Alsowail Rakan A, Al-Shehari Taher
Computer Skills, Self-Development Department, Deanship of Common First Year, King Saud University, Riyadh, Saudi Arabia.
PeerJ Comput Sci. 2022 Apr 1;8:e938. doi: 10.7717/peerj-cs.938. eCollection 2022.
With the wide use of technologies nowadays, various security issues have emerged. Public and private sectors are both spending a large portion of their budget to protect the confidentiality, integrity, and availability of their data from possible attacks. Among these attacks are insider attacks which are more serious than external attacks, as insiders are authorized users who have legitimate access to sensitive assets of an organization. As a result, several studies exist in the literature aimed to develop techniques and tools to detect and prevent various types of insider threats. This article reviews different techniques and countermeasures that are proposed to prevent insider attacks. A unified classification model is proposed to classify the insider threat prevention approaches into two categories (biometric-based and asset-based metric). The biometric-based category is also classified into (physiological, behavioral and physical), while the asset metric-based category is also classified into (host, network and combined). This classification systematizes the reviewed approaches that are validated with empirical results utilizing the grounded theory method for rigorous literature review. Additionally, the article compares and discusses significant theoretical and empirical factors that play a key role in the effectiveness of insider threat prevention approaches (e.g., datasets, feature domains, classification algorithms, evaluation metrics, real-world simulation, stability and scalability, ). Major challenges are also highlighted which need to be considered when deploying real-world insider threat prevention systems. Some research gaps and recommendations are also presented for future research directions.
如今，随着技术的广泛应用，各种安全问题层出不穷。公共部门和私营部门都在将其预算的很大一部分用于保护其数据的保密性、完整性和可用性，使其免受可能的攻击。这些攻击中包括内部人员攻击，这种攻击比外部攻击更为严重，因为内部人员是被授权的用户，能够合法访问组织的敏感资产。因此，文献中有几项研究旨在开发检测和预防各种类型内部威胁的技术和工具。本文回顾了为防止内部人员攻击而提出的不同技术和对策。提出了一个统一的分类模型，将内部威胁预防方法分为两类（基于生物特征的和基于资产指标的）。基于生物特征的类别又分为（生理的、行为的和物理的），而基于资产指标的类别也分为（主机、网络和组合的）。这种分类对所审查的方法进行了系统化整理，这些方法通过扎根理论方法进行严格的文献综述，并得到了实证结果的验证。此外，本文还比较和讨论了在内部威胁预防方法有效性方面起关键作用的重要理论和实证因素（例如，数据集、特征域、分类算法、评估指标、现实世界模拟、稳定性和可扩展性）。还强调了在部署实际的内部威胁预防系统时需要考虑的主要挑战。同时也提出了一些研究空白和建议，以供未来的研究方向参考。
