搜索结果：insider

Advanced Persistent Threats (APTs) represent sophisticated cyberattacks characterized by stealth, persistence, and evasion of traditional detection mechanisms. We observed that APT behaviors during lateral movement and data exfiltration share notable similarities with insider threat activities, leading us to explore cross-domain learning opportunities. This paper introduces a novel machine learning approach leveraging the CERT Insider Threat Dataset to simulate and detect APT behaviors through AI-augmented analytics. Our methodology integrates multi-modal data analysis, language model-driven behavioral understanding, and advanced machine learning to create realistic APT simulations from insider threat data. We developed three key technical components: a multi-agent language model architecture for log analysis, temporal sequence modeling for behavioral pattern recognition, and deep evidential clustering for uncertainty-aware threat detection that reduces false positives. Our research contributes four advances: a novel methodology for simulating APT patterns using insider threat data, an AI-enhanced multi-modal approach processing structured logs and communications, superior performance compared to existing methods, and practical deployment guidelines for enterprise environments. Experimental results achieved 96.3% detection accuracy while reducing false positives by 42% compared to state-of-the-art methods. Our system successfully simulates realistic APT scenarios across attack stages while providing interpretable explanations through natural language generation. The integration of large language models enables sophisticated analysis of unstructured data sources, offering contextual understanding beyond traditional approaches. This research addresses a critical gap for organizations seeking enhanced APT detection without extensive APT-specific training data. Our approach's ability to learn from insider threat patterns while maintaining high accuracy makes it valuable for enterprise security operations and threat hunting teams facing resource constraints.

This study addresses a core managerial dilemma: should leaders equalize relationships to preserve harmony, or differentiate them to stimulate initiative? We examine how employees' comparative evaluations of their own leader-member exchange (LMX) relative to coworkers' LMX function as identity signals that channel them into distinct innovation forms. We conducted a three-wave, multi-source field study of 432 employees nested in 42 high-tech SMEs in Taiwan. At Time 1, employees reported self-referenced and other-referenced LMX; at Time 2, they reported constructive felt responsibility and perceived insider status; at Time 3, supervisors rated employees' expedient and proactive innovation. We define expedient innovation as short horizon, non accumulative innovation for immediate stabilization, rather than compliance, reactive problem fixing, or incremental or exploitative improvement. Using multilevel polynomial response surface analysis and Bayesian mediation, we show that LMX congruence is associated with expedient innovation through constructive felt responsibility, whereas directional incongruence in which self-referenced LMX exceeds other-referenced LMX is associated with proactive innovation through perceived insider status. By distinguishing congruence effects from directional incongruence, including self-high other low and self-low other high configurations, we help reconcile mixed findings in the LMX differentiation literature. Theoretically, these findings reframe LMX differentiation as an identity signaling process that explains variation in innovation form, and managerially, they suggest that calibrating relationship equalization versus differentiation can help leaders balance short-term operational stabilization with longer-term change initiation.

Automated biological laboratories are a growing accelerator of scientific research, enabling remote execution through advanced robotics and computational systems. Automation is deployed across a range of settings, including modular automation platforms, centralized biofoundries, and cloud laboratories. For the most highly automated of these, the defining characteristics include remote operation, limited human oversight, and integrated automation. These technologies might enable fully autonomous biological research, also referred to as "closed-loop" discovery or self-driving laboratories. They can also introduce new vulnerabilities that existing biosafety and biosecurity frameworks do not sufficiently address. We first map the current landscape of automated biological laboratories, define what distinguishes them from conventional laboratories, and argue that existing biosafety and biosecurity oversight fails to account for risks from the latent capabilities of these laboratories. We then analyze multiple threat vectors, including malicious orders, insider threats, and cyberattacks. Through these vectors, an actor may be able to compromise laboratory infrastructure and orchestrate pathogen synthesis or protein engineering, without the knowledge of laboratory operators. We propose the Automated Laboratory Security Tier (AST) framework to categorize facilities into three tiers based on the biosecurity risks they could pose if fully compromised. We use "fully compromised" to mean an attacker can control protocol execution and relevant information technology and operational technology (IT/OT) controls sufficiently to bypass all oversight and safeguards. We outline methods to improve customer verification, order screening, cybersecurity measures, insider threat protections, and independent security assessments. Although limited information regarding automated laboratory capabilities is publicly available, we argue that most current automated laboratories do not possess latent capacity for serious harms. These risks appear low for most current facilities, but laboratories outside the scope of our review may possess greater latent capability, and capabilities may advance faster than anticipated. Our analysis draws on expert interviews with automated laboratory operators and biosecurity experts. We recommend that researchers and industry stakeholders engage with standard-setting bodies to establish security standards for automated biological laboratories. With ongoing monitoring of capability levels and adoption of proportionate safeguards, these laboratories can be safely operated.

