable company data.

Misuse

Insider misuse of technical systems is a growing problem in companies world-wide. In 1996, 62.9 percent of companies reported misuse of computer systems by insiders . The concept of Misuse Detection is to track computer use within a company and prevent users from compromising critical company data.

Theory

Detection of misuse can be attempted by creating a profile of acceptable or routine actions, which would then be compared to actions that a user makes. The profile is a set of data collected from monitoring a user for a period of time. During this calibration, it is assumed that the user is abiding by company policy. If the user is performing illegal or unethical activities during that period of time, the profile cannot be properly constructed. After a proper profile is constructed, various algorithms can be implemented to compare current user activity to the ethical activities reflected within the user profile.

Further Reading

For more information on Misuse Detection, including papers written on the subject, consider the following:

• Misuse Detection Concepts and Algorithms - article by the IR Lab at IIT.