Identifying At-Risk Employees: Modeling Psychosocial Precursors of Potential Insider Threats

Greitzer, Frank L.; Kangas, Lars J.; Noonan, Christine F.; Dalton, Angela C.; Hohimer, Ryan E.

doi:10.1109/hicss.2012.309

Cited by 55 publications

(38 citation statements)

References 15 publications

(16 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Their Contingency Coefficient Analysis yielded a C value of 0.76, indicating a strong correlation between their predictions and the ground truth. In a followup experiment [24], they asked 10 experts to rank 24 cases according to predictors. The inter-rater agreement on the 24 scenarios was high.…”

Section: B Psychological and Social Theoriesmentioning

confidence: 99%

Behavioral Analysis of Insider Threat: A Survey and Bootstrapped Prediction in Imbalanced Data

Azaria

Richardson

Kraus

et al. 2014

IEEE Trans. Comput. Soc. Syst.

110

View full text Add to dashboard Cite

The problem of insider threat is receiving increasing attention both within the computer science community as well as government and industry. This paper starts by presenting a broad, multidisciplinary survey of insider threat capturing contributions from computer scientists, psychologists, criminologists, and security practitioners. Subsequently, we present the behavioral analysis of insider threat (BAIT) framework, in which we conduct a detailed experiment involving 795 subjects on Amazon Mechanical Turk (AMT) in order to gauge the behaviors that real human subjects follow when attempting to exfiltrate data from within an organization. In the real world, the number of actual insiders found is very small, so supervised machine-learning methods encounter a challenge. Unlike past works, we develop bootstrapping algorithms that learn from highly imbalanced data, mostly unlabeled, and almost no history of user behavior from an insider threat perspective. We develop and evaluate seven algorithms using BAIT and show that they can produce a realistic (and acceptable) balance of precision and recall.

show abstract

Section: B Psychological and Social Theoriesmentioning

confidence: 99%

Behavioral Analysis of Insider Threat: A Survey and Bootstrapped Prediction in Imbalanced Data

Azaria

Richardson

Kraus

et al. 2014

IEEE Trans. Comput. Soc. Syst.

110

View full text Add to dashboard Cite

show abstract

“…Greitzer et al [30,31] discuss the use of psychological factors for identifying potential insider threats. They propose a Bayesian Network model that consists of a variety of binary observable behaviours (e.g., engagement, accepting criticism, confrontation, performance, stress, absenteeism).…”

Section: State Of the Art In Researchmentioning

confidence: 99%

A Critical Reflection on the Threat from Human Insiders – Its Nature, Industry Perceptions, and Detection Approaches

Nurse

Legg

Buckley

et al. 2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Organisations today operate in a world fraught with threats, including "script kiddies", hackers, hacktivists and advanced persistent threats. Although these threats can be harmful to an enterprise, a potentially more devastating and anecdotally more likely threat is that of the malicious insider. These trusted individuals have access to valuable company systems and data, and are well placed to undermine security measures and to attack their employers. In this paper, we engage in a critical reflection on the insider threat in order to better understand the nature of attacks, associated human factors, perceptions of threats, and detection approaches. We differentiate our work from other contributions by moving away from a purely academic perspective, and instead focus on distilling industrial reports (i.e., those that capture practitioners' experiences and feedback) and case studies in order to truly appreciate how insider attacks occur in practice and how viable preventative solutions may be developed.

show abstract

“…Greitzer et al [16] developed a psychosocial model to assess employees' behavior, while Brdiczka et al [17] proposed an approach that combines Structural Anomaly Detection from social and information networks and Psychological Profiling of individuals so as to identify threats.…”

Section: Related Workmentioning

confidence: 99%

Proactive insider threat detection through social media

Kandias

Stavrou

Bozovic

et al. 2013

Proceedings of the 12th ACM Workshop on Workshop on Privacy in the Electronic Society

View full text Add to dashboard Cite

Insider threat is a major issue in cyber and corporate security. In this paper we study the psychosocial perspective of the insider via social media, Open Source Intelligence, and user generated content classification. Inductively, we propose a prediction method by evaluating the predisposition towards law enforcement and authorities, a personal psychosocial trait closely connected to the manifestation of malevolent insiders. We propose a methodology to detect users holding a negative attitude towards authorities. For doing so we facilitate the use of machine learning techniques and of a dictionary-based approach, so as to detect comments expressing negative attitude. Thus, we can draw conclusions over a user behavior and beliefs via the content the user generated within the limits a social medium. We also use an assumption free flat data representation technique in order to decide over the user's attitude. Furthermore, we compare the results of each method and highlight the common behavior manifested by the users. The demonstration is applied on a crawled community of users on YouTube.

show abstract

Identifying At-Risk Employees: Modeling Psychosocial Precursors of Potential Insider Threats

Cited by 55 publications

References 15 publications

Behavioral Analysis of Insider Threat: A Survey and Bootstrapped Prediction in Imbalanced Data

Behavioral Analysis of Insider Threat: A Survey and Bootstrapped Prediction in Imbalanced Data

A Critical Reflection on the Threat from Human Insiders – Its Nature, Industry Perceptions, and Detection Approaches

Proactive insider threat detection through social media

Contact Info

Product

Resources

About