-Human behavioral factors are fundamental to understanding, detecting and mitigating insider threats, but to date insufficiently represented in a formal ontology. We report on the design and development of an ontology that emphasizes individual and organizational sociotechnical factors, and incorporates technical indicators from previous work. We compare our ontology with previous research and describe use cases to demonstrate how the ontology may be applied. Our work advances current efforts toward development of a comprehensive knowledge base to support advanced reasoning for insider threat mitigation.
INTRODUCTION
Government and corporate organizations alike recognize
the serious threat posed by insiders who seek to destroy, steal
or leak confidential information, or act in ways that expose the
organization to outside attacks. A widely accepted definition of
the insider threat is “a current or former employee, contractor,
or other business partner who has or had authorized access to
an organization’s network, system, or data and who
intentionally (or unintentionally) exceeds or misuses that
access to negatively affect the confidentiality, integrity, or
availability of the organization’s information or information
systems” [
II.
and tools to identify individuals who pose increased insider threat risk. Most mitigation approaches focus more narrowly on (a) detecting unauthorized user activity and anomalous activity that may be malicious; and (b) preventing data exfiltration. Typical approaches attempt to prevent unauthorized access through the use of firewalls, passwords, and encryption. That is, they are primarily based on the tools and technology used to thwart external attacks. Unfortunately, these security measures will not prevent authorized access by an insider.
Because a key element of insider threat is a “trusted”
perpetrator with authorized access to organizational assets,
monitoring and analysis approaches should not only address
suspicious host/network activities (identifying so-called
technical indicators) but also seek to identify broader aspects of
human behavior, motivation, and intent that may characterize
malicious insider threats. Thus, as noted in [4], approaches
should seek to identify attack-related behaviors that include
deliberate markers, preparatory behaviors, correlated usage
patterns, and even verbal behavior and personality traits, all of
which can be pieced together to detect potential insider threats.
While a number of researchers [5-9] recommend including
behavioral indicators that may be accessible to organizations
prior to an attack, tools and methods that incorporate formal
representations of these human behavioral factors are rare
(exceptions are models described in [
III.
OBJECTIVES
The objective of this research is to develop a formal representation of our current understanding of factors underlying insider threats, particularly relating to individual behavioral and psychological indicators and constructs reflecting organizational factors. The work to date complements and extends extant insider threat ontology frameworks. First, it adds substantial detail (depth) to existing insider threat ontology frameworks that focus on cyber/technical constructs. Second, it defines formal ontological representations of individual and organizational sociotechnical constructs, which are insufficiently represented in current ontological frameworks. The use of a formal, standardized language (ontology) for expressing knowledge about the insider threat domain facilitates information sharing across the insider threat research community and supports model development. A longer term goal is to inform the development of ontology-based reasoning systems and models to support insider threat detection and mitigation. Adopting and using more comprehensive, formal ontological representations will also facilitate the systematic construction of scenarios that may be used in exercising and validating insider threat detection models.
IV.
APPROACH
taxonomy for insider threat risk that can be applied generally to
all types of organizations; and (b) migrating the taxonomy into
a formal ontology for insider threat risk. Care was taken to
compare our representation with existing frameworks
(particularly the ontology developed by Carnegie Mellon
University's Computer Emergency Response Team CERT
[
A well-defined taxonomy provides an initial hierarchy of domain concepts as a starting point for our insider threat ontology. The taxonomy is based on a systematic review, analysis and synthesis of existing research, case studies and guidelines that have been produced by the insider threat research community. Continually being expanded at the leaf nodes, the current taxonomy is 6-7 levels deep. There are 262 unique factors (leaf nodes) defined across the entire taxonomy: a total of 223 constructs defined for the individual factors and 39 for the organizational factors. Our class structure overall contains more than 350 constructs.
