The Robotics Institute

Carnegie Mellon Robotics Institute

Copyright notice: This material is presented to ensure timely dissemination of scholarly and technical work. Copyright and all rights therein are retained by authors or by other copyright holders. All persons copying this information are expected to adhere to the terms and constraints invoked by each author's copyright. These works may not be reposted without the explicit permission of the copyright holder.

Abstract

In many organizations, it is common to control access to confidential information based on the need-to-know principle; The requests for access are authorized only if the content of the requested information is relevant to the requester?s current information analysis project. We formulate such content-based authorization, i.e. whether to accept or reject access requests as a binary classification problem. In contrast to the conventional error-minimizing classification, we handle this problem in a cost-sensitive learning framework in which the cost caused by incorrect decision is different according to the relative importance of the requested information. In particular, the cost (i.e., damaging effect) for a false positive (i.e., accepting an illegitimate request) is more expensive than that of false negative (i.e., rejecting a valid request). The former is a serious security problem because confidential information, which should not be revealed, can be accessed. From the comparison of the cost-sensitive classifiers with error-minimizing classifiers, we found that the costing with a logistic regression showed the best performance, in terms of the smallest cost paid, the lowest false positive rate, and the relatively low false negative rate.

Keywords

cost-sensitive learning, insider threat, security, machine learning

Notes

Associated Center(s) / Consortia: Center for Integrated Manfacturing Decision Systems

Associated Lab(s) / Group(s): Advanced Agent - Robotics Technology Lab

Number of pages: 12

Text Reference

Young-Woo Seo and Katia Sycara, "Cost-Sensitive Access Control for Illegitimate Confidential Access by Insiders," IEEE International Conference on Intelligence and Security Informatics (ISI 2006), May, 2006, pp. 117-128.

BibTeX Reference

@inproceedings{Seo_2006_5431,
   author = "Young-Woo Seo and Katia Sycara",
   editor = "Sharad Mehrotra, Daniel D. Zeng, Hsinchun Chen, Bhavani Thuraisingham, Fei-Yue Wang",
   title = "Cost-Sensitive Access Control for Illegitimate Confidential Access by Insiders",
   booktitle = "IEEE International Conference on Intelligence and Security Informatics (ISI 2006)",
   pages = "117-128",
   publisher = "Springer",
   month = "May",
   year = "2006",
}

The Robotics Institute

Menu