Software Engineering Institute | Carnegie Mellon University
Software Engineering Institute | Carnegie Mellon University

Digital Library

Javascript is currently disabled for your browser. For an optimal search experience, please enable javascript.

Advanced Search

Basic Search

Content Type

Topics

Publication Date

Technical Report

An Insider Threat Indicator Ontology

  • Abstract

    The insider threat community currently lacks a standardized method of expression for indicators of potential malicious insider activity. We believe that communicating potential indicators of malicious insider activity in a consistent and commonly accepted language will allow insider threat programs to implement more effective controls through an increase in collaboration and information sharing with other insider threat teams. In this report, we present an ontology for insider threat indicators. We make the case for using an ontology to fill the stated gap in the insider threat community. We also describe the semi-automated, data-driven development of the ontology, as well as the process by which the ontology was validated. In the appendices, we provide the ontology’s user’s manual and technical specification.

  • OWL File
  • Download

Cite This Report

SEI

Costa, Daniel; Albrethsen, Michael; Collins, Matthew; Perl, Samuel; Silowash, George; & Spooner, Derrick. An Insider Threat Indicator Ontology. CMU/SEI-2016-TR-007. Software Engineering Institute, Carnegie Mellon University. 2016. http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=454613

IEEE

Costa. Daniel, Albrethsen. Michael, Collins. Matthew, Perl. Samuel, Silowash. George, and Spooner. Derrick, "An Insider Threat Indicator Ontology," Software Engineering Institute, Carnegie Mellon University, Pittsburgh, Pennsylvania, Technical Report CMU/SEI-2016-TR-007, 2016. http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=454613

APA

Costa, Daniel., Albrethsen, Michael., Collins, Matthew., Perl, Samuel., Silowash, George., & Spooner, Derrick. (2016). An Insider Threat Indicator Ontology (CMU/SEI-2016-TR-007). Retrieved April 28, 2017, from the Software Engineering Institute, Carnegie Mellon University website: http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=454613

CHI

Daniel Costa, Michael Albrethsen, Matthew Collins, Samuel Perl, George Silowash, & Derrick Spooner. An Insider Threat Indicator Ontology (CMU/SEI-2016-TR-007). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2016. http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=454613

MLA

Costa, Daniel., Albrethsen, Michael., Collins, Matthew., Perl, Samuel., Silowash, George., & Spooner, Derrick. 2016. An Insider Threat Indicator Ontology (Technical Report CMU/SEI-2016-TR-007). Pittsburgh: Software Engineering Institute, Carnegie Mellon University. http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=454613

BibTex

@techreport{CostaAnInsider2016,
title={An Insider Threat Indicator Ontology},
author={Daniel Costa and Michael Albrethsen and Matthew Collins and Samuel Perl and George Silowash and Derrick Spooner},
year={2016},
number={CMU/SEI-2016-TR-007},
institution={Software Engineering Institute, Carnegie Mellon University},
address={Pittsburgh, PA},
url={http://resources.sei.cmu.edu/library/asset-view.cfm?AssetID=454613} }