Insider risk profile matrix to quantify risk value of insider threat prediction framework

Abstract

An insider threat refers to the threat arising from an individual inside an organization that maliciously leverages his or her system privileges, and closeness and proximity in a computerized environment to compromise valuable information and inflict harm. This scenario is an example of system violation that decreases the degree of system trustworthiness. Most cases of system trustworthiness use a peer judgment formulation, which may involve bias sentiments towards document sensitivity values. Moreover, audit trails of risky document navigation paths are important as an alarm to indicate any violation. Therefore, this study presents a combination of the trust criteria and document sensitivity level of an insider to obtain a risk value, which will be used to predict the occurrence of an insider threat. This study begins by investigating the prominent attributes of insiders with a focus on their degree of experience and skill in line with system trust. Subsequently, these prominent attributes are used to construct an insider Trust Profile Matrix (TPM). From the TPM, the trust value is calculated and combined with the sensitivity value of each document to produce a Risk Matrix (RM). As a result, (i) risk value and (ii) prediction rate and risky path are then calculated and analyzed using an Insider Threat Prediction Framework as an alarm for violation occurrence.