Simulated User Bots: Real Time Testing of Insider Threat Detection Systems

The insider threat is one of the most serious security problems faced by modern organizations. High pro?le cases demonstrate the serious consequences of successful attacks. The problem has been studied for many years, leading to a number of technologies and products that have been deployed widely in government and commercial enterprises. A fundamental question is: how well do these systems work? How may they be tested? How expensive are widely deployed monitoring infrastructures in terms of computational cost? Measurement of real systems, which are dynamic in nature, encounter unknown con?guration bugs and have sensitivities to the vagaries of human nature and adversarial behavior, requires a formal means to continuously test and evaluate deployed detection systems. We present a framework to deploy in situ simulated user bots (SUBs) that can emulate the actions of real users. By creating a user account and by running a host in the enterprise network, a SUB can be introduced into an enterprise system that runs at a realistic pace and does not interfere with normal operations. Infusing malicious behavior into the SUB should be detected by the insider threat monitoring infrastructure. The SUB framework can be controlled to explore the limits of deployed systems and to test the effectiveness of insider evasion tactics, especially low and slow behaviors. We demonstrate our framework in a synthetic ecosystem as well as in a live enterprise deployment. We created a synthetic environment of users based on data collected in a West Point cadet study. Various machine learning based intrusion detection algorithms are used to validate the ability of the SUB framework to generate both normal and malicious users. In a live University network, we launched a number of attacks on its intrusion detection system and showcased the ability to devise malicious users. In addition, we further deployed low and slow attacks that perform malicious actions over an extended period of time and demonstrate how even a large enterprise is ill equipped to combat such attacks.