Modeling Human Behavior to Anticipate Insider Attacks

Abstract

human factors and social/behavioral science challenges through modeling and advanced engineering/computing approaches. This research focuses on the intelligence domain, including human behavior modeling with application to identifying/predicting malicious insider cyber activities, modeling socio-cultural factors as predictors of terrorist activities, and human information interaction concepts for enhancing intelligence analysis decision making. Dr. Greitzer's research interests also include evaluation methods and metrics for assessing effectiveness of decision aids, analysis methods and displays. Ryan Hohimer is a Senior Research Scientist at PNNL. His research interests include knowledge representation and reasoning, probabilistic reasoning, semantic computing, cognitive modeling, image analysis, data management, and data acquisition and analysis. He is currently serving as Principal Investigator of a Laboratory-directed Research and Development project that has designed and developed the CHAMPION reasoner. AbstractThe insider threat ranks among the most pressing cyber-security challenges that threaten government and industry information infrastructures. To date, no systematic methods have been developed that provide a complete and effective approach to prevent data leakage, espionage, and sabotage. Current practice is forensic in nature, relegating to the analyst the bulk of the responsibility to monitor, analyze, and correlate an overwhelming amount of data. We describe a predictive modeling framework that integrates a diverse set of data sources from the cyber domain, as well as inferred psychological/motivational factors that may underlie malicious insider exploits. This comprehensive threat assessment approach provides automated support for the detection of high-risk behavioral "triggers" to help focus the analyst's attention and inform the analysis. Designed to be domain-independent, the system may be applied to many different threat and warning analysis/sense-making problems.

A Critical Reflection on the Threat from Human Insiders – Its Nature, Industry Perceptions, and Detection Approaches

“…Greitzer et al [30,31] discuss the use of psychological factors for identifying potential insider threats. They propose a Bayesian Network model that consists of a variety of binary observable behaviours (e.g., engagement, accepting criticism, confrontation, performance, stress, absenteeism).…”

Mitigation Strategies for Unintentional Insider Threats on Information Leaks

“…For example, when the logs history show the user login into system with abnormal from actual, the user profiling method can be used to observe user behaviour and forecast possible threats. Greitzer and Hohimer [40] added that incorporating psychosocial (mental problem, espionage, disgruntlement) data along with cyber data (user behaviour activities) into the behavioural analysis that offers an additional dimension to assess potential threats.…”

Identifying attack patterns for insider threat detection

“…The topic of an insider's psychology has received substantial research and practitioner emphasis over the last few years (e.g., [3,19,31]), after being somewhat overlooked in early enterprise-security work. Based on our research into these articles and the collected case data, we identify eight elements that may be especially useful in modelling and analysing this aspect of insider threats.…”