An unwritten expectation in our everyday social interactions is that intimate personal information about someone-"insider knowledge"-is usually confined within close relationships. For example, it would be odd, or even unsettling, if a stranger knew about your favorite movie. Such expectations about who knows what about whom constitute a cornerstone of complex social behavior, but much remains unknown about their cognitive underpinnings and developmental origins. Drawing on parental report (Study 1) as well as a novel experimental approach using controlled but naturalistic videochat conversations (Study 2 & 3), we find that 4- to 5-y-old children have an abstract, theory-like understanding of how social connections give rise to interpersonal knowledge. Self-report, facial expressions, and memory errors provide converging evidence that children were surprised when someone possessed insider knowledge that is misaligned with their relationships, such as a stranger knowing their favorite food (Study 2a) or their own parent knowing a stranger's favorite movie (Study 2b). Children also generated coherent ad-hoc explanations about how someone might have acquired that knowledge, appealing to either first-hand observations or second-hand sources (Study 3). These findings demonstrate an early-emerging understanding of how individual minds are shaped in the context of their social networks, supporting a precocious ability to detect and explain anomalies in what people know about each other in real-time conversations. The current work also opens possibilities for leveraging open-ended online interactions to study social cognition without compromising experimental control.

Background: Oncology and palliative care staff frequently encounter death yet often lack structured opportunities for reflection following these experiences.Objectives: This study asked: How can we develop and implement a reflective practice program for oncology and palliative care staff to support them with patient death? Reflective practice is recognized as a valuable tool to support staff well-being; however, there is limited literature describing how such interventions are implemented in the hospital setting.Methods: A participatory insider-action research approach was undertaken to codevelop a reflective practice program. A multidisciplinary Action Research Group collaborated through a series of meetings to codesign the program. The data consisted of contemporaneous notes capturing group discussions on what was needed to develop the program. Thematic analysis was used to identify key ideas and patterns that emerged from these discussions, enabling the group to identify factors required to develop a format to support guided reflection.Results: Key themes included the importance of language, timing and location, facilitation and structure, and case selection. The final outcome was a practical, semistructured format for reflective practice sessions for staff to follow as a framework to support reflection and emotional processing in response to patient death.Conclusions: Using an insider action research approach, this staff-led project offers an adaptable framework for structured reflection in acute hospital settings and represents an important initial step towards embedding reflective practice into the culture of health care.

Korean immigrant families face complex barriers to accessing services for their children with autism and developmental disabilities due to intersecting cultural, linguistic, and socioeconomic factors. However, there is limited information in the literature on strategies to close this gap. This tutorial reports on leveraging an academic-community partnership to establish and sustain a parent support group for Korean immigrant families of children with autism and other developmental disorders. Academic and community partners worked together to develop family-centered support. The partnership focused on iteratively tailoring support to a localized context to increase knowledge, self-efficacy, and community support for navigating service systems. The development of the parent support group progressed through three phases: (a) establishing two separate support groups led by a parent and a faculty member, (b) merging the groups and building capacity to empower families, and (c) supporting community partners in formalizing the group and securing grant funding for partner-driven initiatives. In all phases, academic partners contributed university resources, whereas community partners provided insider knowledge to create effective programming. This approach has resulted in a strong, ongoing academic-community partnership that has lasted for more than 2 decades and successfully engaged over 400 families. The lessons learned offer an example of how to reduce barriers to autism-related services by leveraging community strengths and fostering collaboration and by revisiting both the partnership and supports for families to more strongly address community priorities.

