Nadia Tawbi

Ce guide poursuit deux objectifs, soit (1) le développement des connaissances sur les conditions et bonnes pratiques pour la mise en place d’une identité numérique nationale ainsi que (2) la mise en évidence dans une perspective critique des enjeux, impacts et conséquences envisageables de l’implantation d’un projet d’identité numérique nationale sur la société, les organisations et les individus. L’étude de cette question s’inscrit dans la mission plus large du Pôle d’expertise en cybersécurité et impacts sociétaux de l’Observatoire international sur les impacts sociétaux de l’intelligence artificielle et du numérique (OBVIA) d’alimenter la recherche sur la cybersécurité au Québec considérant que l’identité numérique a pour objectif d’assurer les principes fondamentaux de la sécurité de l’information, notamment par la protection des renseignements personnels.

Insider threats are a growing concern for organizations due to the amount of damage that their members can inflict by combining their privileged access and domain knowledge. Nonetheless, the detection of such threats is challenging, precisely because of the ability of the authorized personnel to easily conduct malicious actions and because of the immense size and diversity of audit data produced by organizations in which the few malicious footprints are hidden. In this paper, we propose an unsupervised insider threat detection system based on audit data using Bayesian Gaussian Mixture Models. The proposed approach leverages a user-based model to optimize specific behaviors modelization and an automatic feature extraction system based on Word2Vec for ease of use in a real-life scenario. The solution distinguishes itself by not requiring data balancing nor to be trained only on normal instances, and by its little domain knowledge required to implement. Still, results indicate that the proposed method competes with state-of-the-art approaches, presenting a good recall of 88\%, accuracy and true negative rate of 93%, and a false positive rate of 6.9%. For our experiments, we used the benchmark dataset CERT version 4.2.

Runtime monitoring is a widely used approach for the enforcement of security policies. It allows the safe execution of untrusted code by observing the execution and reacting if needed to prevent a violation of a user-defined security policy. Previous studies have determined that the set of security properties enforceable by monitors is greatly extended by giving the monitor some licence to transform its target execution. In this study, we present a new framework to model and study the behaviour of such monitors. In order to assure that the enforcement is meaningful, we bound the monitor's ability to transform the target execution by a restriction stating that any transformation must preserve equivalence between the monitor's input and output. We proceed by giving examples of meaningful equivalence relations and identify the security policies that are enforceable with their use. We also relate our work to previous work in this field. Finally, we investigate how an a priori knowledge of the target program's behaviour would increase the monitor's enforcement power.