搜索结果：insider

An insider is defined as a team member who covertly deviates from the team's optimal collaborative control strategy in pursuit of a private objective, while maintaining an outward appearance of cooperation. Such insider threats can severely undermine cooperative systems: subtle deviations may degrade collective performance, jeopardize mission success, and compromise operational safety. This paper presents a comprehensive framework for identifying and mitigating insider threats in cooperative control settings. We introduce an insider-aware, game-theoretic formulation in which the insider's hidden intention is parameterized, allowing the threat identification task to be reformulated as a parameter estimation problem. To address this challenge, we employ an online indirect dual adaptive control approach that simultaneously infers the insider's control strategy and counteracts its negative influence. By injecting properly designed probing signals, the resulting mitigation policy asymptotically recovers the nominal optimal control law - one that would be achieved under full knowledge of the insider's objective. Simulation results validate the effectiveness of the proposed identification

This paper studies a Kyle-Back model with a risk-averse insider possessing exponential utility and a dynamic stochastic signal about the asset's terminal fundamental value. While the existing literature considers either risk-neutral insiders with dynamic signals or risk-averse insiders with static signals, we establish equilibrium when both features are present. Our approach imposes no restrictions on the magnitude of the risk aversion parameter, extending beyond previous work that requires sufficiently small risk aversion. We employ a weak conditioning methodology to construct a Schrödinger bridge between the insider's signal and the asset price process, an approach that naturally accommodates stochastic signal evolution and removes risk aversion constraints. We derive necessary conditions for equilibrium, showing that the optimal insider strategy must be continuous with bounded variation. Under these conditions, we characterize the market-maker pricing rule and insider strategy that achieve equilibrium. We obtain explicit closed-form solutions for important cases including deterministic and quadratic signal volatilities, demonstrating the tractability of our framework.

Although the automation and digitisation of anti-financial crime investigation has made significant progress in recent years, detecting insider trading remains a unique challenge, partly due to the limited availability of labelled data. To address this challenge, we propose using a data-driven networks approach that flags groups of corporate insiders who report coordinated transactions that are indicative of insider trading. Specifically, we leverage data on 2.9 million trades reported to the U.S. Securities and Exchange Commission (SEC) by company insiders (C-suite executives, board members and major shareholders) between 2014 and 2024. Our proposed algorithm constructs weighted edges between insiders based on the temporal similarity of their trades over the 10-year timeframe. Within this network we then uncover trends that indicate insider trading by focusing on central nodes and anomalous subgraphs. To highlight the validity of our approach we evaluate our findings with reference to two null models, generated by running our algorithm on synthetic empirically calibrated and shuffled datasets. The results indicate that our approach can be used to detect pairs or clusters of inside

The present paper investigates how insiders strategically navigate ongoing legal risk while leveraging stealth trading within a continuous-time Kyle-type framework. Legal enforcement operates concurrently with trading, which dynamic can be adversely obscured by a large surrounding population of noise traders. While surveillance intensity responds directly to the insider's trading intensity, triggering a random prosecution time, the resulting legal sanctions encompass both strategy-focused criminal penalties and profit-dependent civil penalties. Employing a new impact-neutral measure change, equilibrium analysis shows that even after achieving stealth, the insider internalizes regulatory exposure, and enforcement can significantly shape equilibrium trading strategies. The associated limiting equilibria yield a rich set of outcomes, with three key insights for regulatory impact: (i) under committed regulatory scrutiny, the insider trades a time-varying function of the discrepancy between the asset's fundamental value and its market price, and trading may intensify indefinitely near the end of the trading horizon as legal risk recedes; (ii) merely raising penalties as an advantageous

