Abstract: Compared with the external threats of information system, the internal threat attack of information system is more subtle and more difficult to be discovered. In this paper, the concept and the three common characteristics of internal threats are researched. In view of the general rules of user command operation, a new detection method of internal threat is proposed based on Nave Bayesian using the open security data set called S-M. This method can detect the internal threat attack with mixed operation behavior in the users. This detection method greatly improves the accuracy rate of internal threat detection and decreases the false alarm rate, so that the idea of machine learning has been widely applied in the field of internal threat detection.


Key words:  internal threats, S-M data set, Nave Bayesian, machine learning