Agent implementation for modeling insider threat

Abstract

Insider threat modeling focuses primarily on the individual and the prediction of an insider threat incident. The majority of these models are statistical that tend toward trend-projections using various regression models. The modeling presented in this paper engages an agent-based paradigm that is designed to explore how an agent interacts with other employees and the organization in an environment that grants the agent opportunity and access. This paper continues our research with a discussion of the implementation of the agent's decision-making in the context of emotional, rational, and social factors affecting agent disposition. We proffer that once the agent's disposition reaches or exceeds a personal threshold, the agent is disposed to become an active threat. Our refinement of the agent facilitates continued and more rounded discussion to our original research question: "How and when does a predisposed insider make the decision to become an active insider threat?"