An Approach for Stego-Insider Detection Based on a Hybrid NoSQL Database
One of the reasons for the implementation of information security threats in organizations is the insider activity of its employees. There is a big challenge to detect stego-insiders-employees who create stego-channels to secretly receive malicious information and transfer confidential information a...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2021-03-01
|
| Series: | Journal of Sensor and Actuator Networks |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2224-2708/10/2/25 |
| _version_ | 1797539502644789248 |
|---|---|
| author | Igor Kotenko Andrey Krasov Igor Ushakov Konstantin Izrailov |
| author_facet | Igor Kotenko Andrey Krasov Igor Ushakov Konstantin Izrailov |
| author_sort | Igor Kotenko |
| collection | DOAJ |
| description | One of the reasons for the implementation of information security threats in organizations is the insider activity of its employees. There is a big challenge to detect stego-insiders-employees who create stego-channels to secretly receive malicious information and transfer confidential information across the organization’s perimeter. Especially presently, with great popularity of wireless sensor networks (WSNs) and Internet of Things (IoT) devices, there is a big variety of information that could be gathered and processed by stego-insiders. Consequently, the problem arises of identifying such intruders and their transmission channels. The paper proposes an approach to solving this problem. The paper provides a review of the related works in terms of insider models and methods of their identification, including techniques for handling insider attacks in WSN, as well methods of embedding and detection of stego-embeddings. This allows singling out the basic features of stego-insiders, which could be determined by their behavior in the network. In the interests of storing these attributes of user behavior, as well as storing such attributes from large-scale WSN, a hybrid NoSQL database is created based on graph and document-oriented approaches. The algorithms for determining each of the features using the NoSQL database are specified. The general scheme of stego-insider detection is also provided. To confirm the efficiency of the approach, an experiment was carried out on a real network. During the experiment, a database of user behavior was collected. Then, user behavior features were retrieved from the database using special SQL queries. The analysis of the results of SQL queries is carried out, and their applicability for determining the attribute is justified. Weak points of the approach and ways to improve them are indicated. |
| first_indexed | 2024-03-10T12:46:53Z |
| format | Article |
| id | doaj.art-d3359ee57d624c199a8879352988b2b9 |
| institution | Directory Open Access Journal |
| issn | 2224-2708 |
| language | English |
| last_indexed | 2024-03-10T12:46:53Z |
| publishDate | 2021-03-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Journal of Sensor and Actuator Networks |
| spelling | doaj.art-d3359ee57d624c199a8879352988b2b92023-11-21T13:27:03ZengMDPI AGJournal of Sensor and Actuator Networks2224-27082021-03-011022510.3390/jsan10020025An Approach for Stego-Insider Detection Based on a Hybrid NoSQL DatabaseIgor Kotenko0Andrey Krasov1Igor Ushakov2Konstantin Izrailov3St. Petersburg Federal Research Center of the Russian Academy of Sciences, 199178 St. Petersburg, RussiaDepartment of Secured Communication Systems, The Bonch-Bruevich State University of Telecommunications, 199178 St. Petersburg, RussiaDepartment of Secured Communication Systems, The Bonch-Bruevich State University of Telecommunications, 199178 St. Petersburg, RussiaSt. Petersburg Federal Research Center of the Russian Academy of Sciences, 199178 St. Petersburg, RussiaOne of the reasons for the implementation of information security threats in organizations is the insider activity of its employees. There is a big challenge to detect stego-insiders-employees who create stego-channels to secretly receive malicious information and transfer confidential information across the organization’s perimeter. Especially presently, with great popularity of wireless sensor networks (WSNs) and Internet of Things (IoT) devices, there is a big variety of information that could be gathered and processed by stego-insiders. Consequently, the problem arises of identifying such intruders and their transmission channels. The paper proposes an approach to solving this problem. The paper provides a review of the related works in terms of insider models and methods of their identification, including techniques for handling insider attacks in WSN, as well methods of embedding and detection of stego-embeddings. This allows singling out the basic features of stego-insiders, which could be determined by their behavior in the network. In the interests of storing these attributes of user behavior, as well as storing such attributes from large-scale WSN, a hybrid NoSQL database is created based on graph and document-oriented approaches. The algorithms for determining each of the features using the NoSQL database are specified. The general scheme of stego-insider detection is also provided. To confirm the efficiency of the approach, an experiment was carried out on a real network. During the experiment, a database of user behavior was collected. Then, user behavior features were retrieved from the database using special SQL queries. The analysis of the results of SQL queries is carried out, and their applicability for determining the attribute is justified. Weak points of the approach and ways to improve them are indicated.https://www.mdpi.com/2224-2708/10/2/25cybersecuritystego-insiderNoSQL databasesteganographyattacks |
| spellingShingle | Igor Kotenko Andrey Krasov Igor Ushakov Konstantin Izrailov An Approach for Stego-Insider Detection Based on a Hybrid NoSQL Database Journal of Sensor and Actuator Networks cybersecurity stego-insider NoSQL database steganography attacks |
| title | An Approach for Stego-Insider Detection Based on a Hybrid NoSQL Database |
| title_full | An Approach for Stego-Insider Detection Based on a Hybrid NoSQL Database |
| title_fullStr | An Approach for Stego-Insider Detection Based on a Hybrid NoSQL Database |
| title_full_unstemmed | An Approach for Stego-Insider Detection Based on a Hybrid NoSQL Database |
| title_short | An Approach for Stego-Insider Detection Based on a Hybrid NoSQL Database |
| title_sort | approach for stego insider detection based on a hybrid nosql database |
| topic | cybersecurity stego-insider NoSQL database steganography attacks |
| url | https://www.mdpi.com/2224-2708/10/2/25 |
| work_keys_str_mv | AT igorkotenko anapproachforstegoinsiderdetectionbasedonahybridnosqldatabase AT andreykrasov anapproachforstegoinsiderdetectionbasedonahybridnosqldatabase AT igorushakov anapproachforstegoinsiderdetectionbasedonahybridnosqldatabase AT konstantinizrailov anapproachforstegoinsiderdetectionbasedonahybridnosqldatabase AT igorkotenko approachforstegoinsiderdetectionbasedonahybridnosqldatabase AT andreykrasov approachforstegoinsiderdetectionbasedonahybridnosqldatabase AT igorushakov approachforstegoinsiderdetectionbasedonahybridnosqldatabase AT konstantinizrailov approachforstegoinsiderdetectionbasedonahybridnosqldatabase |