Designing Host and Network Sensors to Mitigate the Insider Threat

Insider attacks-that is, attacks by users with privileged knowledge about a system-are a growing problem for many organizations. To address this threat, the authors have designed an architecture for insider threat detection that combines an array of complementary monitoring and auditing techniques.