ntvНаучно-технический вестник информационных технологий, механики и оптикиScientific and Technical Journal of Information Technologies, Mechanics and Optics2226-14942500-0373Университет ИТМО10.17586/2226-1494-2022-22-4-760-768ntv-220Research ArticleКОМПЬЮТЕРНЫЕ СИСТЕМЫ И ИНФОРМАЦИОННЫЕ ТЕХНОЛОГИИCOMPUTER SCIENCEМетод обнаружения инцидентов информационной безопасности по аномалиям в биометрических поведенческих чертах пользователяA method of detecting information security incidents based on anomalies in the user’s biometric behavioral characteristicshttps://orcid.org/0000-0003-4467-5117ЕсиповД. А.EsipovD. A.

Есипов Дмитрий Андреевич — инженер

Санкт-Петербург, 197101

Dmitry A. Esipov — Engineer

Saint Petersburg, 197101

some1else.d.ma@gmail.comhttps://orcid.org/0000-0003-3650-7412АслановаН.AslanovaN.

Асланова Наргиз — студент

Санкт-Петербург, 197101

Nargiz Aslanova — Student

Saint Petersburg, 197101

aslanova.077@gmail.comhttps://orcid.org/0000-0001-6659-9878ШабалаЕ. Е.ShabalaE. E.

Шабала Егор Евгеньевич — инженер

Санкт-Петербург, 197101

Egor E. Shabala — Engineer

Saint Petersburg, 197101

e.shabala@altdisasm.ruhttps://orcid.org/0000-0003-3913-3997ЩетининД. С.ShchetininD. S.

Щетинин Даниил Сергеевич — инженер

Санкт-Петербург, 197101

Daniil S. Shchetinin — Engineer

Saint Petersburg, 197101

1nta4r@gmail.comhttps://orcid.org/0000-0002-6407-7934ПоповИ. Ю.PopovI. Yu.

Попов Илья Юрьевич — кандидат технических наук, доцент

sc 57202195632

Санкт-Петербург, 197101

Ilya Yu. Popov — PhD, Associate Professor

sc 57202195632

Saint Petersburg, 197101

ilyapopov27@gmail.comУниверситет ИТМОРоссияITMO UniversityRussian Federation202215122024224760768Copyright © Есипов Д.А., Асланова Н., Шабала Е.Е., Щетинин Д.С., Попов И.Ю., 20242024Есипов Д.А., Асланова Н., Шабала Е.Е., Щетинин Д.С., Попов И.Ю.Esipov D.A., Aslanova N., Shabala E.E., Shchetinin D.S., Popov I.Y.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://ntv.elpub.ru/jour/article/view/220

Предмет исследования. В настоящее время значительный объем атак на информационные системы составляют многоэтапные целевые атаки. Зачастую ключевыми субъектами атаки становятся внутренние нарушители — инсайдеры. Действия инсайдера отличаются от активности легитимного пользователя. Тогда возможно формирование модели поведения пользователя, отличия от которой могут быть классифицированы как события или инциденты информационной безопасности. Существующие подходы к обнаружению аномалий в активности пользователя предполагают использование отдельных характеристик его поведения, без учета их взаимозависимостей и зависимостей от различных факторов. Задача исследования состоит в формировании комплексной характеристики поведения пользователя при использовании компьютера — «цифровой метрики», для обнаружения событий и инцидентов информационной безопасности. Метод. Предложен метод обнаружения инцидентов информационной безопасности посредством формирования цифровой метрики пользователя за счет анализа его поведенческих характеристик и их зависимостей, выбранных в качестве предикторов. Разработанный метод предполагает формирование модели посредством машинного обучения без учителя. Рассмотрены алгоритмы: опорных векторов для одного класса, изолирующего леса и эллипсоидальной аппроксимации данных. Основной метрикой качества моделей выбран коэффициент корреляции Мэтьюса, однако были рассмотрены и другие показатели. Выполнен сравнительный анализ моделей, обученных выбранными алгоритмами с различными параметрами по метрикам качества. Основные результаты. Выполнен эксперимент с целью получения оценки разработанного метода и сравнения его эффективности с ближайшим аналогом. Для обучения и оценки моделей в рамках исследуемых методов использованы реальные данные о поведении 138 пользователей. По результатам сравнительного анализа, разработанный метод продемонстрировал отличные показатели по всем рассмотренным метрикам, в том числе повышение коэффициента корреляции Мэтьюса на 0,6125. Практическая значимость. Разработанный метод может быть использован для непрерывной аутентификации пользователя в средствах защиты информации от несанкционированного доступа и выявления инцидентов информационной безопасности, связанных с действиями инсайдеров.

