DAYANANDA SAGAR UNIVERSITY
KUDLU GATE, BANGALORE
– 560068
Bachelor of Technology
in
COMPUTER SCIENCE AND ENGINEERING
Major ProjectPhase-II Report
“INSIDER ATTACK DETECTION
”
By
Bhargav Ram C S– ENG19CS0065
Under thesupervision of
Prof. Nandini K
Assistantprofessor in Computer Science and Engineering
DEPARTMENT OF COMPUTER SCIENCE & ENGINEERING,
SCHOOL OF ENGINEERING
DAYANANDA SAGAR UNIVERSITY,
BANGALORE
(2022-2023)
School of Engineering
Department of Computer Science & Engineering
Kudlu Gate, Bangalore – 560068 Karnataka,
India
CERTIFICATE
This is to certify that the Phase-II project work titled “INSIDER ATTACK DETECTION” is
carried out by Bhargav Ram C S – ENG19CS0065 bonafide students of Bachelor of
Technology in Computer Science and Engineering at the School of Engineering, Dayananda
Sagar University, Bangalore in partial fulfillment for the award of degree in Bachelor of
Technology in Computer Science and Engineering, during the year 2022-2023.
Prof. Nandini K Dr. Girisha G S Dr. Udaya Kumar
Reddy K R
Assistant Professor Chairman CSE Dean
Dept. of CS&E, School of Engineering School of Engineering
School of Engineering Dayananda Sagar University Dayananda Sagar
Dayananda Sagar University University
Date: Date: Date:
Signature of Examiner
Name of the Examiner
1.
2.
DECLARATION
I, Bhargav Ram C S (ENG19CS0065), are students of eighth semester B. Tech in Computer
Science and Engineering, at School of Engineering, Dayananda Sagar University, hereby
declare that the Major Project Stage-II titled “INSIDER ATTACK DETECTION” has been
carried out by us and submitted in partial fulfilment for the award of degree in Bachelor of
Technology in Computer Science and Engineering during the academic year 2022-2023.
ii
Student Signature
USN: ENG19CS0065
Name: Bhargav Ram C S
Place: Bangalore
Date:
ACKNOWLEDGEMENT
It is a great pleasure for me to acknowledge the assistance and support of many individuals
who have been responsible for the successful completion of this project work.
First, I take this opportunity to express our sincere gratitude to School of
Engineering & Technology, Dayananda Sagar University for providing us with a great
opportunity to pursue our Bachelor’s degree in this institution.
I would like to thank Dr. Udaya Kumar Reddy K R, Dean, School of Engineering &
Technology, Dayananda Sagar University for his constant encouragement and expert advice.
iii
It is a matter of immense pleasure to express our sincere thanks to Dr. Girisha G S,
Department Chairman, Computer Science and Engineering, Dayananda Sagar University,
for providing right academic guidance that made our task possible.
I would like to thank our guide Prof. Nandini K Assistant Professor, Dept. of
Computer Science and Engineering, Dayananda Sagar University, for sparing his/her
valuable time to extend help in every step of our project work, which paved the way for smooth
progress and fruitful culmination of the project.
I would like to thank our Project Coordinator Dr. Meenakshi Malhotra and Dr.
Pramod Kumar Naik all the staff members of Computer Science and Engineering for their
support.
I’m also grateful to our family and friends who provided us with every requirement
throughout the course.
I would like to thank one and all who directly or indirectly helped us in the Project
work.
TABLE OF CONTENTS
Page
LIST OF ABBREVIATIONS ................................................................................. vi
LIST OF FIGURES ……….................................................................................... vii
LIST OF TABLES ………….................................................................................. viii
ABSTRACT ............................................................................................................ ix
CHAPTER 1 INTRODUCTION………................................................................. 1 1.1.
INTRODUCTION.....................................................................................
CHAPTER 2 PROBLEM DEFINITION ………..................................................... 5
2.1. OBJECTIVE................................................................................................. 5
iv
2.2. SCOPE.......................................................................................................... 5
CHAPTER 3 LITERATURE SURVEY................................................................... 6
CHAPTER 4 PROJECT DESCRIPTION.................................................................... 10
4.1. SYSTEM DESIGN ..................................................................................... 11
4.2. ASSUMPTIONS AND DEPENDENCIES................................................... 15
CHAPTER 5 REQUIREMENTS ................................................................................ 16
5.1. FUNCTIONAL REQUIREMENTS ............................................................ 17
5.2. NON-FUNCTIONAL REQUIREMENTS…………………………………… 18
5.3. HARDWARE AND SOFTWARE REQUIREMENTS.................................... 19
CHAPTER 6 METHODOLOGY................................................................................ 20
CHAPTER 7 EXPERIMENTATION.......................................................................... 23
CHAPTER 8 TESTING AND RESULTS ….............................................................. 27
8.1 RESULTS ............................................ ............. ........... ........................ 33
CHAPTER 9 CONCLUSION AND FUTURE WORK
10.1. CONCLUSION.................................................................................... 35
10.1. SCOPE FOR FUTUREWORK ............................................................ 35
CHAPTER 10
REFERENCES... ....................................................................................................... 36
APPENDIX A ............................................................................................................
SAMPLE CODE .............................................................................................. 39
Funding and Published Paper details ......................................................................... 40
LIST OF ABBREVIATIONS
AI Artificial Intelligence
DL Deep Learning
GUI Graphical User Interface
PHP Pre-Processor Hyper text
MySQL My Structured Query Language
v
LIST OF FIGURES
Fig. No. Description of the figure Page No.
4.1(a) Use case diagram 8
4.1(b) Sequence diagram 9
4.1(c) Process flow diagram 10
6.1 Depp belief neural network (DBN) 16
7.1 Design of project 18
7.2 Design of log collection and log parsing 19
7.3 Design of anomaly detection 20
vi
ABSTRACT
Cloud computing is a high network infrastructure where users, owners, third users, authorized
users, and customers can access and store their information quickly. The major issue in today's
technological development is identifying the insider threat in the cloud network. When data are
lost, compromising cloud users is difficult. Several solutions are available for the external
security of the cloud network. However, insider or internal threats need to be addressed. we
focus on a solution for identifying an insider attack using the artificial intelligence technique.
These types of attacks need intelligent solutions. A machine learning approach is widely used
for security issues.
In our proposed work, we track the attackers using a user interaction behavior pattern and deep
learning technique. The usage of all the activities of the real user is stored in a database. The
deep belief neural network is designed using a restricted Boltzmann machine (RBM) so that the
layer of RBM communicates with the previous and subsequent layers.
Insider attacks represent a malicious activity performed by an authorized person inside the
organization. It has been defined as threats implemented by malicious person’s whose
permission to enter the Organization's network, systems, and data are used negatively to affect
the confidentiality of the organization.
Using the DBN (Deep Belief Neural Network) as a classifier to detect the insiders who are
vulnerable to access the cloud data. The insider is classified with the features extracted from
their behavioral interaction to access the application or data through the user logs like
Logon/Logoff activity, File activity, HTTP activity, Email activity, Device activity, Keystroke &
Mouse activity. The abnormal access of these user logs is calculated and used as a feature for the
insider detection classification.
vii
