Source-linked AI summary
A Bayesian Correlated Equilibrium for Early Insider-Threat Detection
Javed M. Shah, Ian A. Kash, Natalie Parde
TL;DR
Insider-risk models often assume rational actors, while insider behavior can reflect present bias and loss aversion. The paper uses BTCE to coordinate certifiers and model behavioral dynamics. On CERT r6.2, it reports useful pre-exfiltration coverage for BTCE where the compared methods provide little early warning.
Problem
Insider-risk models commonly treat malicious users as rational expected-utility maximizers, although decision makers can show present bias and loss aversion relevant to insider scenarios.
Source: §1 · pp. 1–2Method
Results
At θ = 0.75, median BTCE achieves Pre-Exfil 28.3% at f = 3 and 17.5% at f = 9, with UFP 1.54% and 1.58%, respectively.
Source: §7 · p. 16Takeaways & Limitations
The guarantees cover current-self obedience under behavioral biases, bounded-expected-time intervention under positive evidence drift, and honest-range aggregation when fewer than half of certifiers are compromised.
Source: §1 · p. 3The early-detection guarantee assumes a positive drift floor; a patient adversary can stay within benign noise and drive that floor toward zero, at the cost of exfiltration throughput.
Source: §8 · p. 18
Abstract
from arXiv · showhide
We model insider threat detection as a dynamic Bayesian game in which a platform coordinates a committee of strategic certifiers to sustain equilibrium among honest users and detect malicious deviations before exfiltration. Certifiers and users operate under a Bayesian Temporal Correlated Equilibrium (BTCE), where a sealed-envelope correlating device issues private recommendations over time and obedience is verified at every on-path information state. Unlike Stackelberg formulations, BTCE coordinates heterogeneous certifiers without requiring commitment power. We incorporate present bias and loss aversion to capture impulsive escalation dynamics, enabling 1.7--4.5 days earlier detection than rational baselines. We prove three guarantees: (1) calibrated intervention losses make recommended behavior a current-self best response despite behavioral biases, (2) controlled evidence accumulation guarantees intervention in bounded expected time before exfiltration, and (3) median aggregation confines implemented actions to the honest recommendation range when fewer than half of certifiers are Byzantine. On CERT r6.2 our mechanism achieves up to 28.3% pre-exfiltration detection with false positives below 1.6%, while both a transformer baseline and a streaming provenance approximation (HOLMESLite) achieve near-zero pre-exfiltration detection under comparable constraints.
1 Introduction
The introduction frames insider detection as a dynamic problem that rational-actor models may miss when users exhibit present bias and loss aversion. It proposes BTCE to coordinate certifiers and support early intervention.
1 Introduction
- Traditional insider-risk models treat malicious users as rational expected-utility maximizers with exponential discounting, despite evidence of systematic behavioral deviations.The paper highlights present bias, time inconsistency, reference dependence, and loss aversion as relevant to insider scenarios.Source: §1 · pp. 1–2
- BTCE models the platform, users, and certifier committee as a dynamic multiagent interaction, with interventions ordered from monitoring to access suspension.Certifiers condition on public history and local posteriors, while the platform aggregates their recommendations.Source: §1 · p. 2
- The Tesla–Tripp episode illustrates how a precipitating event and coordinated actions can escape static systems when valid access makes activity look like technician work.The proposed model uses the reassignment event to update behavioral state and score subsequent activity as a coordinated sequence.Source: §1 · p. 2
- The paper introduces BTCE for history-dependent certifier recommendations, platform aggregation, and user responses, with an on-path one-shot obedience check.Its stated guarantees cover current-self best responses under behavioral biases, bounded-time early detection, and median aggregation when fewer than half of certifiers are compromised.Source: §1 · pp. 2–3
2 Related Work
The related-work discussion positions BTCE between commitment-based game models, detection systems, and provenance methods. Its focus is coordinated control-plane misuse with behavioral dynamics and certifier coordination.