At the highest level we distinguish individual human
factors from organizational factors. Individual human factors
reflect behaviors, attitudes, personal issues, sociocultural or
ideological factors, and various biographical factors that may
indicate increased risk. The individual level also differentiates
psychological traits from dynamic states, consistent with
findings that these two constructs are reliably distinct despite their
admitted overlap (e.g., [
Organizational factors focus on organizational and
management practices, policies, and work setting
characteristics that influence worker satisfaction, attitudes,
safety, or protection/vulnerabilities of assets. These factors
have received much attention by organizations that publish best
practices—indicating situations or conditions that contribute to
an increased likelihood of insider threats within an
organization. Although they may play a role in triggering
malicious or unintentional insider threats, these factors have not
generally been identified in insider threat ontologies to date.
This branch of our taxonomy was constructed by consulting the
broad and diverse literature on industrial/organizational
psychology and human error research, including [
To date, insider threat ontology development has focused
primarily on technical factors (e.g., [
tology expressed in the popular OWL-DL ontology language. OWL-DL balances expressiveness (ability to represent many kinds of domain entities and relationships), computational properties (conclusions are guaranteed to be computable in finite time), and functionality for drawing inferences from asserted facts. Enumeration of (potentially hundreds of) Competency Questions (CQs) for our ontology serves as a requirements specification as well as a means of testing the ontology implementation. An example of a simple CQ is “What are the components of class Attitude?” A more complex CQ is “What factors are associated with the observables attendance problems, unauthorized personal use of work computer, and hostile? The CQs may be evaluated using SPARQL queries. Our OWL-DL implementation will enable automated inferences about class relationships. For example, from the assertion that an individual belongs to class Aggressive and class Manipulative, the reasoning engine can infer that the individual fulfills the membership conditions of class Threat.
Following widely recognized guidelines for ontology
development [
(verification and validation that the ontology represents the domain), Integration (reuse of other available ontologies),
adopted IDEF5 methods in conceptualization and formalization phases to acquire knowledge and develop graphical knowledge representation models. We implemented our taxonomy using an off-the-shelf ontology development tool (Protégé).
other concerning factors [
provided by the taxonomy discussed in Section IV-A, and
translating the hierarchy into parent-child relationships of
classes in our ontology. Classes represent objects with similar
structure and properties Classes are arranged hierarchically;
those without further subcategories are termed leaf nodes.
Individuals in the ontology represent instances of classes.
Class relationships other than parent-child are derived from the
research literature, available material on insider threat cases,
and the experience and judgment of subject-matter experts
within the development team. As reuse of previous knowledge
models is a key advantage of ontologies and an encouraged
practice in ontology engineering, we included as much
information from previous work as possible, especially the
recent ontology developed by CERT [
class structures are adopted in total. Selected classes from the
Unified Cyber Security Ontology [
implemented in the Protégé tool. The ontology is derived from the extensive taxonomy described in Section IV-A. Due to space constraints we depict only selected classes with detail restricted to the 4th level of the hierarchy. A comparison of Tables I and II with Figs. 1-3, shows how the class hierarchy in the ontology represents the organization of domain concepts in the taxonomy. Fig. 1 shows how the ontology accounts for both malicious and non-malicious (unintentional) insider threats. Importantly, we distinguish between actions performed by employees (as insiders) and actions performed by organizations (which may, for example, include poor institutional policies and/or security practices as well as inadequate or exacerbating responses to potential threats). At the same root level we also include classes such as Industry, Insider Threat Risk, Effect, Location and Outcome as attributes of the organization. Industry may account for differences in organizational rules, regulations and policies that differ across industry sectors. The Effect class captures information about the impact of the insider criminal activity on the organization(s), for example the action of injecting a virus into an enterprise network can induce a malfunction in other workstations on the network and/or a full network shutdown. The concept of the consequences of an attack is captured by the Outcome class, for example the shutdown of the network has an outcome of a halt of organization’s operations and thousands of dollars of loss. The Location class encapsulates geographic information about the source of an attack. The Insider Threat Risk class captures the threat level that would be associated with the individuals of the Actor class based on the inference performed over the ontology.