Nowadays a significant amount of attacks on information systems are multi-stage attacks. In many cases the key subjects of attacks are insiders. The actions of an insider differ from the activity of a legitimate user, so it is possible for the latter to form a model of his behavior. Then the differences from the specified model can be classified as information security events or incidents. Existing approaches to anomaly detection in user activity use separate characteristics of user behavior, without taking into account their interdependencies and dependencies on various factors. The task of the study is to form a comprehensive characteristic of the user`s behavior when using a computer — a “digital pattern” for detecting information security events and incidents. The essence of the method is in the formation of a digital pattern of the user’s activity by analyzing his behavioral characteristics and their dependencies selected as predictors. The developed method involves the formation of a model through unsupervised machine learning. The following algorithms were considered: one-class support vector machine, isolating forest and elliptic envelope. The Matthews correlation coefficient was chosen as the main metric for the quality of the models, but other indicators were also taken into consideration. According to the selected quality metrics, a comparative analysis of algorithms with different parameters was conducted. An experiment was carried out to evaluate the developed method and compare its effectiveness with the closest analogue. Real data on the behavior of 138 users was used to train and evaluate models within the studied methods. According to the results of the comparative analysis, the proposed method showed great performance for all the considered metrics, including an increase in the Matthews correlation coefficient by 0.6125 compared to the anomaly detection method by keystroke dynamics. The proposed method can be used for continuous user authentication from unauthorized access and identifying information security incidents related to the actions of insiders.

