[PDF][PDF] Processing Events in Probabilistic Risk Assessment.
R Schrag, E Wright, R Kerr, B Ware - STIDS, 2014 - stids.c4i.gmu.edu
R Schrag, E Wright, R Kerr, B Ware
STIDS, 2014•stids.c4i.gmu.eduAssessing entity (eg, person) risk from entity-related events requires appropriate techniques
to address the relevance of events (individually and/or in aggregate) relative to a prevailing
temporal frame of reference—for continuous risk monitoring, a running time point
representing “the present.” We describe two classes of temporal relevance techniques we
have used towards insider threat detection in probabilistic risk models based on Bayesian
networks. One class of techniques is appropriate when a generic person Bayesian network …
to address the relevance of events (individually and/or in aggregate) relative to a prevailing
temporal frame of reference—for continuous risk monitoring, a running time point
representing “the present.” We describe two classes of temporal relevance techniques we
have used towards insider threat detection in probabilistic risk models based on Bayesian
networks. One class of techniques is appropriate when a generic person Bayesian network …
Abstract
Assessing entity (eg, person) risk from entity-related events requires appropriate techniques to address the relevance of events (individually and/or in aggregate) relative to a prevailing temporal frame of reference—for continuous risk monitoring, a running time point representing “the present.” We describe two classes of temporal relevance techniques we have used towards insider threat detection in probabilistic risk models based on Bayesian networks. One class of techniques is appropriate when a generic person Bayesian network is extended with a new random variable for each relevant event—practical when events of concern are infrequent and we expect their number per person to be small (as in public records monitoring). Another class is needed when (as in computer network event monitoring) we expect too many relevant events to create a new random variable for each event. We present a use case employing both classes of techniques and discuss their relative strengths and weaknesses. Finally, we describe the semantic technology framework supporting this work.
stids.c4i.gmu.edu
Showing the best result for this search. See all results