Fig. 2 expands the Human Factor node of Fig. 1, and Fig. 3 expands the Organizational Factor node. Inspection of the human psychosocial factors in Fig. 2 reveal classes (and associated sub-classes) that correspond to elements of the taxonomy. Acknowledging the Capability-Motive-Opportunity (CMO) model (e.g., [4]), which postulates that the perpetrator of an attack must have the capability, motive, and opportunity to commit the attack, we include these constructs as classes in the ontology. Full implementation of CMO constructs is deferred for future efforts to define relationships among these classes.
an individual’s knowledge/skills/abilities that are represented in
certain human behavioral factors (cf [
Factor class, contains a large set of individual actions that includes the subcategories Job Performance, Boundary
ken down into more granular, lower-level constructs (shown in boxes); not shown are even lower levels of the hierarchy and individuals representing instances of the classes.
The initial structure of the ontology grew out of the detailed taxonomic structure that we developed based on subject-matter expertise and our analysis/synthesis of research literature and numerous case studies. A more robust and richer representation has been informed by exploring complex relationships among constructs (e.g., classes, sub-classes, instances) spread across multiple branches of the hierarchy. As a simple example, the ontology recognizes that different types of attack are identified from their relationships with certain aspects of the cyber/technical exploit (e.g., exfiltration requires certain actions performed on sensitive information, such as saving to external media, printing, emailing, uploading to the cloud, etc.). A more complex example may be considered in using the CMO model (mentioned above) to reason about insider risk. By incorporating knowledge of relationships among detected behaviors, individual behavioral factors, and organizational factors, the ontology allows reasoning about the risk associated with detected behaviors in the context of possible motives, capabilities, and opportunity. Relationships and gaps (missing elements in classes) were further identified by exercising the knowledge base using known or fictitious use cases.
Use cases help to verify the comprehensiveness of the knowledge representation and to identify missing or ill-defined classes and relationships. In this section, we demonstrate the application of the ontology to use cases that include human behavioral factors and organization factors as well as cyber/technical indicators. In the scenarios described, we use [brackets] to identify significant indicators with actions described in the scenario.
related insider threat incident. Use Case #2 (see large text box), which entirely subsumes the contextual and technical information regarding the insider threat incident described in the first use case, injects additional human behavioral factors.
Use Case #1 John [PERSON: Insider X] is a long-time system administrator [LIFE NARRATIVE: PERS HISTORY] [CAPABILITY] with access to sensitive and classified information [OPPORTUNITY] in a company that performs government-sponsored R&D [ORGANIZATION: VICTIM ORGANIZATION].
John uses his personal web-based email account from his work computer to communicate with prospective employers [DIGITAL ACTION: EMAIL ACTION]. Then he uses his administrative privileges to access some sensitive intellectual property information [BUSINESS INFORMATION: INTELLECTUAL PROPERTY] that will be of interest to a competitor. John saves these files to his computer [COMPUTER ASSET: WORK PC] and copies the files to a thumb drive [CONCERNING BEHAVIOR: TECH/CYBER VIOLATION–DIGITAL ACTION/COPY ACTION] [PHYSICAL ASSET: USB DRIVE], which he then sneaks out of the office with the intention of using the information to leverage a job offer with a competitor [THEFT EVENT: DATA THEFT]. Subsequently John resigns and accepts a job offer from a competitor.
It is evident that Use Case #1 lacks substantial contextual information described in Use Case #2 regarding possible contributing or mitigating factors, relevant personal predispositions, or concerning behaviors that may be associated with this individual’s insider threat risk. Fig. 4 is a concept map depicting Use Case #2, showing all the behavioral and technical concepts and their associated relations. The dashed
Use Case #2 John [PERSON: Insider X] is a long-time system administrator [LIFE NARRATIVE: PERS HISTORY] [CAPABILITY] with access to sensitive and classified information [OPPORTUNITY] in a company that performs government-sponsored R&D [ORGANIZATION: VICTIM ORGANIZATION]. The following input was recorded in his personnel file: (1) One colleague states that John discounts the opinions of colleagues and he becomes hostile when colleagues discuss and critique his ideas [STATIC TRAIT: TEMPERAMENT: RESISTS CRITICISM] [DYNAMIC STATE: AFFECT—HOSTILE]. (2) A different colleague states that John seeks to control all aspects of a project and often insists on dominating the conversation about project tasks and approach [STATIC TRAIT: OTHER PERSONALITY DIMENSIONS—AUTHORITARIANISM]. (3) His manager corroborates these inputs and adds that John tends to become argumentative and irritated, and defensively cites his superior knowledge of industry best practices when others criticize his rigid protocols [DYNAMIC STATE: AFFECT–HOSTILE] [STATIC TRAIT: TEMPERAMENT—BIG EGO]. Staff development/performance review assessment includes criticism by colleagues that portions of his protocols are idiosyncratic with weak rationale, and that his rigid protocols have impacted company projects [CONCERNING BEHAVIORS: JOB PERF—NEGATIVE PERF EVALUATION].