обнаружение и реагирование на угрозы на конечных точкахклавиатурный почеркцифровая метрикамашинное обучениеобнаружение аномалийметод опорных векторовалгоритм изолирующего лесаалгоритм эллипсоидальной аппроксимации данныхendpoint detection and responseEDRkeystroke dynamicsdigital patternmachine learninganomaly detectionsupport vector machineSVMisolation forestelliptic envelopeReferencesSiddiqi M.A., Mugheri A., Oad K. Advance persistent threat defense techniques: A review // Pakistan Journal of Computer and Information Systems. 2016. V. 1. N 2. P. 53–65.Siddiqi M.A., Mugheri A., Oad K. Advance persistent threat defense techniques: A review. Pakistan Journal of Computer and Information Systems, 2016, vol. 1, no. 2, pp. 53–65.Al-Zewairi M., Almajali S., Ayyash M. Unknown security attack detection using shallow and deep ANN classifiers // Electronics. 2020. V. 9. N 12. P. 2006. https://doi.org/10.3390/electronics9122006Al-Zewairi M., Almajali S., Ayyash M. Unknown security attack detection using shallow and deep ANN classifiers. Electronics, 2020, vol. 9, no. 12, pp. 2006. https://doi.org/10.3390/electronics9122006Aparicio-Navarro F.J., Kyriakopoulos K.G., Gong Y., Parish D.J., Chambers J.A. Using pattern-of-life as contextual information for anomaly-based intrusion detection systems // IEEE Access. 2017. V. 5. P. 22177–22193. https://doi.org/10.1109/ACCESS.2017.2762162Aparicio-Navarro F.J., Kyriakopoulos K.G., Gong Y., Parish D.J., Chambers J.A. Using pattern-of-life as contextual information for anomaly-based intrusion detection systems. IEEE Access, 2017, vol. 5, pp. 22177–22193. https://doi.org/10.1109/ACCESS.2017.2762162Aparicio-Navarro F.J., Chambers J.A., Kyriakopoulos K., Gong Y., Parish D. Using the pattern-of-life in networks to improve the effectiveness of intrusion detection systems // Proc. of the 2017 IEEE International Conference on Communications (ICC). 2017. P. 7997374. https://doi.org/10.1109/ICC.2017.7997374Aparicio-Navarro F.J., Chambers J.A., Kyriakopoulos K., Gong Y., Parish D. Using the pattern-of-life in networks to improve the effectiveness of intrusion detection systems. Proc. of the 2017 IEEE International Conference on Communications (ICC), 2017, pp. 7997374. https://doi.org/10.1109/ICC.2017.7997374Aparicio-Navarro F.J., Kyriakopoulos K.G., Ghafir I., Lambotharan S., Chambers J.A. Multi-stage attack detection using contextual information // Proc. of the IEEE Military Communications Conference (MILCOM). 2018. P. 920–925. https://doi.org/10.1109/MILCOM.2018.8599708Aparicio-Navarro F.J., Kyriakopoulos K.G., Ghafir I., Lambotharan S., Chambers J.A. Multi-stage attack detection using contextual information. Proc. of the IEEE Military Communications Conference (MILCOM), 2018, pp. 920–925. https://doi.org/10.1109/MILCOM.2018.8599708Aparicio-Navarro F.J., Chadza T.A., Kyriakopoulos K.G., Ghafir I., Lambotharan S., Assadhan B. Addressing multi-stage attacks using expert knowledge and contextual information // Proc. of the 22nd Conference on Innovation in Clouds, Internet and Networks and Workshops (ICIN). 2019. P. 188–194. https://doi.org/10.1109/ICIN.2019.8685841Aparicio-Navarro F.J., Chadza T.A., Kyriakopoulos K.G., Ghafir I., Lambotharan S., Assadhan B. Addressing multi-stage attacks using expert knowledge and contextual information. Proc. of the 22nd Conference on Innovation in Clouds, Internet and Networks and Workshops (ICIN), 2019, pp. 188–194. https://doi.org/10.1109/ICIN.2019.8685841Budiarto R., Alqarni A.A., Alzahrani M.Y., Pasha M.F., Firdhous M.F.M., Stiawan D. User behavior traffic analysis using a simplified memory-prediction framework // Computers, Materials and Continua. 2022. V. 70. N 2. P. 2679–2698. https://doi.org/10.32604/cmc.2022.019847Budiarto R., Alqarni A.A., Alzahrani M.Y., Pasha M.F., Firdhous M.F.M., Stiawan D. User behavior traffic analysis using a simplified memory-prediction framework. Computers, Materials and Continua, 2022, vol. 70, no. 2, pp. 2679–2698. https://doi.org/10.32604/cmc.2022.019847Quraishi S.J., Bedi S.S. Keystroke dynamics biometrics, a tool for user authentication–review // Proc. of the 7th International Conference on System Modeling and Advancement in Research Trends (SMART). 