Intent-Driven Insider Threat Detection in Intelligence Analyses

In intelligence analysis, information plays an important role in solving problems and making decisions. However, an increasing number of malicious behaviors, most of which come from insiders, are threatening information security. An insider in the intelligence community is either a current or previous member who has access to privileged resources and whose intelligence decisions have impacts on the decision makers. With malicious intent, an insider may alter, fabricate, or hide critical information in order to interfere with a decision making process, In this paper, we focus on detecting abnormal behaviors that can lead to identifying a malicious insider. Malicious actions such as disinformation tend to be very subtle and thus difficult to detect. Therefore, we employ a user modeling technique because its dynamic and incremental nature provides unique capabilities to reflect the cumulative effects from malicious actions. We created a computational model for each insider and applied ou...

• Type: Conference
• Year: 2008
• Where: IAT
• Authors: Eugene Santos Jr., Hien Nguyen, Fei Yu, Keum Joo Kim, Deqing Li, John T. Wilkinson, Adam Olson, Russell Jacob
• Keywords: IAT 2008, Intelligent Agent, Malicious Actions, Malicious Behaviors, Malicious Insiders