Misuse detection

Misuse Detection actively works against potential insider threats to vulnerable company data.

Misuse

Insider misuse of technical systems is a growing problem in companies world-wide. In 1996, 62.9 percent of companies reported misuse of computer systems by insiders . The concept of Misuse Detection is to track computer use within a company and prevent users from compromising critical company data.

Theory

Misuse Detection utilizes anomaly detection as a way to identify insider misuse of a system. A profile of acceptable or routine actions is created, which is then be compared to future actions that a user makes. The profile is a set of data collected from monitoring a user for a period of time. During this calibration, it is assumed that the user is abiding by company policy. If the user is performing illegal or unethical activities during that period of time, the profile cannot be properly constructed. After a proper profile is constructed, various algorithms can be implemented to compare current user activity to the ethical activities reflected within the user profile.

Further Reading

For more information on Misuse Detection, including papers written on the subject, consider the following:

• Misuse Detection Concepts and Algorithms - article by the IR Lab at IIT.