San Francisco, CA
May 23, 2013 to May 24, 2013
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/SPW.2013.34
The insider threat is a prime security concern for government and industry organizations. As insider threat programs come into operational practice, there is a continuing need to assess the effectiveness of tools, methods, and data sources, which enables continual process improvement. This is particularly challenging in operational environments, where the actual number of malicious insiders in a study sample is not known. The present paper addresses the design of evaluation strategies and associated measures of effectiveness; several quantitative/statistical significance test approaches are described with examples, and a new measure, the Enrichment Ratio, is proposed and described as a means of assessing the impact of proposed tools on the organization's operations.
assessment, insider threat, evaluation, validation, metrics
Frank L. Greitzer, Thomas A. Ferryman, "Methods and Metrics for Evaluating Analytic Insider Threat Tools", SPW, 2013, 2013 IEEE CS Security and Privacy Workshops (SPW2013), 2013 IEEE CS Security and Privacy Workshops (SPW2013) 2013, pp. 90-97, doi:10.1109/SPW.2013.34