Modeling Expert Judgments of Insider Threat Using Ontology Structure: Effects of Individual Indicator Threat Value and Class Membership

Abstract

We describe research on a comprehensive ontology of sociotechnical and organizational factors for insider threat (SOFIT) and results of an expert knowledge elicitation study. The study examined how alternative insider threat assessment models may reflect associations among constructs beyond the relationships defined in the hierarchical class structure. Results clearly indicate that individual indicators contribute differentially to expert judgments of insider threat risk. Further, models based on ontology class structure more accurately predict expert judgments. There is some (although weak) empirical evidence that other associations among constructssuch as the roles that indicators play in an insider threat exploit-may also contribute to expert judgments of insider threat risk. These findings contribute to ongoing research aimed at development of more effective insider threat decision support tools.

The Dynamic Nature of Insider Threat Indicators

“…Several researchers have sought to identify and categorize individual insider threat indicators as part of an early warning system approach to insider threat detection (e.g., [2][3][4][5]), but few ( [6][7][8]) have attempted to quantify or distinguish among the contributions of different indicators to possible insider threat risk. For example, Magklaras and Furnell [3] proposed a metric called Evaluated Potential Threat (EPT) computed as a linear, weighted combination of individual threat component scores reflecting user role, behaviors (online actions), and sophistication (e.g., IT knowledge) that yields a score between 0 and 100, which is interpreted as a misuse probability between 0 and 1.…”

“…In this approach, the cybersecurity analysts (i.e., experts) establish the weights in accordance with their assessment of the emphasis they wish to place on the individual components. More recently, in separate expert knowledge elicitation studies focusing on expert judgments of the severity of insider threat indicators, Greitzer et al [6] demonstrated differential judgments of severity levels for 12 behavioral indicators, and in an independent set of studies, Greitzer et al [8] demonstrated differential severity levels of hundreds of individual technical and behavioral indicators. In these studies, and in the present work, in the absence of ground truth, the investigators test their models either by injecting simulated "target" data into a corpus of anonymized real-world data (e.g., [6,9]), or using expert judgments to classify "target" vs. baseline data in an anonymized real-world dataset (e.g., [3,7,8,10]).…”

“…In the Greitzer et al [8] study, expert judgments of severity levels were obtained for 202 individual indicators across a range of factors including behavioral, cybersecurity, job performance, and psychological indicators. Estimates of level of concern, on a 0-100 scale, were obtained and incorporated into an ontology of insider threat indicators (Sociotechnical and Organizational Factors for Insider Threats, or SOFIT [7,8,11,12]). The ontology distinguishes among five major classes of insider threat indicators [7]:…”

“…Role types form a complementary taxonomy that may be used to describe insider threat indicators. The SOFIT ontology defines five role types for insider threat indicators: Personal Predispositions, Precipitating Events, Behavioral Precursors, Technical Precursors, and Access Path [8]; definitions and examples are provided in Table 1. Personal predispositions overlap strongly with the psychological factor class.…”

Insider Threat Risk Prediction based on Bayesian Network

“…Insider threat risk prediction is a complex task for the research community to address, and recent studies such as those of (Greitzer et al, 2019(Greitzer et al, , 2018Legg et al, 2017) have started to consider insider threat issues from a different perspective of attempting to mitigate the risk of insider threats. Our work is inspired by the methodology proposed by (Kasanen et al, 1993) in combination with an empirical Bayes' method (Pearl, 1985).…”