Insider threats are a growing organizational problem due to the complexity of identifying their technical and behavioral elements. A large research body is dedicated to the study of insider threats from technological, psychological, and educational perspectives. However, research in this domain has been generally dependent on datasets that are static and limited access which restricts the development of adaptive detection models. This study introduces a novel, ethically grounded approach that uses the large language model (LLM) Claude Sonnet 3.7 to dynamically synthesize syslog messages, some of which contain indicators of insider threat scenarios. The messages reflect real-world data distributions by being highly imbalanced (1% insider threats). The syslogs were analyzed for insider threats by both Sonnet 3.7 and GPT-4o, with their performance evaluated through statistical metrics including accuracy, precision, recall, F1, specificity, FAR, MCC, and ROC AUC. Sonnet 3.7 consistently outperformed GPT-4o across nearly all metrics, particularly in reducing false alarms and improving detection accuracy. The results show strong promise for the use of LLMs in synthetic dataset generation

In this policy memorandum, we explain why deployers of AI models in high-stakes contexts should treat those AI models as insider risk vectors. High-stakes contexts include AI model deployment within government agencies and contractors, where AI models are privileged with access to, among others, classified and sensitive unclassified information, IL6 and IL7 network environments, cleared personnel, and other critical resources. AI models are increasingly embedded in high-stakes contexts and capable of leveraging their authorized access and permissions to execute misaligned actions that could damage national security, such as whistleblowing, sabotaging, or blackmailing. This combination of (1) privileged access to critical resources and (2) an increased ability to act autonomously and against the desire of their organization makes the potential insider risk posed by AI models functionally indistinguishable from that posed by their human counterparts. As a consequence, AI models deployed in high-stakes contexts could lead to intentional or unintentional loss or degradation of government or contractor information, resources, or capabilities via the unauthorized disclosure of informatio

We consider a Kyle-type model where insider trading takes place among a potentially large population of liquidity traders and is subject to legal penalties. Insiders exploit the liquidity provided by the trading masses to "camouflage" their actions and balance expected wealth with the necessary stealth to avoid detection. Under a diverse spectrum of prosecution schemes, we establish the existence of equilibria for arbitrary population sizes and a unique limiting equilibrium. A convergence analysis determines the scale of insider trading by a stealth index $γ$, revealing that the equilibrium can be closely approximated by a simple limit due to diminished price informativeness. Empirical aspects are derived from two calibration experiments using non-overlapping data sets spanning from 1980 to 2018, which underline the indispensable role of a large population in insider trading models with legal risk, along with important implications for the incidence of stealth trading and the deterrent effect of legal enforcement.

Over the years, the technological landscape has evolved, reshaping the security posture of organisations and increasing their exposure to cybersecurity threats, many originating from within. Insider threats remain a major challenge, particularly in sectors where cybersecurity infrastructure, expertise, and regulations are still developing. This study proposes the Insider Threat Explainable Machine Learning (IT-XML) framework, which integrates the Cross-Industry Standard Process for Data Mining (CRISP-DM) with Hidden Markov Models (HMM) to enhance proactive insider threat management and decision-making. A quantitative approach is adopted using an online questionnaire to assess employees' knowledge of insider threat patterns, access control, privacy practices, and existing policies across three large data-sensitive organisations. The IT-XML framework provides assessment capabilities through survey-based data, HMM-driven pattern recognition for security maturity classification, and evidence-based recommendations for proactive threat mitigation. The framework classified all organisations at the developing security maturity level with 97-98% confidence and achieved a classification accu

Insider threats pose a persistent and critical security risk, yet are notoriously difficult to detect in complex enterprise environments, where malicious actions are often hidden within seemingly benign user behaviors. Although machine-learning-based insider threat detection (ITD) methods have shown promise, their effectiveness is fundamentally limited by the scarcity of high-quality and realistic training data. Enterprise internal data is highly sensitive and rarely accessible, while existing public and synthetic datasets are either small-scale or lack sufficient realism, semantic richness, and behavioral diversity. To address this challenge, we propose Chimera, an LLM-based multi-agent framework that automatically simulates both benign and malicious insider activities and generates comprehensive system logs across diverse enterprise environments. Chimera models each agent as an individual employee with fine-grained roles and supports group meetings, pairwise interactions, and self-organized scheduling to capture realistic organizational dynamics. Based on 15 insider attacks abstracted from real-world incidents, we deploy Chimera in three representative data-sensitive organization

