Identifying and Visualizing the Malicious Insider Threat Using Bipartite Graphs

Government agencies and organizations are just beginning to harness the powerful capabilities of visualization to aid in the prevention, detection, and mitigation of security threats. Most advances in this area have focused on protecting an agency or organization from malicious outsiders. While not a new threat, the malicious insider has recently earned increased focus. This paper investigates methods of classifying and visualizing insider behavior to establish a pattern of acceptable actions based on workgroup role classifications. It then discusses actions as related to identified precursors of malicious activities and provides a simplified example of how visualization can be used to help detect this threat. When visualized using bipartite mappings, behaviors outside the norm can be easily identified and provide an important step in the process of highlighting areas and individuals for further investigation.