An Insider Threat Indicator Ontology
• Technical Report
Publisher
Software Engineering Institute
CMU/SEI Report Number
CMU/SEI-2016-TR-007Topic or Tag
Abstract
The insider threat community currently lacks a standardized method of expression for indicators of potential malicious insider activity. We believe that communicating potential indicators of malicious insider activity in a consistent and commonly accepted language will allow insider threat programs to implement more effective controls through an increase in collaboration and information sharing with other insider threat teams. In this report, we present an ontology for insider threat indicators. We make the case for using an ontology to fill the stated gap in the insider threat community. We also describe the semi-automated, data-driven development of the ontology, as well as the process by which the ontology was validated. In the appendices, we provide the ontology’s user’s manual and technical specification.
Cite This Technical Report
Costa, D., Albrethsen, M., Collins, M., Perl, S., Silowash, G., & Spooner, D. (2016, May 10). An Insider Threat Indicator Ontology. (Technical Report CMU/SEI-2016-TR-007). Retrieved December 13, 2024, from https://insights.sei.cmu.edu/library/an-insider-threat-indicator-ontology/.
@techreport{costa_2016,
author={Costa, Daniel and Albrethsen, Michael and Collins, Matthew and Perl, Samuel and Silowash, George and Spooner, Derrick},
title={An Insider Threat Indicator Ontology},
month={{May},
year={{2016},
number={{CMU/SEI-2016-TR-007},
howpublished={Carnegie Mellon University, Software Engineering Institute's Digital Library},
url={https://insights.sei.cmu.edu/library/an-insider-threat-indicator-ontology/},
note={Accessed: 2024-Dec-13}
}
Costa, Daniel, Michael Albrethsen, Matthew Collins, Samuel Perl, George Silowash, and Derrick Spooner. "An Insider Threat Indicator Ontology." (CMU/SEI-2016-TR-007). Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, May 10, 2016. https://insights.sei.cmu.edu/library/an-insider-threat-indicator-ontology/.
D. Costa, M. Albrethsen, M. Collins, S. Perl, G. Silowash, and D. Spooner, "An Insider Threat Indicator Ontology," Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, Technical Report CMU/SEI-2016-TR-007, 10-May-2016 [Online]. Available: https://insights.sei.cmu.edu/library/an-insider-threat-indicator-ontology/. [Accessed: 13-Dec-2024].
Costa, Daniel, Michael Albrethsen, Matthew Collins, Samuel Perl, George Silowash, and Derrick Spooner. "An Insider Threat Indicator Ontology." (Technical Report CMU/SEI-2016-TR-007). Carnegie Mellon University, Software Engineering Institute's Digital Library, Software Engineering Institute, 10 May. 2016. https://insights.sei.cmu.edu/library/an-insider-threat-indicator-ontology/. Accessed 13 Dec. 2024.
Costa, Daniel; Albrethsen, Michael; Collins, Matthew; Perl, Samuel; Silowash, George; & Spooner, Derrick. An Insider Threat Indicator Ontology. CMU/SEI-2016-TR-007. Software Engineering Institute. 2016. https://insights.sei.cmu.edu/library/an-insider-threat-indicator-ontology/