Design and Implementation of the Insider Attack Detection System

The greatest threat is the problem of insiders who misuse their privileges for malicious purposes. These days, private information has often been leaked because of increased IT outsourcing, administrators’ moral problems, multiple root accounts, and root accounts shared by many users, etc. Accordingly, organizations have employed insider attack detection systems to protect their critical information from break-ins by insider attacks and hackers. In this paper, we developed an integrated insider attack detection system which was composed of a minimized hardware appliance and a software package that uses TCP tunneling and intelligent packet filtering. It could be configured as a gateway between users and legacy servers in order to protect the important internal information in the legacy servers. And, it could control the access of users on the servers, who were connected by Telnet or FTP, to block the theft of confidential information using intelligent packet filtering. Also, it should provide an audit, using packet logging on the legacy servers.