Detecting Masquerading Traitors from Process Visualization of Computer Usage

Insider attacks in organizations are currently one of the most crucial cybersecurity challenges. Traitors are one of the most dangerous types of insider attackers. They are difficult to detect because they know the organization, processes, defense mechanisms, and employees. Besides abusing their rights and accesses, they can use their co-workers’ rights and accesses. They can hide their activities to perform attacks inconspicuously. The current masquerader detection techniques usually rely on the fact that the masquerader is an outsider, making them unable to detect attacks from the traitor. To detect these insider attackers, which we call masquerading traitors, we propose the human-as-solution approach and engage the employees in deciding whether the usage of their rights and accesses is suspicious and, therefore, might be performed by a masquerading traitor.