Insider Threats

Science of Human Circumvention of Security (SHUCS)

S.W. Smith (Dartmouth), V. Kothari (Student) with J. Blythe (USC ISI), R. Koppel (University of Pennsylvania)


  • Good people circumvent security controls to do their jobs and to meet their organization’s mission.
  • We can’t pretend it doesn’t happen!


  • Move from fantasy-based security to evidence-based security
  • Develop tools and metrics to make meaningful, quantifiable comparisons, decisions, and other evaluations of proposed solutions in light of what users do
  • Interdisciplinary: computer security, AI, sociology, ethnography

Key Science Methods & Advances

  • Conducted surveys to compare users’ security perceptions and behaviors to those of experts.
  • Employed ethnography and interviews to document how and why users circumvent.
  • Catalogued and classified mismorphisms, “mappings that fail to preserve structure.”
  • Developed agent-based simulations to model security-relevant human behavior
  • Conducting eye-gazing study to examine how users read and classify emails, esp., cues they use.
  • Builds on our prior projects including TISH (healthcare settings) and IRIDOE (financial)

Results & Impacts

  • Serves as a window into how and why users circumvent security policies, mechanisms, and advice in real-world settings.
  • Suggests approaches for developing workflow-inspired security solutions tailored to organizational needs.
  • Provides methods to compare and evaluate different security solutions, e.g., simulations suggest lax privacy policies provide better security than stringent ones in select settings.
  • Invitational workshops on circumvention, and on insider attack
  • “Best Paper” accolades from AMIA and IMIA

REV2: Review Fraud in online Marketplaces

V.S. Subrahmanian (Dartmouth) with S. Kumar (Stanford), B. Hooi, C. Faloutsos (Carnegie Mellon University), D. Makhija, M. Kumar (FlipKart)


  • A 1-star increase in online product reviews can yield an increase of 5-9% in revenues. Examples:
    • “Online reviews are a five-star world of fakery”, Times of London, Dec 9 2017
    • “Huawei got people to write fake reviews for an unreleased phone”, The Verge, Feb 12 2018
  • Objective: What distinguishes fair vs. unfair online reviews? How well can we predict if a review is fair?

Key Science Methods & Advances

  • Developed a bipartite graph model. Two types of nodes: users and products, linked by edges between a user u and a product p if u wrote a review of p.
  • Developed a set of equations linking three variables. Fairness fuf_uof a user u, goodness gpg_pof a product p, and reliability ru,pr_(u,p)of a review of p written by u. Proved that the equations are always solvable.
  • Unsupervised prediction: Showed that users with low fairness scores were likely to be unfair.
  • Supervised predictions: Fed unsupervised predictions into supervised classifiers to get highly accurate predictions.

Results & Impacts

  • Tested on 5 large real world datasets (Amazon, Epinions, Flipkart, 2 Bitcoin exchanges).
  • 85-90% predictive accuracy
  • REV2 reported 150 previously unknown unfair reviewers to Flipkart. Of these, 127 were deemed bad by Flipkart’s anti-fraud team. Also discovered a “review botnet” of over 30 accounts.
  • REV2 is in operational use at Flipkart, India’s biggest e-commerce vendor.

VEWS: A Wikipedia Vandal early Warning System

V.S. Subrahmanian (Dartmouth) with S. Kumar (Stanford) and F. Spezzano (Boise State)


  • 7% of edits on Wikipedia involve vandalism.
  • 3-4% of Wikipedia editors are vandals.
  • What behavior distinguishes vandals from benign users?
  • Can we automatically predict if a user is a vandal or not before s/he makes malicious edits?

Key Science Methods & Advances

  • Developed VEWS dataset. 34K editors, 770K edits,1.5 year time frame. Approximately 50% vandals.
  • Available at:
  • Showed that vandals rarely engage in discussions with other editors and edit pages in quick succession.
  • Developed novel set of features based on the statistics of consecutive edits made by an editor. Thus, each pair of consecutive edits has an associated consecutive edit feature vector (CEFV).
  • Developed a novel probabilistic transition matrix that captures transitions between each possible pair of CEFVs. These capture the dynamics of transitions.

Results & Impacts

  • On average, VEWS identifies vandals in 2.13 edits.
  • VEWS achieves an AUC of approx. 87%. Past work identified vandals with 59.3% (Stiki) and 71.4% (ClueBotNG). When combined with ClueBot and Stiki, VEWS’AUC is 90.8%.
  • Showed that the very first edit made by an editor can determine if he is a vandal or not

Linking Human Behavior with Cyber-Vulnerability

V.S. Subrahmanian (Dartmouth) with C. Kang (AT&T), N. Park (University of North Carolina), B.A. Prakash (Virginia Tech), E. Serra (Boise State), B. Wang (Virginia Tech)


  • Can we use data-driven methods to link cyber vulnerability of a host to human behavior>?
  • Can host behaviors such as number of binaries, number of downloaded binaries, number of rare binaries, user travel behavior be linked to the likelihood of a host being compromised by a cyber attack?
  • Do these behaviors vary by host type (e.g. software developers vs. gamers vs. professionals)?

