Insider Threat Detection in Source Code via Defect Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security vulnerability assessment technologies are inadequate in detecting intentionally obfuscated insider threats in source code, leading to increased security risks due to insufficient testing and reduced oversight in software development cycles.
Innovation Solution
A system and method for detecting insider threats using models developed from natural language descriptions of software security vulnerabilities, which can be regularly updated to improve detection accuracy and reliability by establishing criteria for code defects indicative of potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If developers prioritize meeting user demands and reducing development cycles, then productivity increases, but security review and oversight are reduced, leading to increased insider threats
Solution Approach 1:
An automated insider threat detection system acts as an intermediary between developers and security review processes. The system uses machine learning models trained on vulnerability descriptions to automatically analyze source code for potential insider threats, compensating for reduced human security review capacity while maintaining high productivity.
Solution Approach 2:
The detection system performs preliminary security analysis during the development process rather than relying solely on final security reviews. By implementing continuous automated monitoring and analysis of code commits, the system identifies potential insider threats early in the development cycle, maintaining security oversight without slowing down productivity.
2Difficulty of detecting and measuring
If security vulnerability assessment technologies are used to detect insider threats, then security detection capability improves, but false positive detections increase due to obfuscated malicious content
Solution Approach 1:
The system applies multiple analysis techniques and examines more code patterns than traditional tools, even if some analyses are redundant. By using ensemble methods that combine multiple machine learning models and analysis approaches, the system achieves higher detection accuracy while managing false positives through voting mechanisms and confidence scoring.
Solution Approach 2:
The detection system dynamically adjusts analysis parameters and thresholds based on the specific code being analyzed and the type of threat being detected. Machine learning models adapt their sensitivity and detection criteria according to the context, reducing false positives while maintaining high detection rates for actual insider threats.
Data Source
AI summary
A code repository stores source code. An insider threat detection system stores instructions for detecting code defects and criteria indicating predetermined types of code defects that, when present, are associated with intentional obfuscation of one or more functions of the source code. The insider threat detection system receives an entry of source code and detects, using the model, a set of code defects in the entry of source code. A defect type is determined for each code defect, thereby determining a set of defect types included in the entry of source code. If it is determined that each of the predetermined types of code defects indicated by the criteria is included in the determined set of defect types, the entry of source code is determined to include an insider threat.