Title: Insider threat detection and its future directions

Authors: Li Ling Ko; Dinil Mon Divakaran; Yung Siang Liau; Vrizlynn L.L. Thing

Addresses: Department of Cyber Security and Intelligence (CSI), Institute for Infocomm Research (I²R), A*STAR 138632, Singapore ' Department of Cyber Security and Intelligence (CSI), Institute for Infocomm Research (I²R), A*STAR 138632, Singapore ' Department of Cyber Security and Intelligence (CSI), Institute for Infocomm Research (I²R), A*STAR 138632, Singapore ' Department of Cyber Security and Intelligence (CSI), Institute for Infocomm Research (I²R), A*STAR 138632, Singapore

Abstract: The ability to detect insider threats is important for many organisations. However, the field of insider threat detection is not well understood. In this paper, we survey existing insider threat detection mechanisms to provide a better understanding of the field. We identify and categorise insider behaviours into four classes - biometric behaviours, cyber behaviours, communication behaviours, and psychosocial behaviours. Each class is further comprised of several independent research fields of anomaly detection. Our survey reveals that there is significant scope for further research in many of those research fields, with many machine learning algorithms and features that have not been explored. We identify and summarise the unexplored areas as future directions.

Keywords: insider threat; security; detection; biometrics; masquerade; information theft; collusion; sabotage; communication; psychosocial.

DOI: 10.1504/IJSN.2017.084391

International Journal of Security and Networks, 2017 Vol.12 No.3, pp.168 - 187

Received: 09 Oct 2015
Accepted: 08 Dec 2016
Published online: 06 Jun 2017 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article