Mitigating Insider Threats on the Edge:
A Knowledgebase Approach
2Software Engineering Department, Jordan University of
Science and Technology, Jordan
Abstract: Insider Threats, who are cloud internal users, cause very
serious problems, which in terns, leads to devastating attacks for both
individuals and organizations. Although, most of the attentions, in the real
world, is for the outsider attacks, however, the most damaging attacks come
from the Insiders. In cloud computing, the problem becomes worst in which the
number of insiders are maximized and hence, the amount of data that can be
breached and disclosed is also maximized. Consequently, insiders' threats in
the cloud ought to be one of the top most issues that should be handled and
settled. Classical solutions to defend against insiders’ threats might fail
short as it is not easy to track both activities of the insiders as well as the
amount of knowledge an insider can accumulate through his/her privileged
accesses. Such accumulated knowledge can be used to disclose critical
information –which the insider is not privileged to- through expected
dependencies that exist among different data items that reside in one or more nodes
of the cloud. This paper provides a solution that suits well the specialized nature
of the above mentioned problem. This solution takes advantage of knowledge bases
by tracking accumulated knowledge of insiders through building Knowledge Graphs
(KGs) for each insider. It also takes advantage of Mobile Edge Computing (MEC)
by building a fog layer where a mitigation unit -resides on the edge- takes
care of the insiders threats in a place that is as close as possible to the
place where insiders reside. As a consequence, this gives continuous reactions
to the insiders’ threats in real-time, and at the same time, lessens the
overhead in the cloud. The MEC model to be presented in this paper utilizes a knowledgebase
approach where insiders’ knowledge is tracked and modeled. In case an insider
knowledge accumulates to a level that is expected to cause some potential
disclosure of private data, an alarm will be raised so that expected actions
should be taken to mitigate this risk. The knowledgebase approach involves
generating Knowledge Graphs (KGs), Dependency Graphs (DGs) where a Threat
Prediction Value (TPV) is evaluated to estimate the risk upon which alarms for
potential disclosure are raised. Experimental analysis has been conducted using
CloudExp simulator where the results have shown the ability of the proposed
model to raise alarms for potential risks from insiders in a real time fashion
with accurate precision.
Keywords:
Insider Threats, Fog, Mobile
Edge, Cloud, Knowledge Graph, Dependency Graph, Database.
Received
February 29, 2020; accepted June 9, 2020
https://doi.org/10.34028/iajit/17/4A/6