Paying Attention to the Insider Threat

The misuse of information systems by internal actors -the insider threat -is an ever-growing concern in organizations of all types.The timely detection of an insider threat is as important as it is difficult.Analyzing user behaviors recorded in electronic logs require significant computing resources and the capability to find and interpret complex patterns in temporal sequences that may contain irrelevant, temporary or novel elements.In this paper we use an attentionbased architecture derived from BERT (Bidirectional Encoder Representations from Transformers) for the creation, storage and updating of an always-current, holistic user behavior model that enables real-time insider threat detection through anomaly detection and user behavior prediction techniques.A case study with a very large transaction system is provided.