Organizations use Linux-based systems to store sensitive files, application configurations, business records, research documents, and other important information. Access to these files is generally controlled through user accounts, file permissions, authentication mechanisms, and application-level authorization.
Insider threats can arise when an authorized user accesses sensitive information beyond their legitimate responsibilities or attempts to access files belonging to another user. Such activity may involve unusual file-access patterns, repeated access attempts, access to sensitive directories, or attempts to read files that the user is not authorized to access.
Traditional security mechanisms enforce access permissions and generate audit records, but they do not automatically determine whether every permitted file-access event is suspicious from a behavioral perspective. An access attempt may also be technically permitted while still deviating from a user's normal activity. Therefore, monitoring and behavioral analysis can provide additional security information alongside existing access controls.
In this use case, a controlled Linux file-access monitoring environment is implemented using Ubuntu Linux and Kali Linux virtual machines. Ubuntu acts as the target file server and monitoring environment, while Kali Linux acts as the separate security-testing machine used to perform controlled unauthorized file-access attempts.
A network-accessible file service is configured on Ubuntu so that Kali can communicate with the target through an actual application protocol rather than attempting to access another virtual machine's local filesystem directly. A laboratory-only Samba file share can provide this functionality. Test accounts and sample files are used to represent authorized and unauthorized file-access scenarios.
A public insider-threat or user-activity dataset is used as the existing data source for the machine-learning research. The dataset is reviewed to determine whether its available labels and features are suitable for the intended classification task. The training data is not manually invented for the project.
CatBoost is used as the machine-learning algorithm for classification when the selected dataset provides appropriate labelled features. SHAP is used to explain the contribution of individual input features to the model's predictions.
On Ubuntu, auditd is configured to record relevant file-access and security events. The exact events and fields collected depend on the configured audit rules and the activity being monitored. Controlled activity generated from Kali is correlated with the corresponding Ubuntu-side audit evidence.
The public dataset and locally collected audit events are evaluated for feature compatibility before attempting to apply the trained model to the laboratory events. If their schemas or meanings are incompatible, the public dataset model evaluation and local audit-event analysis are reported separately rather than incorrectly treating the two data sources as interchangeable.
Application: Ubuntu Linux File Server with Samba
Ubuntu Linux is the target operating system and file-server environment in this use case. A Samba file share is configured to provide network-based access to selected laboratory files.
Kali Linux is used as a separate testing machine. It communicates with the Ubuntu file server through the configured laboratory network and attempts to access files using the available test credentials and permissions.
The target environment uses sample files and controlled test accounts. No real confidential files or production user accounts are involved.
Ubuntu also provides the monitoring environment in which auditd records the configured security-relevant operating-system events. These events provide evidence of the file-access activity generated during the experiment.
Linux systems use file permissions and access-control mechanisms to restrict which users can read, modify, or execute files. A network file service such as Samba applies its own share configuration and account-related access controls in addition to the underlying filesystem permissions.
However, enforcing permissions and detecting suspicious behavior are different security functions.
An unauthorized file-access attempt may be rejected by the server, but the attempt can still be useful security evidence. Conversely, a request that succeeds because the requesting account has permission may still be unusual and require further investigation.
Traditional access-control mechanisms do not necessarily classify activity according to behavioral patterns learned from historical user activity. Security teams therefore need ways to correlate access-control decisions, audit events, and behavioral-analysis results.
The proposed solution combines Linux file-access monitoring, a public user-activity dataset, CatBoost classification, and SHAP explainability. Kali Linux generates controlled test activity against the Ubuntu file service, while Ubuntu records the resulting events. The experiment evaluates whether the collected evidence and machine-learning workflow can support the identification and explanation of suspicious file-access behavior.
Specific Attack: Controlled Unauthorized Sensitive-File Access Attempt
The controlled attack scenario evaluates whether a test account operating from Kali Linux can attempt to access a sample file that the account is not authorized to read through the Ubuntu file server.
The Ubuntu environment contains a network-accessible file share, sample sensitive files, and test accounts with defined access permissions. Kali Linux acts as the separate testing machine and sends file-access requests to the Ubuntu service.
The attack scenario is designed to generate observable security events without modifying or damaging the target system. The expected result depends on the actual Samba configuration, account permissions, and filesystem access controls.
