An agent-based approach to modeling insider threat

Abstract

Insider threat research and modeling has focused on the individual and the prediction of an insider threat incident. The majority of these models are statistical with inputs from psychological and social (work environment) assessments. These statistical analyses tend toward trend-projections using various regression models. The modeling presented in this paper implements the agent-based paradigm that is designed to explore the primary elements of an insider threat. Specifically, the insider (represented as an agent) interacts with other employees and the organization (also represented as agents) in an environment that provides the opportunity and necessary access to become an insider threat. The specific research question we seek to answer is How and when does an insider that is pre-disposed to being a threat make the decision to become an active insider threat? The model met the research objective: capture insider threat behavior given the set of assumptions governing agent behavior.