Conventional security solutions are insufficient to address the urgent cybersecurity challenge posed by insider attacks. While a great deal of research has been done in this area, our systematic literature analysis attempts to give readers a thorough grasp of penetration testing's role in reducing insider risks. We aim to arrange and integrate the body of knowledge on insider threat prevention by using a grounded theory approach for a thorough literature review. This analysis classifies and evaluates the approaches used in penetration testing today, including how well they uncover and mitigate insider threats and how well they work in tandem with other security procedures. Additionally, we look at how penetration testing is used in different industries, present case studies with real-world implementations, and discuss the obstacles and constraints that businesses must overcome. This study aims to improve the knowledge of penetration testing as a critical part of insider threat defense, helping to create more comprehensive and successful security policies.

Timely disclosure of insider transactions is a cornerstone of market transparency, yet delays in filing remain widespread and challenging to monitor at scale. This study introduces a comprehensive insider filing delay dataset spanning more than four million Form 4 transactions from 2002 to 2025, enriched with annotations on insider roles, governance attributes, and firm-level indicators. Building on these data, we present a hybrid framework that integrates a state-space encoder with an XGBoost classifier to capture temporal trading patterns while retaining interpretability essential for regulatory auditing. The framework consistently outperforms statistical models, deep sequence learners, and large language model baselines, achieving balanced gains in precision, recall, and F1-score. Feature ablation analyses highlight the predictive importance of insider history, spatiotemporal factors, and governance signals, shedding light on the behavioral drivers of both minor oversights and systematic violations. Beyond accuracy, the dataset and framework establish a reproducible benchmark for studying disclosure compliance, offering regulators and researchers transparent tools to strengthen

Insider threats wield an outsized influence on organizations, disproportionate to their small numbers. This is due to the internal access insiders have to systems, information, and infrastructure. %One example of this influence is where anonymous respondents submit web-based job search site reviews, an insider threat risk to organizations. Signals for such risks may be found in anonymous submissions to public web-based job search site reviews. This research studies the potential for large language models (LLMs) to analyze and detect insider threat sentiment within job site reviews. Addressing ethical data collection concerns, this research utilizes synthetic data generation using LLMs alongside existing job review datasets. A comparative analysis of sentiment scores generated by LLMs is benchmarked against expert human scoring. Findings reveal that LLMs demonstrate alignment with human evaluations in most cases, thus effectively identifying nuanced indicators of threat sentiment. The performance is lower on human-generated data than synthetic data, suggesting areas for improvement in evaluating real-world data. Text diversity analysis found differences between human-generated and L

According to The Exchange Act, 1934 unlawful insider trading is the abuse of access to privileged corporate information. While a blurred line between "routine" the "opportunistic" insider trading exists, detection of strategies that insiders mold to maneuver fair market prices to their advantage is an uphill battle for hand-engineered approaches. In the context of detailed high-dimensional financial and trade data that are structurally built by multiple covariates, in this study, we explore, implement and provide detailed comparison to the existing study (Deng et al. (2019)) and independently implement automated end-to-end state-of-art methods by integrating principal component analysis to the random forest (PCA-RF) followed by a standalone random forest (RF) with 320 and 3984 randomly selected, semi-manually labeled and normalized transactions from multiple industry. The settings successfully uncover latent structures and detect unlawful insider trading. Among the multiple scenarios, our best-performing model accurately classified 96.43 percent of transactions. Among all transactions the models find 95.47 lawful as lawful and $98.00$ unlawful as unlawful percent. Besides, the mode

In this paper, we propose a game-theoretical framework to investigate advanced persistent threat problems with two types of insider threats: malicious and inadvertent. Within this framework, a unified three-player game is established and Nash equilibria are obtained in response to different insiders. By analyzing Nash equilibria, we provide quantitative solutions to the advanced persistent threat problems with insider threats. Furthermore, optimal defense strategy and defender's cost comparisons between two insider threats have been performed. The findings suggest that the defender should employ more active defense strategies against inadvertent insider threats than against malicious insider threats, despite the fact that malicious insider threats cost the defender more. Our theoretical analysis is validated by numerical results, including an additional examination of the conditions of the risky strategies adopted by different insiders. This may help the defender in determining monitoring intensities and defensive strategies.

