ADMIT: Automated Detection Method for Insider Threats

ABSTRACT

Detecting Deception by Analyzing Changes in Mouse and Keyboard Behavior during Targeted Survey Administration
The threat of malicious insiders is a top concern for government and corporate agencies. Insider threats – a trusted adversary who operates within an organization’s boundaries – are a significant danger to both private and public sectors, and are often cited as the greatest threat to an organization. Insider threats include disgruntled employees or ex-employees, potential employees, contractors, business partners, or auditors. The damage caused by an insider threat can take many forms, including workplace violence; the introduction of malware into corporate networks; the theft of information, corporate secrets, or money; the corruption or deletion of data; and so on. According to a recent survey of 50 representative companies, it takes them on the average 45 days to contain an insider attack. To address the insider threats challenge, we propose the development and validation of a solution called ADMIT (Automated Detection Method for Insider Threat). ADMIT is a web-based survey tool that elicits information to sensitive questions and reliably detects whether one is being deceptive, concealing information, or experiencing a heightened emotional response to the question. Abnormal behavior that is indicative of insider threat is then highlighted to specified individuals in the organization for review and further investigation. ADMIT operates like well-known Web-based survey tools like Survey Monkey or Qualtrics, and thus can be mass deployed to an entire organization simultaneously.