Search papers, labs, and topics across Lattice.
This paper introduces a dynamic Bayesian game framework for insider threat detection, utilizing a Bayesian Temporal Correlated Equilibrium (BTCE) to coordinate a committee of strategic certifiers. By incorporating behavioral factors such as present bias and loss aversion, the proposed method achieves significantly earlier detection of insider threats—1.7 to 4.5 days sooner than traditional rational models. The mechanism demonstrates robust performance, achieving up to 28.3% pre-exfiltration detection with minimal false positives, outperforming existing baselines like transformers and streaming provenance methods.
Early detection of insider threats can be accelerated by up to 4.5 days using a novel Bayesian game approach that adapts to human behavioral biases.
We model insider threat detection as a dynamic Bayesian game in which a platform coordinates a committee of strategic certifiers to sustain equilibrium among honest users and detect malicious deviations before exfiltration. Certifiers and users operate under a Bayesian Temporal Correlated Equilibrium (BTCE), where a sealed-envelope correlating device issues private recommendations over time and obedience is verified at every on-path information state. Unlike Stackelberg formulations, BTCE coordinates heterogeneous certifiers without requiring commitment power. We incorporate present bias and loss aversion to capture impulsive escalation dynamics, enabling 1.7--4.5 days earlier detection than rational baselines. We prove three guarantees: (1) calibrated intervention losses make recommended behavior a current-self best response despite behavioral biases, (2) controlled evidence accumulation guarantees intervention in bounded expected time before exfiltration, and (3) median aggregation confines implemented actions to the honest recommendation range when fewer than half of certifiers are Byzantine. On CERT r6.2 our mechanism achieves up to 28.3% pre-exfiltration detection with false positives below 1.6%, while both a transformer baseline and a streaming provenance approximation (HOLMESLite) achieve near-zero pre-exfiltration detection under comparable constraints.
