一种实时内部威胁模型建立方法

Method for building the real time insider threat model

利用系统访问控制关系,定义了主体、客体两个偏序结构和二者间的映射关系,建立了分层映射内部威胁模型.采用层次分析法从主客体两方面对分层映射模型的内部威胁特征进行分解量化,并利用二者间的映射关系实现了对系统内部威胁的全面实时评估.克服了原有模型不能同时定量定性分析内部威胁的缺陷,提高了量化的准确性和客观性.实验结果表明,分层映射内部威胁模型能够实时、有效地评估系统的内部安全威胁,为进一步实现内部威胁感知建立了基础.

Partial orders of subjects and of objects in the system and mapping relationship between them are defined by using the access control relationship. On this basis, a hierarchy-mapping based insider threat model is developed. The analytic hierarchy process is used to decompose and quantify the insider threat features of subjects and objects in the model. Then full real time assessment is obtained by using the mapping between subjects and objects. Compared with other models, this model improves the precision and objectivity of the quantization by the combination of qualitative and quantitative analysis. Experimental results show that the hierarchy-mapping based insider threat model can effectively assess the insider threat in real-time and can be used to build the insider threat sense system.