2 Related Work
- Prior security games emphasize Stackelberg or Bayesian models with defender commitment, while repeated private-monitoring games do not combine causal signals, behavioral bias, and loyalty-type evolution.BTCE uses correlated equilibrium to coordinate heterogeneous certifiers without commitment power.Source: §2 · p. 3
- Machine-learning detectors may achieve user-level detection but struggle on timing-sensitive early-warning metrics; BTCE places a DBN-inspired evidence layer inside a game-theoretic mechanism.The cited approaches include Isolation Forest, LSTMs, and Transformer-UBS.Source: §2 · p. 3
- Unlike host-level provenance reconstruction, BTCE targets enterprise control planes where misuse can unfold across users and devices without one host-level execution chain.The paper benchmarks against a streaming approximation, HOLMESLite, rather than treating provenance reconstruction as the main task.Source: §2 · p. 3
- BTCE is framed as an auditable coordination layer for existing enterprise systems, not as their replacement.Source: §2 · p. 3
3 Bayesian Game Design
The game design connects telemetry-derived evidence to certifier recommendations and a platform-implemented intervention. Its signal model uses dependencies across channels to distinguish coordinated sequences from isolated anomalies.
3 Bayesian Game Design
- A committee of certifiers maintains beliefs about each user's latent loyalty state, while users also have latent behavioral states that affect play.The model includes a finite horizon, a user population, certifiers, actions, signals, and state-transition structure.Source: §3 · p. 4
- The platform observes telemetry and prior implemented outcomes; certifiers recommend interventions after signals, and the platform aggregates recommendations into one action.Users then respond to the intervention environment and their present bias.Source: §3 · p. 4
- The telemetry model uses a kill-chain dependency graph over logon, LDAP, device, file, email, and HTTP channels, including dependencies from logon to file and device and from file to email and HTTP.Source: §3 · p. 5
- DBN filtering feeds certifier policies and the temporal correlating device, with channel context raising the likelihood assigned to coordinated access–collection–exfiltration sequences over isolated negligent anomalies.File and device anomalies are interpreted in logon context, while exfiltration channels are interpreted in the context of prior file aggregation.Source: §3 · p. 5
4 Behavioral Utility, Type Evolution and Belief System
The section specifies behavioral utility, user-state evolution, and Bayesian belief updates that support the paper's obedience and detection analysis. Together, these components represent psychological dynamics and telemetry-driven beliefs.
4 Behavioral Utility, Type Evolution and Belief System
- The behavioral utility combines reference dependence and loss-domain risk-taking with quasi-hyperbolic evaluation that gives the current self greater weight on present rewards than future sanctions.The behavioral state includes a reference point and a present-bias parameter.Source: §4 · pp. 6–7
4.1 Type Evolution
- Loyalty types evolve with strategic behavior and organizational feedback, while sustained adverse interventions raise the behavioral reference point and stress sharpens present bias.The type kernel allows toxic access to move users from disgruntled to malicious, probing to move loyal users to disgruntled, and honest behavior to stabilize type.Source: §4.1 · p. 7
4.2 Bayesian Belief System
- A controlled Bayesian filter uses the signal model and state-transition kernels to form a posterior over latent user state, whose loyalty marginal drives threshold policies and BTCE obedience constraints.The per-user, per-period update is stated to cost O(|Θuser||B||Au|K), with K = 6 channels.Source: §4.2 · pp. 7–8
5 Bayesian–Temporal Correlated Equilibrium
BTCE coordinates users and heterogeneous certifiers through history-dependent private recommendations, with obedience checked locally at on-path information states. Under stated risk–reward and continuation conditions, calibrated sanctions can make recommendations current-self best responses, while positive evidence drift supports finite expected-time intervention before exfiltration.
