براق نعمان كاظم الموسوي

Today, organizations of all sizes face many difficulties in protecting their data, systems, and tools. One issue of particular concern is the insider threat. Insiders seek to use their privileges to undermine data confidentiality, validity, and availability. Any sabotage committed by someone within a company significantly harms the company’s integrity, credibility, and financial profits. Automated feature extraction methods face challenges when used to classify data due to their tendency sometimes to return inaccurate results, leading to overfitting. Furthermore, analyzing irregular data requires extensive manual feature detection. We propose an algorithm that represents an expert system that detects insiders and determines their risk level as well. After that, the decisive step will be to intersect the results obtained from a classification using multiple algorithms with those obtained from the internal detection algorithm using expert rules. This research uses several classification methods that can deal with this type of data to predict the status of insiders within a computer network. The main goal of this study is to improve the accuracy and efficiency of identifying insiders within a computer network. Model performance evaluation includes important parameters such as precision, recall, and F1 score. The highest classification accuracy is obtained at 0.99, and after combining these results with the results of the proposed algorithm, the accuracy is 100%. These results highlight the remarkable ability of these models to detect internal states accurately, providing encouraging possibilities for improving cyber security within a computer network.

Recently, the number of insiders of computer networks in companies has increased. Some insiders can be detected when they perform outside activities, such as sending a file or opening blocked websites, to enter the company network. Another class of insiders is the company's employees, and it is difficult to identify them. And here lies the problem—the taxonomies of insiders and insider threats. The survey method is one of the most widely used approaches to constructing a taxonomy of insiders. This method is based on the analysis of materials from investigations of computer security incidents conducted by computer security specialists. Based on the incidents investigated, it is possible to categorize studies using technical and psychosocial data. User data on networks requires detailed preliminary analysis to study user behavior and identify insiders more accurately. In this research, we proposed a model to detect insiders when making any events on networks like the open blocked site, sending emails, and logging into the network at a suitable time. The proposed algorithm needs to analyze a user data set based on the No SQL language and then define expert rules to determine the degree of risk for insiders. Analysis of the proposed algorithm regarding time, accuracy, and correctness of the insider classification led to satisfactory results.