Developmental Coordination Disorder (DCD) is an under-recognised neurodevelopmental condition impacting 5-6% of the population. There is a growing evidence base showing the deleterious impacts of poor motor skill development, however there is a distinct lack of research gathering in-depth insights which explore the impact of DCD within both childhood and adulthood. Ten online lived experience interviews were undertaken with adults who have a diagnosis of DCD/ Dyspraxia (8 females, 2 males), lasting between 30 minutes and one hour. Participants were recruited both nationally and internationally. Lived experience interviews focused on experiences in primary care, education, friendships, wellbeing, employment and romantic relationships. Data were transcribed and analysed using inductive thematic analysis. Emergent themes highlighted a major lack of societal awareness in all life domains, which often led to participants facing difficulties navigating health, education and workplace systems for support, resulting in relative abandonment and a lack of validation within their lived experience of DCD. Individuals with DCD often report feeling alone, isolated and misunderstood in a world which presents challenges for them across all aspects of life. There is an urgent need for the profile of DCD to be raised by insider voices as for many, DCD often transcends diagnostic criteria to wider challenges, for example executive functioning. Fundamentally, more needs to be done to ensure a lifespan approach to DCD, to allow greater opportunities for adults with a diagnosis to thrive alongside their 'neurotypical' peers.

The advancement of airborne wireless sensor networks (AWSNs) in modern aircraft monitoring has introduced heightened risks to security isolation, particularly from insider threats. Namely, the bidirectional real-time data flows enable attackers to hijack vulnerable nodes as gateways to breach both aircraft control systems and airline operational domains, potentially leading to data exfiltration or system sabotage. To address the issue, more recently, a decentralized zero trust framework for AWSNs has been designed, which is centered on a certificateless aggregation signcryption (CLASC) scheme. Unfortunately, through a concrete security attack, we find that the underlying CLASC scheme is insecure against a public-key replacement attacker. In particular, an attacker can successfully forge a valid signature on any false message, thus destroying unforgeability, one of the most important security features a CLASC scheme must provide. Therefore, the existing design cannot achieve its goal. To tackle this problem, we design a security-enhanced CLASC scheme and prove its security under standard security assumptions. We also analyze its practical performance by comparing the computational and communication costs with several related works. By replacing the insecure CLASC scheme, we obtain a security-enhanced distributed zero trust framework for AWSNs.

How individuals negotiate marginalized identities within restrictive sociopolitical environments remains a critical question for understanding the dynamic relationship between culture and the self. This study investigates why and how Chinese professional translators engage with materials related to lesbian, gay, bisexual, transgender, queer, intersex, and other sexual and gender minorities (LGBTQI+) in a sociocultural context where queer identities are frequently marginalized or silenced. Conceptualizing translation as a process of cultural and identity negotiation, the study draws on semi-structured interviews with 23 professional translators who have experience translating queer-related literary, academic, or community materials. Thematic analysis identifies four translator positions that reflect different strategies of engagement with cultural constraints: visibility-seekers, who leverage sociocultural trends for professional or commercial gain; cautious negotiators, who adapt queer content to meet censorship and market norms; insider advocates, queer translators who use their lived experience to affirm cultural identity and empower their community; and allied activists, non-queer translators who engage in ethical solidarity and social justice through translation. These positions reveal how translators mobilize professional resources, personal experience, and ethical commitments while navigating political regulation, cultural stigma, and market expectations. The findings highlight translators as socially situated agents whose practices mediate the circulation of marginalized cultural meanings and demonstrate how identity and cultural expression are co-constructed within structures of ideological constraint.

Insider-originated breaches remain the predominant vector of data compromise in healthcare. Traditional role-based access control (RBAC) offers limited responsiveness to dynamic clinical workflows. This paper presents an adaptive access governance model integrating RBAC, attribute-based, and risk-based authorisation with continuous behavioural anomaly detection. Contextual factors including temporal patterns, device provenance, geolocation, and record sensitivity are incorporated into real-time access logic supported by dynamic risk scoring. Validation in simulated and operational environments demonstrates reduced inappropriate access events and enhanced alignment with GDPR, HIPAA, and ISO/IEC 27001.