Sniffing out insider threats

Feb 19, 2008

A rapid way to spot insider threats from individuals within an organization such as a multinational company or military installation is reported in the current issue of the International Journal of Security and Networks. The technology uses data mining techniques to scour email and build up a picture of social network interactions. The technology could prevent serious security breaches, sabotage, and even terrorist activity.

Gilbert Peterson and colleagues at the Air Force Institute of Technology at Wright Patterson AFB, in Ohio are developing technology that could help any organization sniff out insider threats by analyzing email activity or find individuals among potentially tens of thousands of employees with latent interests in sensitive topics. The same technology might also be used to spot individuals who feel alienated within the organization as well as unraveling any worrying changes in their social network interactions.

Security efforts have tended to focus on outside electronic threats, explain Peterson and colleagues. However, they point out that it is insiders that pose the greatest threat to an organization. Insiders are members of the organization who may have access to sensitive information for legitimate purposes but who could betray that trust for illegitimate reasons.

An aggrieved employee, saboteur, or terrorist infiltrator with access to such information could potentially cause great harm. Spotting the potential for an insider attack quickly without recourse to huge numbers of investigators is essential to preventing such an occurrence.

Peterson and his colleagues have developed an approach to assist investigators looking for such insider threats based on an extended version of Probabilistic Latent Semantic Indexing (PLSI). This extended technology can discern employees’ interests from e-mail and create a social network graph showing their various interactions.

The researchers explain that individuals who have shown an interest in a sensitive topic but who have never communicated to others within the organization on this subject are often the most likely to be an insider threat. The software can reveal those people either with a secret interest in that topic or who may feel alienated from the organization and so communicate their interest in it only to those outside the organization.

Another important signal of alienation or a potential problem is a shift in the connections between an individual and others within the organization. If an individual suddenly stops communicating or socializing with others with whom they have previously had frequent contact, then the technology could alert investigators to such changes.

The research team has tested their approach on the archived body of messages from the liquidated Enron company e-mail system. Their PLSI results unearthed several individuals who represented potential insider threats. However, it should be noted that the individuals under indictment are the bosses of the organization. It was the core of the organization that is responsible for the illegal behavior, says Peterson. The team points out that while internet activity was not available for Enron, it is generally available from the same sources that supply e-mail history logs and so could be used to search more widely for insider threats. He adds that by turning the domain 'on its ear' in effect, the identify of the whistleblower could be revealed.

Source: Inderscience Publishers

Explore further: Newest computer neural networks can identify visual objects as well as the primate brain

add to favorites email to friend print save as pdf

Related Stories

Building a worldwide genetic library BRIC-by-BRIC

Dec 12, 2014

A house is only as good as its foundation. Built solid and strong, the resulting structure should last for decades. NASA is laying a strong foundation of life science research with results from a recent investigation ...

Where there's muck there's aluminium (if not brass)

Dec 04, 2014

Technology developed at the University of Cambridge lies at the heart of a commercial process that can turn toothpaste tubes and drinks pouches into both aluminium and fuel in just three minutes.

Extreme materials and ubiquitous electronics

Dec 03, 2014

Nearly everyone seems to carry a cell phone or tablet. But if Tomás Palacios' vision of the future of electronics comes to bear, it will be increasingly difficult to separate electronics from all the other ...

What makes Toxoplasma gondii so unpredictable?

Dec 01, 2014

Toxoplasma gondii is a common parasite often spread by cats. Most people who are infected in Europe or North America show no symptoms at all, and only a few suffer from encephalitis or ocular toxoplasmosis, ...

Extreme shrimp may hold clues to alien life

Nov 24, 2014

(Phys.org) —At one of the world's deepest undersea hydrothermal vents, tiny shrimp are piled on top of each other, layer upon layer, crawling on rock chimneys that spew hot water. Bacteria, inside the shrimps' ...

Recommended for you

Cloud computing helps make sense of cloud forests

Dec 17, 2014

The forests that surround Campos do Jordao are among the foggiest places on Earth. With a canopy shrouded in mist much of time, these are the renowned cloud forests of the Brazilian state of São Paulo. It is here that researchers ...

Teaching robots to see

Dec 15, 2014

Syed Saud Naqvi, a PhD student from Pakistan, is working on an algorithm to help computer programmes and robots to view static images in a way that is closer to how humans see.

User comments : 0

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.