Key Science Methods & Advances

  • Developed a data set with 15K Android APKs in all (5K each of spyware, goodware, and other malware).
  • Samples are recent, drawn from 2016-2017.
  • Built novel static and dynamic features for each APK.
  • Developed machine learning methods to separate spyware from goodware and other malware.
  • Developed a detailed study of the behaviors of 5 major recent Android spyware families: AceCard, HeHe, Pincer, UAPush, USBCleaver.

Results & Impacts

  • Separating spyware from goodware achieves 97% AUC and
  • F1-Score, 0.95% false positive rate.
  • Separating spyware from other malware achieves 96% AUC and F1-Score, and a 2.95% false positive rate.
  • Key factors distinguishing spyware:
    • 50% of spyware wish to write SMSs, while almost no goodware do so
    • Tend to have fewer components (providers, activities, intents, receivers)
    • Tend to access finer grained permissions (e.g. record audio, request fine location
  • Other malware tend wish to start admin services, spyware usually does not.

Insider threat and intelligence

G. Santos (Dartmouth)


  • A malicious insider is an insider who has malicious intent to act against the best interests of the organization.
  • Focus: detect malicious insiders who aim to interfere with the decision-making process


  • Attacks are subtle and accumulative
  • Analytical products are written in natural language
  • Large individual differences



  • Key difference between normal and malicious actions may rest with whether they follow an analyst’s habitual working style.

APEX '07 Dataset

  • Data collected by NIST to evaluate CASE tools for tacit collaboration.
  • Scenario of the experiment: The Secretary of State has requested analytic assessment of two questions
  • 9 users (including root for testing purpose)


  • Developed a framework that processes user’s activity information for a period of time, detects malicious insiders in an automated fashion
  • All malicious insiders are detected with no false alarms
  • The proposed idea that relies on stability of one’s cognitive styles have been proven successful to determine malicious intent

Scalable Trusted Computing for Protecting Against Insider Attack

A. Iliev, S.W. Smith (Dartmouth)


  • How do we protect sensitive computation against insider attack at the server? Example: power market auctions
  • Easy but wrong answer: use a secure execution environment.
  • Problem: but what if the computation is bigger than the secure execution environment?

Key Science Methods & Advances


  • Use blinded circuits....
  • but generalize “gates operations” to the largest operations that can fit into the SEE
  • including novel approach to array lookup

Start With

  • Secure function evaluation (Yao blinding)
  • Smith's work at IBM on trusted computing
  • Oblivious RAM
  • Benes networks
  • Fairplay


  • Tiny trusted third parties
  • Encrypted switches
  • Language and compiler and prototype, using the IBM 4758
  • Practical demonstration: power market scheduling including Djikstra's shortest paths algorithm.

Results & Impacts

  • A. Iliev, S.W. Smith. “Small, Stupid and Scalable: Secure Computing with Faerieplay.” The Fifth ACM Workshop on Scalable Trusted Computing (STC'10). October 2010. 41--52.
  • A. Iliev, S.W. Smith. “Faerieplay on Tiny Trusted Third Parties (Work in Progress).” Second Workshop on Advances in Trusted Computing (WATC '06) November 2006.
  • A. Iliev, S.W. Smith. “Protecting User Privacy via Trusted Computing at the Server.” IEEE Security and Privacy. 3 (2): 20--28. March/April 2005.
  • Ph.D. Thesis: Dartmouth TR2009-659

BAIT: Behavioral Analysis of Insider Threat

V.S. Subrahmanian (Dartmouth), A. Azaria (Carnegie Mellon University), S. Kraus (Bar-Ilan University), A. Richardson (Jerusalem College of Technology)


  • Insider threat prediction is a huge challenge for several reasons:
    • high imbalance as most insiders are benign
    • prediction methods must have low false positive rates
    • real-world data is hard to get
  • Problem: Given a set of data monitoring a given user community, can we predict who might constitute a malicious insider threat?

Key Science Methods & Advances

  • Developed an online insider threat “game” in which each player is given various tasks. Each player is also told that their actions are subject to continuous monitoring. Actions are drawn from a generic list including a “personal” action that mimics personal interests.
  • A very small number of players are told to exfiltrate data and given rewards for doing so if he eludes detection.
  • Recruited 795 players in all on Amazon Mechanical Turk. Only 7 were given the role of “malicious” insiders.
  • Developed bootstrapping classifiers in which labels generated in a previous iteration of the classifiers are used for training in a subsequent iteration.
  • Developed 7 such algorithms to manage the imbalance in data (< 1% of users were in the malicious class, more than 99% in the benign class).

Results & Impacts

  • Malicious users were more active than benign users.
  • Malicious users fetched significantly more sensitive information than benign users, but also fetched significantly less data that was labelled “classified”.
  • Malicious users exported significantly more data (e.g. to DVD/USB) than benign users.
  • Malicious users edited data less than benign users.
  • 30% precision, 60% recall