If the access controls are configured correctly, the unauthorized request should be rejected. The failed request and its associated audit or service evidence can then be examined as part of the security assessment.
This controlled scenario demonstrates an unauthorized access attempt. It does not, by itself, establish that the activity is an insider attack. Insider-threat classification requires suitable labelled training data and supporting context about user activity.
Explainable Machine-Learning-Based Insider-Threat Detection
The primary security concept is behavioral analysis of sensitive-file access combined with explainable machine-learning classification.
The first objective is to examine a public insider-threat or user-activity dataset and identify whether it contains suitable labelled observations and features for classifying normal and suspicious activity. The available dataset must support the intended classification task; its labels must not be assumed to represent Linux file-access attacks unless the dataset documentation establishes that relationship.
The second objective is to collect real operating-system audit evidence from the controlled Ubuntu file server while Kali Linux performs legitimate and unauthorized test requests. These events are used to examine the behavior of the target system and establish evidence of the controlled access attempts.
The third objective is to use CatBoost to classify appropriately prepared data and SHAP to explain the model's predictions. Model training and evaluation must be based on the available labels, while local attack validation must be grounded in the actual observed events.
The workflow distinguishes between model evaluation on the public dataset and analysis of local Ubuntu audit events. A model trained on one feature schema cannot automatically classify another schema reliably. Before using the trained model on local events, the required features, data types, meanings, and preprocessing operations must be compatible.
The security concept defines the overall security strategy. The following are the specific defensive mechanisms implemented in this use case.
Ubuntu uses filesystem permissions, account permissions, and Samba share configuration to control access to laboratory files.
auditd is configured with suitable audit rules to record relevant file-access and security events.
Public dataset records and locally collected audit events are reviewed and processed according to their respective schemas.
CatBoost is trained and evaluated using appropriately labelled data and a defined set of input features.
SHAP is used to analyze the contribution of input features to individual CatBoost predictions.
The controlled access attempt is compared with the corresponding Ubuntu audit and Samba evidence.
Kali Linux and Ubuntu Linux operate in an isolated VirtualBox laboratory using sample files and test accounts.
Ubuntu Linux hosts the target file-service environment and the monitoring components used in the experiment.
Samba provides a network-accessible file share that allows Kali Linux to send file-access requests to Ubuntu through an actual service.
Kali Linux acts as the separate security-testing machine used to generate controlled file-access requests.
auditd provides the Linux auditing framework used to record events selected by the configured audit rules.
CatBoost is the classification algorithm used to train and evaluate the insider-threat or user-activity model.
SHAP is used to explain the contribution of individual features to CatBoost model predictions.
Python provides the main implementation environment for dataset processing, audit-event analysis, model training, prediction, and explainability.
Pandas is used to load, filter, transform, and organize dataset records and audit-event data.
NumPy supports numerical transformations required during feature preparation and model processing.
Scikit-learn supports dataset splitting and classification evaluation.
VirtualBox provides the isolated virtual-machine environment used for the Ubuntu target and Kali testing system.
Ubuntu and Kali Linux are used together to conduct the controlled network-based file-access experiment.
The project establishes a controlled Linux environment to investigate unauthorized sensitive-file access using Kali Linux and Ubuntu Linux.
The Ubuntu file server provides a network-accessible Samba share for testing sensitive-file access permissions.
Kali Linux generates controlled file-access attempts against the Ubuntu target to evaluate the configured access controls.
The auditd tool records relevant operating-system audit events associated with the tested file-access activity.
A public insider-threat or user-activity dataset provides labelled data for training and evaluating the CatBoost classification model.
The CatBoost model classifies suitable input records according to the behavioral patterns learned from the selected dataset.
SHAP explains the contribution of individual features to the model's predictions, improving the interpretability of the classification results.
The collected Ubuntu audit records are correlated with the controlled access attempts to validate the observed security events.
Feature compatibility is assessed to determine whether the trained model can validly classify locally collected audit events.
The project demonstrates an explainable machine-learning-based approach to analyzing suspicious file-access behavior and evaluating insider-threat detection within an isolated Linux laboratory.
Research Breakthrough Possible @S-Logix