Psychosocial Modeling of Insider Threat Risk Based on Behavioral and Word Use Analysis

Abstract

In many insider crimes, managers and other coworkers observed that the offenders had exhibited signs of stress, disgruntlement, or other issues, but no alarms were raised. Barriers to using such psychosocial indicators include the inability to recognize the signs and the failure to record the behaviors so that they can be assessed. A psychosocial model was developed to assess an employee’s behavior associated with an increased risk of insider abuse. The model is based on case studies and research literature on factors/correlates associated with precursor behavioral manifestations of individuals committing insider crimes. A complementary Personality Trait modeling approach was developed based on analysis to derive relevant personality characteristics from word use. Several implementations of the psychosocial model were evaluated by comparing their agreement with judgments of human resources and management professionals; the personality trait modeling approach was examined using email samples. The paper also briefly discusses privacy/ethical issues in behavioral monitoring for insider threat detection and a vision for operational deployment of an approach that incorporates these models into a set of management tools for identifying employees who pose a greater insider threat.