Insider Data Theft Prevention System

Insider data theft attacks are characterized by an adversary stealing a legitimate user's credentials and using them to impersonate the authenticate user and to perform malicious activities. Prior works also combines a user behavior profiling technique with a baiting technique, but profiling user behavior using single modeling technique suffers from a considerable number of false positives. Also decoy documents are placed at conspicuous locations rather than using automatically generated decoys which may not give significant accuracy to the detection system. Proposed system will extend prior work and presents an integrated detection approach where behavior profiling will be done by combining more than one classifier, each uses different modeling algorithm to reduce false positive rate. Along with this proposed system will include a baiting approach based on automated generation of demand decoy documents on the user's file system and user authentication by challenge questions, to provide more accuracy. Proposed system could provide a strong defense mechanism against malicious insider data theft attacks.