PAUP: a pre-awareness insider threat detection method based on user psychoanalysis

Internal personnel within an organization often have privileged access to critical systems and sensitive information. They are familiar with the internal network structure, business processes, and security measures, which can lead to insider threats that are more insidious, long-term, destructive and diverse, posing a serious threat to enterprises and organizations. However, existing models for detecting insider threats primarily focus on modeling user behavior information but seldom take into account the valuable information from the psychological personality of insider personnel for threat detection. To address this limitation and better analyze the impact of user attributes on insider threats, a new direction for insider threat user analysis is proposed. This involves analyzing and visualizing the relationship between users' personalities and the execution of insider threat behaviors, using data analysis. Additionally, a decision tree model is constructed to realize insider threat detection based on user psychology, using feature_importance, a relative importance metric of features generated in the decision tree decision-making process, to judge the importance of different personality traits for insider threat detection. To further enhance the detection process, an insider threat user clustering method based on Fuzzy C-Means clustering is realized, and the groups are divided according to the user's psychological assessment scores to realize the early perceived localization of risky users. These approaches provide new ideas for finding new research directions in the field of insider threat.