Collaborative information systems (CISs) are deployed within a diverse array of environments that manage sensitive information. Current security mechanisms detect insider threats, but they are ill-suited to monitor systems in which users function in dynamic teams. In this paper, we introduce the community anomaly detection system (CADS), an unsupervised learning framework to detect insider threats based on the access logs of collaborative environments. The framework is based on the observation that typical CIS users tend to form community structures based on the subjects accessed (e.g., patients' records viewed by healthcare providers). CADS consists of two components: 1) relational pattern extraction, which derives community structures and 2) anomaly prediction, which leverages a statistical model to determine when users have sufficiently deviated from communities. We further extend CADS into MetaCADS to account for the semantics of subjects (e.g., patients' diagnoses). To empirically evaluate the framework, we perform an assessment with three months of access logs from a real electronic health record (EHR) system in a large medical center. The results illustrate our models exhibit significant performance gains over state-of-the-art competitors. When the number of illicit users is low, MetaCADS is the best model, but as the number grows, commonly accessed semantics lead to hiding in a crowd, such that CADS is more prudent.

中文翻译：

---

检测协作信息系统中的异常内部人员

协作信息系统 (CIS) 部署在管理敏感信息的各种环境中。当前的安全机制检测内部威胁，但它们不适合监控用户在动态团队中运作的系统。在本文中，我们介绍了社区异常检测系统（CADS），这是一种基于协作环境访问日志检测内部威胁的无监督学习框架。该框架基于以下观察：典型的 CIS 用户倾向于根据访问的主题（例如，医疗保健提供者查看的患者记录）形成社区结构。CADS 由两个部分组成：1) 关系模式提取，它推导出社区结构和 2) 异常预测，它利用统计模型来确定用户何时充分偏离社区。我们进一步将CADS 扩展到MetaCADS 以说明主题的语义（例如，患者的诊断）。为了对框架进行实证评估，我们使用来自大型医疗中心的真实电子健康记录 (EHR) 系统的三个月访问日志进行评估。结果表明，我们的模型比最先进的竞争对手表现出显着的性能提升。当非法用户数量较少时，MetaCADS是最好的模型，但随着数量的增加，常用语义导致隐藏在人群中，因此CADS更加谨慎。我们使用来自大型医疗中心的真实电子健康记录 (EHR) 系统的三个月访问日志进行评估。结果表明，我们的模型比最先进的竞争对手表现出显着的性能提升。当非法用户数量较少时，MetaCADS是最好的模型，但随着数量的增加，常用语义导致隐藏在人群中，因此CADS更加谨慎。我们使用来自大型医疗中心的真实电子健康记录 (EHR) 系统的三个月访问日志进行评估。结果表明，我们的模型比最先进的竞争对手表现出显着的性能提升。当非法用户数量较少时，MetaCADS是最好的模型，但随着数量的增加，常用语义导致隐藏在人群中，因此CADS更加谨慎。