Authors:
Pamela Carvallo
1
;
Ana R. Cavalli
1
and
Natalia Kushik
2
Affiliations:
1
SAMOVAR, Télécom SudParis, CNRS, Université Paris-Saclay and Montimage, France
;
2
SAMOVAR, Télécom SudParis, CNRS and Université Paris-Saclay, France
Keyword(s):
Dataset, Cloud Computing, Intrusion Threat, User Behavior, Synthetic Data Generation, Dataset Validation.
Related
Ontology
Subjects/Areas/Topics:
Cloud Applications
;
Distributed and Mobile Software Systems
;
Software and Information Security
;
Software Engineering
;
Software Engineering Methods and Techniques
Abstract:
The malicious insider threat is often listed as one of the most dangerous cloud threats. Considering this threat, the main difference between a cloud computing scenario and a traditional IT infrastructure, is that once perpetrated, it could damage other clients due to the multi-tenancy and virtual environment cloud features. One of the related challenges concerns the fact that this threat domain is highly dependent on human behavior characteristics as opposed to the more purely technical domains of network data generation. In this paper, we focus on the derivation and validation of the dataset for cloud-based malicious insider threat. Accordingly, we outline the design of synthetic data, while discussing cloud-based indicators, and socio-technical human factors. As a proof of concept, we test our model on an airline scheduling application provided by a flight operator, together with proposing realistic threat scenarios for its future detection. The work is motivated by the complexity
of the problem itself as well as by the absence of the open, realistic cloud-based datasets.
(More)