John was passed over for a promotion to manage a new, prestigious project [LIFE NARRATIVE: PERS HISTORY: EMPLOYMENT–PASSED OVER FOR PROMOTION]. He files a complaint with HR claiming unfair treatment and his manager, compelled to meet with him, comes away with the impression that John still harbors resentment over not being promoted. John’s most recent evaluation cited a decline in performance [CONCERNING BEHAVIORS: JOB PERF—NEGATIVE PERF EVALUATION]; since being denied the promotion his attitude has been increasingly disgruntled [DYNAMIC STATE: ATTITUDE—DISGRUNTLEMENT]; and that there were multiple complaints from coworkers about frequent tardiness [CONCERNING BEHAVIORS: BOUNDARY VIOLATION—ATTENDANCE]. The attendance problem led to a formal, written warning [CONCERNING BEHAVIORS: BOUNDARY VIOLATION–POLICY VIOLATION]. After getting the warning, John talks to his manager and loses his cool—storming out of the office [DYNAMIC STATE: AFFECT–HOSTILE]. A colleague hears John’s outburst and tells the manager about John’s recent marital separation to provide some context to Johns behavior [LIFE NARRATIVE: PERS HISTORY—MAJOR LIFE EVENTS/RECENT CHANGE IN MARITAL STATUS (MARITAL SEPARATION)]. The incident prompts the manager to contact the company Security Office. The Security Office checks the local court records to learn that three weeks ago, John was arrested for allegedly driving under the influence (his first contact with the criminal justice system) [LIFE NARRATIVE: CRIMINAL RECORD—DUI].
Faced with these job and personal stressors, John begins to seek work with a competitor. John contacts a competitor to see if they are interested in him and in proprietary information he can provide. To avoid being noticed, John carries out email dialogue with the competitor by logging into his personal Yahoo web mail account from his work computer [CONCERNING BEHAVIORS: JOB PERFORMANCE—CYBERLOAFING]. Next, John carries out the insider threat attack and resigns, as described in second paragraph of Use Case #1. box in Fig. 4 represents Use Case #1 (due to space limitations, not all details are shown). In a real scenario, detecting concerning behaviors or other factors may require multiple factors to meet threshold requirements for alerts—these are not described or represented here due to space constraints. Events depicted in the use case scenarios are numbered chronologically. Shown in the lower right side of the figure is a timeline (spanning several months for illustrative purposes) suggesting that monitoring of sociotechnical factors may help achieve proactive mitigation goals (getting “left of the boom”).
VI.
