Real-Time Abnormal Insider Event Detection on Enterprise Resource Planning Systems via Predictive Auto-Regression Model

With the development of information and communication technology and the globalisation of enterprises, many companies are being operated through an electrical resource management system called Enterprise Resource Planning (ERP) system. An ERP system enables efficient and centralised resource management for enterprises. However, since many enterprise resources are being managed by the system, the threatening behaviour by an insider is one of the most significant risks in operating ERP systems. It is much stealthier and fatal compared with the threat from an outsider since it is considered as normal events that accessing the enterprise resource of insiders. Conventional insider threat detection methods have aimed to detect particular events manually defined by system administrators. Those approaches are not robust to the variation of event patterns, and they can not be used when the predefined cases are not given. In this paper, we present a real-time abnormal insider event detection method using the Predictive Auto-regression Model (PAM). Compared with the conventional approaches, the proposed method compiles a prediction model using normal events and identifies threat when the likelihood of prediction results is lower than a threshold. Experiments are conducted using a dataset including events defined as a sequence of ERP system logs. The logs are captured in a practical situation of an enterprise. The results demonstrate that the proposed method can successfully identify abnormal events of on ERP systems.