Caught in the act of an insider attack: detection and assessment of insider threat

The greatest asset that any organisation has are its people, but they may also be the greatest threat. Those who are within the organisation may have authorised access to vast amounts of sensitive company records that are essential for maintaining competitiveness and market position, and knowledge of information services and procedures that are crucial for daily operations. In many cases, those who have such access do indeed require it in order to conduct their expected workload. However, should an individual choose to act against the organisation, then with their privileged access and their extensive knowledge, they are well positioned to cause serious damage. Insider threat is becoming a serious and increasing concern for many organisations, with those who have fallen victim to such attacks suffering significant damages including financial and reputational. It is clear then, that there is a desperate need for more effective tools for detecting the presence of insider threats and analyzing the potential of threats before they escalate. We propose Corporate Insider Threat Detection (CITD), an anomaly detection system that is the result of a multi-disciplinary research project that incorporates technical and behavioural activities to assess the threat posed by individuals. The system identifies user and role-based profiles, and measures how users deviate from their observed behaviours to assess the potential threat that a series of activities may pose. In this paper, we present an overview of the system and describe the concept of operations and practicalities of deploying the system. We show how the system can be utilised for unsupervised detection, and also how the human analyst can engage to provide an active learning feedback loop. By adopting an accept or reject scheme, the analyst is capable of refining the underlying detection model to better support their decisionmaking process and significant reduce the false positive rate

Automated insider threat detection system using user and role-based profile assessment

© 2007-2012 IEEE. Organizations are experiencing an ever-growing concern of how to identify and defend against insider threats. Those who have authorized access to sensitive organizational data are placed in a position of power that could well be abused and could cause significant damage to an organization. This could range from financial theft and intellectual property theft to the destruction of property and business reputation. Traditional intrusion detection systems are neither designed nor capable of identifying those who act maliciously within an organization. In this paper, we describe an automated system that is capable of detecting insider threats within an organization. We define a tree-structure profiling approach that incorporates the details of activities conducted by each user and each job role and then use this to obtain a consistent representation of features that provide a rich description of the user's behavior. Deviation can be assessed based on the amount of variance that each user exhibits across multiple attributes, compared against their peers. We have performed experimentation using ten synthetic data-driven scenarios and found that the system can identify anomalous behavior that may be indicative of a potential threat. We also show how our detection system can be combined with visual analytics tools to support further investigation by an analyst

A biopsychosocial interpretation of the Neuropsychiatric Inventory – Nursing Home assessment: reconceptualising psychiatric symptom attributions

Background: The Neuropsychiatric Inventory is predicated on the assumption that psychiatric symptoms are manifestations of disease. Biopsychosocial theories suggest behavioural changes viewed as psychiatric may also arise as a result of external behavioural triggers. Knowing the causes of psychiatric is important since the treatment and management of psychiatric symptoms relies on this understanding. Aims: This study sought to understand the causes of psychiatric symptoms recorded in care home settings by investigating qualitatively described symptoms in NPI-NH interviews. Method: The current study examined the NPI-NH interviews of 725 participants across 50 care homes. The qualitatively described symptoms from each of the 12 subscales of the NPI were extracted: 347 interviews included at least one qualitatively described symptom (n=651 descriptions). A biopsychosocial algorithm developed following a process of independent researcher coding (n=3) was applied to the symptom descriptions. This determined whether the description had predominantly psychiatric features, or features that were cognitive or attributable to other causes (i.e. issues with Orientation & Memory, Expressions of Need, Poor Care and Communication or Understandable Reactions) Results: Our findings suggest that the majority (over 80%) of descriptions described symptoms with features that could be attributable to cognitive changes and external triggers (e.g. poor care and communication). Conclusions: The finding suggest that in its current form the NPI-NH may over attribute the incidence of psychiatric symptoms in care homes by overlooking triggers for behavioural changes. Measures of psychiatric symptoms should determine the causes of behavioural changes in order to guide treatments more effectively

The role of dieting, happiness with appearance, self-esteem, and bullying in the relationship between mental health and body-mass index among UK adolescents: a longitudinal analysis of the Millennium Cohort Study.

BACKGROUND: Mental illness and obesity are among the biggest challenges to population health, they are linked, and may be modifiable during adolescence. We aimed to determine intervening pathways between mental health and BMI z-score symptoms across adolescence. METHODS: In this longitudinal cohort study, we used path models to examine self-reported dieting, happiness with appearance, self-esteem and bullying at 14 years as potential mediators of the cross-lagged relationship between mental health (via the Strengths and Difficulties Questionnaire) and Body Mass Index (BMI) z-score at 11 and 17 years by sex in the UK Millennium Cohort Study, a prospective cohort study of 18,818 children born in the UK between September 1st, 2000, and January 31st, 2002. Full, incomplete data on all singleton children still participating in the study by age 11 years were analysed in GSEM via maximum likelihood estimation (N = 12,450). FINDINGS: We found happiness with appearance and self-esteem, but not dieting or bullying, mediated the relationship between BMI age 11 and mental health age 17. Each increase in BMI z-score at 11 years was associated with 0.12 increase for boys and a 0.19 increase for girls in scores of unhappiness with appearance (boys: b 0.12, 95% C.I.; girls b 0.19, C.I. 0.14 to 0.23) and a 16% increase for boys and a 22% increase for girls in odds of low self-esteem (boys OR 1.16, 95% C.I. 1.07 to 1.26; girls: OR 1.22, 95% C.I. 1.15 to 1.30) at 14 years. In turn, for both boys and girls, being unhappy with appearance and low self-esteem at 14 years were associated with a greater likelihood of emotional and externalizing symptoms at 17 years. INTERPRETATION: Early prevention strategies to encourage healthy physical and mental development of children need to focus on the promotion of positive body-mage and self-esteem. FUNDING: The National Institute for Health and Care Research (NIHR) School for Public Health Research (SPHR)

Is earlier obesity associated with poorer executive functioning later in childhood? Findings from the Millennium Cohort Study

BACKGROUND: Children affected with overweight or obesity have been associated with having lower educational achievement compared to peers who are non-overweight/obese. One of the drivers of this association could be a link between obesity and poorer executive function. Evidence is limited to small, cross-sectional studies which lack adjustment for important common causes. OBJECTIVE: We investigate the association between weight status and executive function longitudinally in mid-childhood, accounting for potential common causes. METHODS: Linear regression analyses were conducted to examine associations between weight status between 5 and 7 years and executive functioning at 11 years in members of the Millennium Cohort Study (n = 7739), accounting for a wide range of potential common causes. Age- and sex-specific International Obesity Taskforce cut-points for body mass index (BMI) were used. Executive function, including decision-making, impulsivity and spatial working memory, was assessed using the Cambridge Neuropsychological Test Automated Battery. RESULTS: There were no unadjusted associations between weight status and decision-making or impulsivity. After adjustment for all potential common causes, there was a lack of consistent evidence to support an association between persistent obesity (including overweight) between 5 and 7 years and spatial working memory task at 11 years. CONCLUSIONS: We found little evidence that poorer spatial working memory contributes to the association of children with obesity having lower educational achievement

Comparison of two putatively selective radioligands for labeling central nervous system beta-adrenergic receptors: inadequacy of [3H]dihydroalprenolol

[3H]Dihydroalprenolol ([3H]DHA) has been used extensively in receptor binding studies to measure beta-adrenergic receptors in the central nervous system. Usually, nonspecific binding has been defined by high concentrations of the beta-adrenergic receptor agonist isoproterenol or antagonists such as alprenolol or propranolol. Scatchard plots of such "specific" [3H]DHA saturation data in rat cerebral cortex membranes are linear. However, computer analysis demonstrated that the competition curves of these drugs for 2.0 nM [3H]DHA binding are biphasic, with a continuous inhibition of [3H]DHA binding in the concentration range usually used to determine nonspecific binding. These data indicate that another saturable high affinity site was being labeled by the radioligand and that the definition of nonspecific binding with any of these unlabeled drugs is not satisfactory. We used the nonlinear, least squares, curve-fitting program LIGAND to analyze total [3H]DHA binding, allowing the program to mathematically define nonspecific binding as a function of 3H-ligand concentration. Significantly lower Bmax (-44%) and Kd (-58%) values for beta-adrenergic receptors were found, indicating that under normal experimental procedures (defining [3H]DHA non-specific binding with these nonradioactive drugs) a second binding site was being labeled. We found that [3H]DHA binding to this site could be inhibited by drugs such as RU24969, a 5-hydroxytryptamine1A (5HT1A) and 5HT1B receptor subtype-selective agonist, and CGS12066B, a 5HT1B receptor subtype-selective agonist, which were able to compete for 15-20% of [3H]DHA binding in the nanomolar concentration range, whereas drugs that are selective for other serotonin receptor subtypes inhibited [3H]DHA binding only at much higher concentrations. Another beta-adrenergic receptor antagonist radioligand, [3H]CGP-12177, was found to be more selective for beta-adrenergic receptors. Alprenolol competition curves for [3H]CGP-12177 binding were monophasic and saturation curves, with nonspecific binding defined either by 10 microM alprenolol or by LIGAND, yielded Bmax values close to those obtained with [3H]DHA when its nonspecific binding was defined by LIGAND. [3H]DHA cannot be considered a suitable radioligand to quantify central nervous system beta-adrenergic receptors in the manner in which it has been typically used

Reevaluation of the regulation of beta-adrenergic receptor binding by desipramine treatment

Treatment of rats with desipramine (DMI) has been shown to down-regulate beta-adrenergic receptor-stimulated adenylate cyclase and reduce the Bmax of beta-adrenergic receptors in some brain areas. Recent reports have indicated that the down-regulation in the number of beta-adrenergic receptors following DMI treatment does not occur if the serotonin system has been impaired following parachlorophenylalanine (PCPA) or 5,7-dihydroxytryptamine injection. We have previously shown that [3H]dihydroalprenolol ([3H]DHA), the most commonly used radioligand to measure central nervous system beta-adrenergic receptors, labels another site under normal experimental procedures, in addition to the beta-adrenergic receptors. This second site has some pharmacological characteristics of the 5-hydroxytryptamine1A receptor. The depletion of serotonin following PCPA injection was indeed able to prevent the down-regulation of [3H]DHA binding sites after DMI injection. However, PCPA alone increased the density of [3H]DHA binding sites. If the nonlinear, least squares, curve-fitting program LIGAND was allowed to define [3H]DHA nonspecific binding or if the more selective beta-adrenergic receptor radioligand [3H]CGP-1277 was used, the Bmax of beta-adrenergic receptors was not changed after PCPA injection. Importantly, PCPA did not prevent beta-adrenergic receptor down-regulation following DMI treatment. The blockade of 5-hydroxytryptamine2 receptors, via ketanserin administration, during DMI treatment did not change the response of beta-adrenergic receptors. Furthermore, if LIGAND was used to define the nonspecific binding of [3H]DHA, the down-regulation of beta-adrenergic receptors was significant 24 hr after a single DMI injection. The same rapid down-regulation was demonstrated with [3H]CGP-12177. However, if [3H]DHA was used to label beta-adrenergic receptors in the "typical" manner (nonspecific binding defined by 10 microM alprenolol), a decrease in the number of beta-adrenergic receptors was significant only after seven daily DMI injections. These data demonstrate that the use of [3H]DHA to measure beta-adrenergic receptors can be misleading, because changes in its second binding site can conceal the changes occurring in beta-adrenergic receptors. Moreover, these results suggest that a similarity in the time course of action of DMI cannot be used to support the hypothesis that its therapeutic antidepressant action is related to beta-adrenergic receptor down-regulation

Electron capture dissociation mass spectrometry of phosphopeptides: Arginine and phosphoserine

AbstractWe have previously shown that the presence of phosphorylation can inhibit detection of electron capture dissociation (ECD) fragments of doubly charged peptide ions. The presence of non-covalent interactions, in the form of salt-bridges or ionic hydrogen bonds, prevents the separation of fragments following backbone cleavage. Here, we show the electron capture dissociation mass spectrometry of a suite of model peptides designed to investigate the relationship between phosphoserine and arginine position, namely AApSAnRAmKA (n=0–6, m=6–0), the presence of lysine residues (AApSAAKAARAKA) and AAApSARAAAAKAAAK, and the presence of proline A(A/P)ApSARAAA(A/P)KAAAK. The latter are analogous to the peptides studied previously. The results show that the presence of phosphoserine and basic amino acid residues alone does not inhibit ECD fragmentation, even when the number of basic amino acid residues is greater than the precursor charge state. Neither did the presence of proline in the peptide sequence suppress ECD backbone cleavage. Nevertheless, the presence and relative position of the phosphorylated residue do alter the observed backbone fragmentation abundance. In addition, the presence of phosphorylation appears to inhibit cleavage within the arginine side-chain regardless of the relative position of the arginine residue. The results suggest that ECD fragmentation behaviour is dependent on the three-dimensional structure of a peptide rather than its sequence

An automatic abstraction technique for verifying featured, parameterised systems

A general technique combining model checking and abstraction is presented that allows property based analysis of systems consisting of an arbitrary number of featured components. We show how parameterised systems can be specified in a guarded command form with constraints placed on variables which occur in guards. We prove that results that hold for a small number of components can be shown to scale up. We then show how featured systems can be specified in a similar way, by relaxing constraints on guards. The main result is a generalisation theorem for featured systems which we apply to two well known examples