Improving classification based off-topic search detection via category relationships

ABSTRACT

The illegitimate access of documents by insiders (also known as off-topic search) is an increasingly prevalent and largely ignored problem. We propose an approach that uses text classification for off-topic search detection. Our empirical results indicate that off-topic search detection effectiveness improves by considering only a subset of documents that are retrieved for a given user query. Furthermore, we also show that the effectiveness of off-topic search detection improves by using the ontological information of document categories. Our empirical results demonstrate that utilizing sibling relationship information and relationships derived from misclassification information statistically significantly improves the results over the baseline in most cases.

REFERENCES

• 1: B. Aleman-Meza, P. Burns, M. Eavenson, D. Palaniswami, A. Sheth. An ontological approach to the document access problem of insider threat. IEEE Intl. Conf. on Intelligence and Security Info. (ISI), May 2005.
• 2: Rebecca Cathey , Ling Ma , Nazli Goharian , David Grossman, Misuse detection for information retrieval systems, Proceedings of the twelfth international conference on Information and knowledge management, November 03-08, 2003, New Orleans, LA, USA [doi>10.1145/956863.956901]
• 3: Y. Elovici, et al. Content-based detection of terrorists browsing the web using an advanced terror detection system (ATDS). IEEE Intl. Conf. on Intelligence and Security Info. (ISI), May 2005.
• 4: José Fonseca , Marco Vieira , Henrique Madeira, Online detection of malicious data access using DBMS auditing, Proceedings of the 2008 ACM symposium on Applied computing, March 16-20, 2008, Fortaleza, Ceara, Brazil [doi>10.1145/1363686.1363921]
• 5: Nazli Goharian , Ling Ma, On off-topic access detection in information systems, Proceedings of the 14th ACM international conference on Information and knowledge management, October 31-November 05, 2005, Bremen, Germany [doi>10.1145/1099554.1099663]
• 6: Ling Ma , Nazli Goharian, Query length impact on misuse detection in information retrieval systems, Proceedings of the 2005 ACM symposium on Applied computing, March 13-17, 2005, Santa Fe, New Mexico [doi>10.1145/1066677.1066921]
• 7: N. Goharian and A. Platt. DOTS: Detection of Off-Topic Search Via Result Clustering. IEEE Intl. Conf. on Intelligence and Security Info. (ISI), May 2007.
• 8: M. Last, et al. Content-based methodology for anomaly detection on the Web. Lecture Notes in Computer Science, Intl. Atlantic Web Intelligence Conf., May 2003.
• 9: Jie Lu , Jamie Callan, User modeling for full-text federated search in peer-to-peer networks, Proceedings of the 29th annual international ACM SIGIR conference on Research and development in information retrieval, August 06-11, 2006, Seattle, Washington, USA [doi>10.1145/1148170.1148229]
• 10: Saket S. R. Mengle , Nazli Goharian , Alana Platt, Discovering relationships among categories using misclassification information, Proceedings of the 2008 ACM symposium on Applied computing, March 16-20, 2008, Fortaleza, Ceara, Brazil [doi>10.1145/1363686.1363899]
• 11: Alana Platt , Nazli Goharian , Saket S. R. Mengle, On using user query sequence to detect off-topic search, Proceedings of the 2007 ACM symposium on Applied computing, March 11-15, 2007, Seoul, Korea [doi>10.1145/1244002.1244196]
• 12: R. Richardson. 2007 CSI Computer Crime and Security Survey. (http://i.cmpnet.com/v2.gocsi.com/pdf/CSISurvey 2007.pdf). 2007
• 13: Y. Seo, J. Giampapa, and K. Sycara. A multi-agent system for enforcing Need-To-Know security policies. Intl. Conf. on Auto. Agents and Multi Agent Systems Workshop on Agent Oriented Info. Systems (AOIS-04), July 2004.
• 14: Y. Seo and K. Sycara. Cost-Sensitive Access Control for Illegitimate Confidential Access by Insiders. IEEE Intl. Conf. on Intelligence and Security Info. (ISI), May 2006.
• 15: Xuehua Shen , Bin Tan , ChengXiang Zhai, Context-sensitive information retrieval using implicit feedback, Proceedings of the 28th annual international ACM SIGIR conference on Research and development in information retrieval, August 15-19, 2005, Salvador, Brazil [doi>10.1145/1076034.1076045]
• 16: Kazunari Sugiyama , Kenji Hatano , Masatoshi Yoshikawa, Adaptive web search based on user profile constructed without any effort from users, Proceedings of the 13th international conference on World Wide Web, May 17-20, 2004, New York, NY, USA [doi>10.1145/988672.988764]
• 17: S. Symonenko, L. Liddy, O. Yilmazel, R. Del Zoppo, E. Brown, M. Downey. Semantic analysis for monitoring insider threats. IEEE Intl. Conf. on Intelligence and Security Info. (ISI), May 2004.
• 18: Jaime Teevan , Susan T. Dumais , Eric Horvitz, Personalizing search via automated analysis of interests and activities, Proceedings of the 28th annual international ACM SIGIR conference on Research and development in information retrieval, August 15-19, 2005, Salvador, Brazil [doi>10.1145/1076034.1076111]
• 19: O. Yilmazel, S. Symonenko, N. Balasubramanian, E. Liddy. Leveraging One-Class SVM and Semantic Analysis to Detect Anomalous Content. IEEE Intl. Conf. on Intelligence and Security Info. (ISI), May 2005.

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)

General Terms:
Algorithms, Experimentation, Security

Keywords:
insider misuse, need-to-know, ontology, user profiles