Insider Threat

Abstract

Language as a symbolic medium plays an important role in virtual communications. Words communicated online as action cues can provide indications of an actor's behavioral intent. This paper describes an ongoing investigation into the impact of a deceptive insider on group dynamics in virtual teamcollaboration. An experiment using an online game environment was conducted in 2014. Our findings support the hypothesis that language-action cues of group interactions will change significantly after an insider has been compromised and makes efforts to deceive. Furthermore, the language used in group dynamic interaction will tend to employ more cognition, inclusivity and exclusivity words when interacting with each other and with the focal insider. Future work will employ finely tuned complex Linguistic Inquiry and Word Count dictionaries to identify additional language-action cues for deception.

Leader Member Exchange: An Interactive Framework to Uncover a Deceptive Insider as Revealed by Human Sensors

“…Ho, Hancock et al's [37,38] findings are consistent with Taylor, Dando et al's [68] findings, suggesting that, in both asynchronous and synchronous communication, deceptive leaders can be expected to use more words associated with cognitive processes in their communication than other members from the same group. In a different set of hypotheses, Ho, Hancock et al [40] further identified differences in language-action cues-not only between deceptive leaders and non-deceptive leaders-but also between groups with a deceptive leader and groups without one.…”

“…As the most prominent insider threat cases are often committed by those who are in power positions and betray inherent trust [37,38], we note that certain influences can be found in the deceptive leader's exchange with the subordinates, and further impact the subordinates commitment to the organization [31]. Griffith, Connelly et al [31] validated the deceptive leader's influences on leader-member exchange using survey instruments, while Ho, Hancock et al [37,38] simulated experiments to investigate the differences in language-action cues between deceptive leaders and non-deceptive leaders in group interaction, and specifically how language-action cues from groups that include a deceptive leader differed from those of groups that did not include a deceptive leader.…”

Computer-Mediated Deception: Collective Language-action Cues as Stigmergic Signals for Computational Intelligence

“…Identification of deception is a complex problem that often requires ground truth verification [11,15]; nevertheless, deception can be detected in interpersonal communication [1,[21][22][23] as well as group communication [24,25]. Research into CMC deception cues has examined a variety of media types and modes of communication, while also exploring the role of media choice and mode of communication.…”

“…Ho, Hancock et al [25], [24] examined behaviors of a deceptive "insider" in spontaneous synchronous chat-based group-dynamics context, and suggested that deceptive "insiders" in computer-mediated synchronous interactions will tend to use more words associated with cognitive processes. Ho, Hancock et al's [25] findings are consistent with those of Taylor, Dando et al [35], and suggest that deceptive "insiders" tend to use words more associated with cognitive processes in their communication with their peers in either asynchronous or synchronous communication.…”