2018. P. 248–254. https://doi.org/10.1109/SYSMART.2018.8746932Quraishi S.J., Bedi S.S. Keystroke dynamics biometrics, a tool for user authentication–review. Proc. of the 7th International Conference on System Modeling and Advancement in Research Trends (SMART), 2018, pp. 248–254. https://doi.org/10.1109/SYSMART.2018.8746932Xiaofeng L., Shengfei Z., Shengwei Y. Continuous authentication by free-text keystroke based on CNN plus RNN // Procedia Computer Science. 2019. V. 147. P. 314–318. https://doi.org/10.1016/j.procs.2019.01.270Xiaofeng L., Shengfei Z., Shengwei Y. Continuous authentication by free-text keystroke based on CNN plus RNN. Procedia Computer Science, 2019, vol. 147, pp. 314–318. https://doi.org/10.1016/j.procs.2019.01.270Druijff-van de Woestijne G.B., McConchie H., de Kort Y., Licitra G., Zhang C., Overeem S., Smolders K.C.H.J. Behavioural biometrics: Using smartphone keyboard activity as a proxy for rest–activity patterns // Journal of Sleep Research. 2021. V. 30. N 5. P. e13285. https://doi.org/10.1111/jsr.13285Druijff-van de Woestijne G.B., McConchie H., de Kort Y., Licitra G., Zhang C., Overeem S., Smolders K.C.H.J. Behavioural biometrics: Using smartphone keyboard activity as a proxy for rest–activity patterns. Journal of Sleep Research, 2021, vol. 30, no. 5, pp. e13285. https://doi.org/10.1111/jsr.13285Крутохвостов Д.С., Хиценко В.Е. Парольная и непрерывная аутентификация по клавиатурному почерку средствами математической статистики // Вопросы кибербезопасности. 2017. № 5(24). С. 91–99. https://doi.org/10.21681/2311-3456-2017-5-91-99Krutohvostov D., Khitsenko V. Password authentication and continuous authentication by keystroke dynamics using mathematical statistics. Voprosy kiberbezopasnosti, no. 5(24), pp. 91–99. (in Russian). https://doi.org/10.21681/2311-3456-2017-5-91-99Sjarif N.N.A., Chuprat S., Mahrin M.N., Ahmad N.A., Senan F.M., Zamani N.A., Saupi A. Endpoint detection and response: Why use machine learning? // Proc. of the 10th International Conference on Information and Communication Technology Convergence (ICTC). 2019. P. 283–288. https://doi.org/10.1109/ICTC46691.2019.8939836Sjarif N.N.A., Chuprat S., Mahrin M.N., Ahmad N.A., Senan F.M., Zamani N.A., Saupi A. Endpoint detection and response: Why use machine learning? Proc. of the 10th International Conference on Information and Communication Technology Convergence (ICTC), 2019, pp. 283–288. https://doi.org/10.1109/ICTC46691.2019.8939836Kumar Singh Gautam R., Doegar E.A. An ensemble approach for intrusion detection system using machine learning algorithms // Proc. of the 8th Confluence International Conference on Cloud Computing, Data Science and Engineering. 2018. P. 14–15. https://doi.org/10.1109/CONFLUENCE.2018.8442693Kumar Singh Gautam R., Doegar E.A. An ensemble approach for intrusion detection system using machine learning algorithms. Proc. of the 8th Confluence International Conference on Cloud Computing, Data Science and Engineering, 2018, pp. 61–64. https://doi.org/10.1109/CONFLUENCE.2018.8442693Alqudah N., Yaseen Q. Machine learning for traffic analysis: a review // Procedia Computer Science. 2020. V. 170. P. 911–916. https://doi.org/10.1016/j.procs.2020.03.111Alqudah N., Yaseen Q. Machine learning for traffic analysis: a review. Procedia Computer Science, 2020, vol. 170, pp. 911–916. https://doi.org/10.1016/j.procs.2020.03.111Lampert C.H. Kernel methods in computer vision // Foundations and Trends in Computer Graphics and Vision. 2009. V. 4. N 3. P. 193–285. http://dx.doi.org/10.1561/0600000027Lampert C.H. Kernel methods in computer vision. Foundations and Trends in Computer Graphics and Vision, 2009, vol. 4, no. 3, pp. 193–285. http://dx.doi.org/10.1561/0600000027Bounsiar A., Madden M.G. One-class support vector machines revisited // Proc. of the 5th International Conference on Information Science & Applications (ICISA). 