Detecting Insider Threats Using Ben-ware: Beneficial Intelligent Software for Identifying Anomalous Human Behaviour Andrew Stephen McGough1∗ y, Budi Arief2, Carl Gamble2, David Wall3, John Brennan1, John Fitzgerald2, Aad van Moorsel2, Sujeewa Alwis4, Georgios Theodoropoulos1, Ed Ruck-Keene1 1Durham University, Durham DH1 3LE, UK fstephen.mcgough, j.d.brennan, georgios.theodoropoulos,
[email protected] 2Newcastle University, Newcastle upon Tyne NE1 7RU, UK fbudi.arief, carl.gamble, john.fitzgerald,
[email protected] 3University of Leeds, Leeds LS2 9JT, UK
[email protected] 4Insighlytics Ltd, York, UK
[email protected] Abstract The insider threat problem is a significant and ever present issue faced by any organisation. While security mechanisms can be put in place to reduce the chances of external agents gaining access to a system, either to steal assets or alter records, the issue is more complex in tackling insider threat. If an employee already has legitimate access rights to a system, it is much more difficult to prevent them from carrying out inappropriate acts, as it is hard to determine whether the acts are part of their official work or indeed malicious. We present in this paper the concept of “Ben-ware”: a beneficial software system that uses low-level data collection from employees’ computers, along with Artifi- cial Intelligence, to identify anomalous behaviour of an employee. By comparing each employee’s activities against their own ‘normal’ profile, as well as against the organisational’s norm, we can detect those that are significantly divergent, which might indicate malicious activities. Dealing with false positives is one of the main challenges here.