COMPARISON WITH RELATED WORK
The focus of our effort is to express and represent
individual and organizational sociotechnical factors in an ontological
characterization of insider threat risk (e.g., [
The information framework underlying this database informed
the vocabulary in the ontology. Namely, organizations grant
access to persons that perpetrate events that harm the
organization. Persons and Organizations are the actors in the
CERT ontology, and their actions culminate in events (i.e.,
insider threat incidents). Instead of a focus on events, our
ontology focuses on the insider. Our taxonomy and ontology are
based on theories and models of insider threat in the literature
that incorporate human behavioral as well as technical
indicators of threat (e.g., [
At a basic level, the Factor class, which contains much of the vocabulary in our ontology, can be placed alongside Assets in the CERT ontology. Both are non-temporal classes that a person can possess (i.e., Things). We integrated the two ontologies and eliminated duplications. All CERT ontology classes were incorporated in this way. There are, however, stark differences between the extent and scope of the CERT ontology and our ontology. The CERT ontology contains a standardized and well-defined vocabulary for describing the actions of insider threats. It contains 31 actions (e.g., Copy), along with six action modifiers (e.g., Suspicious), organized under four major classes to describe digital, financial, and job-related insider threat behavior. These actions can be taken on 26 assets (e.g., USB drive) in three major categories (i.e., Physical, Financial, and Digital) and/or 16 types of information (e.g., Password) organized in seven major categories (i.e., National Security, Technology, Financial, Medical, Classified, Business, and Uniquely Identifiable). Eleven focal events are also captured as classes in the ontology (e.g., Theft), for a total of 125 constructs within their class structure. In contrast to the CERT ontology, our framework is broader and deeper. In addition to containing these constructs, our ontology represents a knowledge base that is six to seven layers deep, comprising a total of over 350 constructs. In sum, we have greatly expanded the CERT ontology by adding classes representing human behavioral and organizational factors of insider threat.
While not specifically addressing insider threat, the
cybersecurity HUFO presented by [
VII.
CONCLUSIONS AND FUTURE WORK
Our work addresses two major challenges. First, due to the large number of concepts and their complex interrelationships, the insider threat domain is cumbersome to model. Second, there is a need to establish a common terminology and shared understanding of the complex insider threat domain. We used an exhaustive approach that incorporates into our taxonomy most of the concepts we have encountered in the insider threat literature. We then developed a mapping that transforms the taxonomy into an ontology, and added relationships to the ontology to produce a formal representation of concepts and their interrelationships. By synthesizing the contributions of a diverse set of experts, we developed a knowledge representation that more fully characterizes insider threat indicators— from the perspective of human behavior as well as cyber/technical indicators—and that can be made available in a shareable knowledge base to facilitate reuse and collaboration.
Beyond its immediate use in providing a common, shareable knowledge base of insider threat problem space constructs, the present research will help to advance efforts to model and mitigate insider threats. Informed by extant research on human and organizational factors associated with insider threats, the constructs and indicators represented in the present ontology can be used to develop models to assess individual risk and organizational vulnerability, as well as to inform operational risk management practices. In addition, by specifying a more comprehensive knowledge base, our ontology facilitates the generation of diverse scenarios for use in red teaming and testing of more holistic insider threat models. Finally, the knowledge base provided here may have further operational impact by informing the structure of data to be captured by enterprises for effective insider threat monitoring and analysis.
A brief discussion of some limitations of the research reported here may be useful in interpreting progress to date as well as motivating future work. First, our choice to define a taxonomy as a foundation for the ontology meant that the initial structure only specified hierarchical parent-child relationships among constructs. Other relationships were then defined as part of the process of transforming the taxonomy into an ontology.
Because our primary interest (and recognized need in modeling
insider threats) was to incorporate sociotechnical factors that
have been suggested in research literature, there was also an
inherent limitation in the ability to specify robust axioms that
reflect more complex relationships among constructs.
Ultimately this more complete specification will be required to support
inferences about classes and individuals. There is a tradeoff
between implementing the asserted classes and individuals
versus the inferred constructs. While some of the classes in our
ontology are defined by certain inference rules and axioms
(e.g., the class Capability categorizes instances based on
specified rules), much more work is needed to more fully specify
relationships that will ultimately be required to support
inferences about insider threat risks. A second limitation is that,
while the current ontology has captured salient constructs in the
literature, there are certainly more constructs that can and
should be added to the ontology. Research should continue the
process of encapsulating the entirety of constructs related to
insider threat. We are continually populating the individual and
organizational classes of ontology with relevant instances
(informed by use cases); we plan to further develop the
Capabilities and Opportunities classes and associated relationships,
building upon recent related work [
We use the present forum and others to share these results
with the research community. We also plan to extend our
ontology into a probabilistic ontology by incorporating
information about uncertainty in the insider threat domain. The
resulting probabilistic ontology will support reasoning under
uncertainty [