Results From Invoking Artificial Neural Networks to Measure Insider Threat Detection & Mitigation

Journal Article · Thu Mar 31 00:00:00 EDT 2022 · Digital Threats: Research and Practice

DOI:https://doi.org/10.1145/3457909· OSTI ID:1831170

Williams, Adam D. ^[1]; Abbott, Shannon N. ^[1]; Shoman, Nathan ^[1]; Charlton, William S. ^[2]

---

1. Sandia National Lab. (SNL-NM), Albuquerque, NM (United States)
2. Univ. of Texas, Austin, TX (United States). Nuclear Engineering Teaching Lab.

Advances on differentiating between malicious intent and natural “organizational evolution” to explain observed anomalies in operational workplace patterns suggest benefit from evaluating collective behaviors observed in the facilities to improve insider threat detection and mitigation (ITDM). Advances in artificial neural networks (ANN) provide more robust pathways for capturing, analyzing, and collating disparate data signals into quantitative descriptions of operational workplace patterns. In response, a joint study by Sandia National Laboratories and the University of Texas at Austin explored the effectiveness of commercial artificial neural network (ANN) software to improve ITDM. Overall, this research demonstrates the benefit of learning patterns of organizational behaviors, detecting off-normal (or anomalous) deviations from these patterns, and alerting when certain types, frequencies, or quantities of deviations emerge for improving ITDM. Evaluating nearly 33,000 access control data points and over 1,600 intrusion sensor data points collected over a nearly twelve-month period, this study's results demonstrated the ANN could recognize operational patterns at the Nuclear Engineering Teaching Laboratory (NETL) and detect off-normal behaviors—suggesting that ANNs can be used to support a data-analytic approach to ITDM. Several representative experiments were conducted to further evaluate these conclusions, with the resultant insights supporting collective behavior-based analytical approaches to quantitatively describe insider threat detection and mitigation.

• Research Organization: Sandia National Lab. (SNL-NM), Albuquerque, NM (United States)
• Sponsoring Organization: USDOE National Nuclear Security Administration (NNSA), Office of Defense Nuclear Nonproliferation
• Grant/Contract Number: NA0003525
• OSTI ID: 1831170
• Report Number(s): SAND-2021-3782J; 695178
• Journal Information: Digital Threats: Research and Practice, Vol. 3, Issue 1; ISSN 2692-1626
• Publisher: Association for Computing Machinery (ACM)
• Country of Publication: United States
• Language: English

Related Subjects

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEFENSE