Toward a Deeper Understanding of Personnel Anomaly Detection

Abstract

Recent threats to prominent organizations have greatly increased social awareness of the need for information security. Many measures have been designed and developed to guard against threats from outsider attacks. Technologies are commonly implemented to actively prohibit unauthorized connection and/or limit access to corporate internal resources; however, threats from insiders are even more subtle and complex. Personnel whom are inherently trusted have valuable internal corporate knowledge that could impact profits or organizational integrity. They are often a source of potential threat within the corporation, through leaking or damaging confidential and sensitive information—whether intentionally or unintentionally. Identifying and detecting anomalous personnel behavior and potential threats are concomitantly important. It can be done by observation and evaluation of communicated intentions and behavioral outcomes of the employee over time. While human observations are subject to fallibility and systems statistics are subject to false positives, personnel anomaly detection correlates observations on the change of personnel trustworthiness to provide for both corporate security and individual privacy. In this paper, insider threats are identified as one of the significant problems to corporate security. Some insightful discussions of personnel anomaly detection are provided, from both a social and a systems perspective.