Behavioral Analysis of Insider Threat: A Survey and Bootstrapped Prediction in Imbalanced Data

• Published in: IEEE transactions on computational social systems Vol. 1; no. 2; pp. 135 - 155
• Main Authors: Azaria, Amos, Richardson, Ariella, Kraus, Sarit, Subrahmanian, V. S.
• Format: Journal Article
• Language: English
• Published: IEEE 01.06.2014
• Subjects: Algorithm design and analysis; Bayes methods; Behavioral models; Computer security; Human factors; insider threat; Predictive models; Psychology; Sociology; computer security; insider threat; Behavioral models
• ISSN: 2329-924X; 2373-7476
• DOI: 10.1109/TCSS.2014.2377811

The problem of insider threat is receiving increasing attention both within the computer science community as well as government and industry. This paper starts by presenting a broad, multidisciplinary survey of insider threat capturing contributions from computer scientists, psychologists, criminologists, and security practitioners. Subsequently, we present the behavioral analysis of insider threat (BAIT) framework, in which we conduct a detailed experiment involving 795 subjects on Amazon Mechanical Turk (AMT) in order to gauge the behaviors that real human subjects follow when attempting to exfiltrate data from within an organization. In the real world, the number of actual insiders found is very small, so supervised machine-learning methods encounter a challenge. Unlike past works, we develop bootstrapping algorithms that learn from highly imbalanced data, mostly unlabeled, and almost no history of user behavior from an insider threat perspective. We develop and evaluate seven algorithms using BAIT and show that they can produce a realistic (and acceptable) balance of precision and recall.