Predict insider threats using human behaviors

Abstract

In a Systems Engineering perspective, insider threats are not new but emerging. For modern systems that require a seamless integration between human and machine, human interactions with systems become a large part of operations. This creates a system security challenge while protecting systems from insider threats. As technology evolves, system vulnerabilities and network penetrations from external entities have been the center of attention. However, when considering system security, insider threats are as damaging as external threats. Unforutnately, insider threats have been overlooked for decades and there is no clear guidance or standards to protect systems from insider attacks. In this paper, we focus on identifying potential insider threats based on human behaviors, such as system logins. By analyzing user behavioral patterns, we attempt to identify suspicious behaviors based on common characterestics that appear to be unusual and estimate the prediction interval to determine if such behaviors should be considered as a threat. Having a baseline of normal user behaviors and comparing against unusual behaviors allow us to predict and identify potential insider threats.