Modeling Human Behavior to Anticipate Insider Attacks

The insider threat ranks among the most pressing cyber-security challengesthat threaten government and industry information infrastructures.To date, no systematic methods have been developed that provide acomplete and effective approach to prevent data leakage, espionage, andsabotage. Current practice is forensic in nature, relegating to the analystthe bulk of the responsibility to monitor, analyze, and correlate an overwhelmingamount of data. We describe a predictive modeling frameworkthat integrates a diverse set of data sources from the cyber domain, as wellas inferred psychological/motivational factors that may underlie maliciousinsider exploits. This comprehensive threat assessment approachprovides automated support for the detection of high-risk behavioral"triggers" to help focus the analyst's attention and inform the analysis.Designed to be domain-independent, the system may be applied to manydifferent threat and warning analysis/sense-making problems.