Probabilistic evidence based insider threat detection and reasoning

Abstract

The main enabler of the technology is the probabilistic programming based computation strategies that have an outstanding ability to handle uncertainties in discovering anomalous patterns. This new capability to handle uncertainties is particularly relevant for detecting insider threats, as there are usually no clearly defined rules and policies. An insider's behaviors would deviate from normally distributed events and actions in various aspects. The probabilistic model detects this deviation and explains the computational path of the deviation. The result interpretation unit enables organizations to investigate the causes with high accuracy, avoiding costly and embarrassing false alarms. The technology detects and ranks abnormal events. This ranking capability helps prioritize follow-up manual investigation.