Methods, systems, and media for testing insider threat detection systems

Abstract

Methods, systems, and media for testing insider threat detection systems are provided. In some embodiments, the method comprises: receiving, using a hardware processor, a first plurality of actions in a computing environment that are associated with one of a plurality of user accounts; generating a plurality of models of user behavior based at least in part on the first plurality of actions, wherein each of the plurality of models of user behavior is associated with each of the plurality of user accounts; selecting a model of user behavior from the plurality of models of user behavior, wherein the model of user behavior is associated with a malicious user type; generating a simulated user bot based on the selected model of user behavior; executing the simulated user bot in the computing environment, wherein the simulated user bot injects a second plurality of actions in the computing environment; determining whether an insider threat detection system executing within the computing environment identifies the simulated user bot as a malicious user; and transmitting a notification indicating an efficacy of the insider threat detection system based on the determination.