2014. P. 6847442. https://doi.org/10.1109/ICISA.2014.6847442Bounsiar A., Madden M.G. One-class support vector machines revisited. Proc. of the 5th International Conference on Information Science & Applications (ICISA), 2014, pp. 6847442. https://doi.org/10.1109/ICISA.2014.6847442Tax D.M.J., Duin R.P.W. Support vector data description // Machine Learning. 2004. V. 54. N 1. P. 45–66. https://doi.org/10.1023/B:MACH.0000008084.60811.49Tax D.M.J., Duin R.P.W. Support vector data description. Machine Learning, 2004, vol. 54, no. 1, pp. 45–66. https://doi.org/10.1023/B:MACH.0000008084.60811.49Liu F.T., Ting K.M., Zhou Z.H. Isolation forest // Proc. of the 8th IEEE International Conference on Data Mining (ICDM). 2008. P. 413–422. https://doi.org/10.1109/ICDM.2008.17Liu F.T., Ting K.M., Zhou Z.H. Isolation forest. Proc. of the 8th IEEE International Conference on Data Mining (ICDM), 2008, pp. 413–422. https://doi.org/10.1109/ICDM.2008.17Ji Y., Wang Q., Li X., Liu J. A survey on tensor techniques and applications in machine learning // IEEE Access. 2019. V. 7. P. 162950–162990. https://doi.org/10.1109/ACCESS.2019.2949814Ji Y., Wang Q., Li X., Liu J. A survey on tensor techniques and applications in machine learning. IEEE Access, 2019, vol. 7, pp. 162950–162990. https://doi.org/10.1109/ACCESS.2019.2949814Howard S. The Elliptical Envelope // arXiv. 2007. arXiv:math/0703048. https://doi.org/10.48550/arXiv.math/0703048Howard S. The Elliptical Envelope. arXiv, 2007, arXiv:math/0703048. https://doi.org/10.48550/arXiv.math/0703048Ashrafuzzaman M., Das S., Jillepalli A.A., Chakhchoukh Y., Sheldon F.T. Elliptic envelope based detection of stealthy false data injection attacks in smart grid control systems // Proc. of the 2020 IEEE Symposium Series on Computational Intelligence (SSCI). 2020. P. 1131–1137. https://doi.org/10.1109/SSCI47803.2020.9308523Ashrafuzzaman M., Das S., Jillepalli A.A., Chakhchoukh Y., Sheldon F.T. Elliptic envelope based detection of stealthy false data injection attacks in smart grid control systems. Proc. of the 2020 IEEE Symposium Series on Computational Intelligence (SSCI), 2020, pp. 1131–1137. https://doi.org/10.1109/SSCI47803.2020.9308523Pedregosa F., Varoquaux G., Gramfort A., Michel V., Thirion B., Grisel O., Blondel M., Prettenhofer P., Weiss R., Dubourg V., Vanderplas J., Passos A., Cournapeau D., Brucher M., Perrot M., Duchesnay É. Scikit-learn: Machine learning in Python // Journal of Machine Learning Research. 2011. V. 12. P. 2825–2830.Pedregosa F., Varoquaux G., Gramfort A., Michel V., Thirion B., Grisel O., Blondel M., Prettenhofer P., Weiss R., Dubourg V., Vanderplas J., Passos A., Cournapeau D., Brucher M., Perrot M., Duchesnay É. Scikit-learn: Machine learning in Python. Journal of Machine Learning Research, 2011, vol. 12, pp. 2825–2830.Saranya T., Sridevi S., Deisy C., Chung T.D., Khane M.K.A.A. Performance analysis of machine learning algorithms in intrusion detection system: A review // Procedia Computer Science. 2020. V. 171. P. 1251–1260. https://doi.org/10.1016/j.procs.2020.04.133Saranya T., Sridevi S., Deisy C., Chung T.D., Khane M.K.A.A. Performance analysis of machine learning algorithms in intrusion detection system: A review. Procedia Computer Science, 2020, vol. 171, pp. 1251–1260. https://doi.org/10.1016/j.procs.2020.04.133Chicco D., Jurman G. The advantages of the Matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation // BMC Genomics. 2020. V. 21. N 1. P. 1–13. https://doi.org/10.1186/s12864-019-6413-7Chicco D., Jurman G. The advantages of the Matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation. BMC Genomics, 2020, vol. 21, no. 1, pp. 1–13. https://doi.org/10.1186/s12864-019-6413-7

The authors declare that there are no conflicts of interest present.