Insider Threat is a significant and potentially dangerous security issue in corporate settings. It is difficult to mitigate because, unlike external threats, insiders have knowledge of an organization's access policies, access hierarchy, access protocols, and access scheduling. Several approaches to reducing insider threat have been proposed in the literature. However, the integration of access control and moving target defense (MTD) for deceiving insiders has not been adequately discussed. In this paper, we combine MTD, deception, and attribute-based access control to make it more difficult and expensive for an insider to gain unauthorized access. We introduce the concept of correlated attributes into ABAC and extend the ABAC model with MTD by generating mutated policy using the correlated attributes for insider threat mitigation. The evaluation results show that the proposed framework can effectively identify correlated attributes and produce adequate mutated policy without affecting the usability of the access control systems.

We present a new discrete time version of Kyle's (1985) classic model of insider trading, formulated as a generalised extensive form game. The model has three kinds of traders: an insider, random noise traders, and a market maker. The insider aims to exploit her informational advantage and maximise expected profits while the market maker observes the total order flow and sets prices accordingly. First, we show how the multi-period model with finitely many pure strategies can be reduced to a (static) social system in the sense of Debreu (1952) and prove the existence of a sequential Kyle equilibrium, following Kreps and Wilson (1982). This works for any probability distribution with finite support of the noise trader's demand and the true value, and for any finite information flow of the insider. In contrast to Kyle (1985) with normal distributions, equilibria exist in general only in mixed strategies and not in pure strategies. In the single-period model we establish bounds for the insider's strategy in equilibrium. Finally, we prove the existence of an equilibrium for the game with a continuum of actions, by considering an approximating sequence of games with finitely many actions

Kyle (1985) builds a pioneering and influential model, in which an insider with long-lived private information submits an optimal order in each period given the market maker's pricing rule. An inconsistency exists to some extent in the sense that the ``constant pricing rule " actually assumes an adaptive expected price with pricing rule given before insider making the decision, and the ``market efficiency" condition, however, assumes a rational expected price and implies that the pricing rule can be influenced by insider's strategy. We loosen the ``constant pricing rule " assumption by taking into account sufficiently the insider's strategy has on pricing rule. According to the characteristic of the conditional expectation of the informed profits, three different models vary with insider's attitudes regarding to risk are presented. Compared to Kyle (1985), the risk-averse insider in Model 1 can obtain larger guaranteed profits, the risk-neutral insider in Model 2 can obtain a larger ex ante expectation of total profits across all periods and the risk-seeking insider in Model 3 can obtain larger risky profits. Moreover, the limit behaviors of the three models when trading frequency

Insider threats refer to threats originating from people inside organizations. Although such threats are a classical research topic, the systematization of existing knowledge is still limited particularly with respect to non-technical research approaches. To this end, this paper presents a systematic literature review on the psychology of insider threats. According to the review results, the literature has operated with multiple distinct theories but there is still a lack of robust theorization with respect to psychology. The literature has also considered characteristics of a person, his or her personal situation, and other more or less objective facts about the person. These are seen to correlate with psychological concepts such as personality traits and psychological states of a person. In addition, the review discusses gaps and limitations in the existing research, thus opening the door for further psychology research.

Insider threats is the most concerned cybersecurity problem which is poorly addressed by widely used security solutions. Despite the fact that there have been several scientific publications in this area, but from our innovative study classification and structural taxonomy proposals, we argue to provide the more information about insider threats and defense measures used to counter them. While adopting the current grounded theory method for a thorough literature evaluation, our categorization's goal is to organize knowledge in insider threat research. Along with an analysis of major recent studies on detecting insider threats, the major goal of the study is to develop a classification of current types of insiders, levels of access, motivations behind it, insider profiling, security properties, and methods they use to attack. This includes use of machine learning algorithm, behavior analysis, methods of detection and evaluation. Moreover, actual incidents related to insider attacks have also been analyzed.