Context-Aware Insider Threat Detection

We are researching ways to detect insider threats in computer usage data crossing multiple modalities ‐ e.g., resources and devices used, network and communication patterns ‐ and where signals of possible threat are highly contextual ‐ e.g., detectable only after inferring user roles, peer groups, collaborators and personal history. The contexts are also dynamic ‐ reflecting a user’s rapid shifts in focus when working on different tasks and longer term changes in interests ‐ and take place in a setting that is identity-aware but privacypreserving. Although currently focused on the insider threat domain, the architecture, representations and algorithms we are developing are broadly applicable and can lead to interesting future research directions for context-aware computing. 1