Prediction and Detection of Malicious Insiders' Motivation Based on Sentiment Profile on Webpages and Emails

Recent high profile data breaches have highlighted the importance of insider threat detection research for cyber security. Anomaly based insider detection approaches are generally associated with high false positives; thus, there has been increased focus on including prediction of user psychology and attack motivations. However, data relating to psychological profile and personality trait of employees are challenging to collect, and do not generally adequately capture attack motivations such as disgruntlement (e.g. towards certain behavior). Therefore, in this paper, we demonstrate how one can build a user psychological profile based on the sentiment analysis of their network browsing and email content. We then evaluate our approach using real-world datasets, and the findings suggest that our approach can proactively and accurately detect malicious insiders with extreme or negative emotional tendencies. This is the first work to build user profile and predict insider threats using sentiment analysis of their browsing and email content.