Human Behavior, Insider Threat and Awareness

Project Summary

We propose to address the problem of insider threat by forming a collaboration of eight I3P member organizations: Carnegie Mellon University, Columbia University, Cornell University, Dartmouth College, Indiana University, MITRE Corporation, Purdue University, and the RAND Corporation. Two primary objectives serve to focus and integrate the proposed research activities: technology exploration and environmental constraints. The first objective addresses the need for base technologies to monitor insider behavior, coupled with behavioral descriptions of suspicious inappropriate or illegitimate events or activities. In combination, the technology and monitoring will provide a lightweight, robust, and scalable event processing infrastructure that can be deployed in a range of at risk enterprises (e.g. the U.S. military, banks, chemical plants and refineries, and border and port security systems). The second objective addresses the need for a methodological framework for handling incipient and actual insider behavior once it is recognized. Here, research efforts aim to characterize behaviors, determine risks, and understand the ethical, legal and policy choices available to technologists and policy-makers. Policy choices might include modifying institutional behavior, establishing clear policies, providing incentives for good behavior, and implementing training programs so that employees will better understand the risks and consequences of their actions. This information will inform decisions about preventing and dealing with insider threats. All of the research will be integrated with three workshops, intended to engage the stakeholders most affected by this work.

• Principal Investigator: Sean W. Smith, Department of Computer Science
• Project Researchers
• Project Publications
  
• Project Web Site
• Funding: I3P