On the Possibility of Insider Threat Detection Using Physiological Signal Monitoring
Abdulaziz Almehmadi, Khalil El‐Khatib · 2014
Insider threat damages vary from intellectual property loss and fraud to IT sabotage. As insider threat incidents have evolved to cause potentially catastrophic damages, there exists a need for a detection mechanism in order to build solutions that prevent such threats. Studies over the years show an understanding of the threat, and many approaches have been suggested to detect it, yet none of the approaches targets the physiological aspect of the threat. Bio-signals are impossible to mimic or change, as opposed to behavioral approaches. In this paper, we investigate the use of physiological signals as a measurement to detect insider threat. We design an insider threat monitoring system called Physiological Signals Monitoring (PSM) that detects incidents seconds before they occur. The main measurement in PSM is the abnormal deviation rate of electrocardiogram (ECG) amplitude, Galvanic Skin Response (GSR) and skin temperature that occurs seconds before an incident is executed. Our experiment on 15 human subjects explores this new area and shows the promise of the proposed solution with all of the tested incidents being correctly classified with Nearest Neighbor and Functional Trees classifiers.