5 Bayesian–Temporal Correlated Equilibrium
- A sealed-envelope device samples a contingent recommendation plan ex ante and privately reveals the relevant recommendation as history unfolds.Recommendations are revealed sequentially within each period: to the user first, then to certifiers after the public signal.Source: §5 · pp. 8–10
5.1 Temporal Obedience and Current-Self Best Response
- BTCE obedience rules out profitable one-shot deviations by users and certifiers at every on-path information state.Source: §5.1 · p. 11
- For sanctions in a nonempty interval, the recommendation is a current-self best response when conditions (A)–(C) hold.Condition (C) requires the reward-per-unit-risk forfeited by caution to exceed that gained by aggression by at least the continuation slack ΔV.Source: §5.1 · p. 11
- The sanction interval is local to a fixed on-path continuation; using it as a design range requires ΔV to remain uniform across that range.Source: §5.1 · p. 11
- Under positive per-period log-likelihood-ratio drift, evidence accumulation triggers intervention in finite expected time before exfiltration.Source: §5.1 · p. 12
6 Early Detection Mechanism
The mechanism maps system beliefs or calibrated threat scores to tiered interventions and accumulates evidence toward an intervention threshold. Positive malicious evidence drift bounds expected threshold-crossing time, while committee aggregation and post-intervention exclusion shape the response.
6 Early Detection Mechanism
- The operational policy maps system belief or calibrated Insider Threat Score to decisions, while the updated joint posterior drives sanctions and evidence accumulation.The Insider Threat Score is a weighted signal combination calibrated from historical telemetry to select thresholds corresponding to desired posterior risk levels.Source: §6 · p. 12
6.1 Tiered intervention and evidence drift
- Low-risk users receive NoAct, isolated mid-risk anomalies receive Monitor, coordinated mid-risk cases use median aggregation, and high-risk cases use the fail-safe max rule.The intervention space orders actions from NoAct through Monitor and Escalate to SuspendAccess.Source: §6.1 · pp. 12–13
- Positive pre-intervention evidence drift bounded below by λmin, with increments bounded by ℓmax, bounds expected threshold-crossing time by ∆t⋆ + ℓmax/λmin.The bound applies when the initial log-odds are below the threshold and malicious behavior generates the stipulated drift.Source: §6.1 · p. 14
- After a malicious user’s evidence crosses the intervention region, SuspendAccess makes that user inactive from the next period and restricts the continuation game to the remaining active users.The suspended user’s continuation value is normalized to zero.Source: §6.1 · p. 14
- Correlated access–collection–exfil signals make malicious trajectories more likely under the attack model, so behavioral escalation crosses the threshold earlier than the rational ablation.The stated mechanism links positive evidence drift to finite expected time to intervention, potentially before data loss.Source: §6.1 · pp. 13–14
- With fewer than half of certifiers Byzantine, Proposition 2 identifies the median rule as robust; anchor-clip instead guarantees posterior-anchor containment, not an honest-range guarantee over actions.The anchor-clip ablation is presented separately from the certified median rule.Source: §6.1 · pp. 14–15
7 Results and Discussion
On CERT r6.2, BTCE provides useful pre-exfiltration coverage at loose-to-moderate thresholds, where the compared baselines provide little early warning. Threshold choice trades timing-sensitive detection against user-level capture.
Behavioral vs. rational
- Removing present bias delays detection at every threshold and Byzantine mix, while behavioral BTCE has lower MTTD than rational BTCE throughout.Table 2 compares behavioral and rational BTCE early-warning timing under median aggregation over 10 runs.Source: Table 2 · p. 16, §7 · p. 16
Robustness to concept drift
- When f < m/2, median aggregation keeps the implemented action within the honest recommendation range.The anchor-clip variant satisfies posterior-anchor containment, keeping the aggregate score within the stated anchor interval.Source: §7 · p. 16
Early detection with bounded user-level false alarms
- At θ = 0.75, median BTCE reaches Pre-Exfil 28.3% at f = 3 and 17.5% at f = 9, with UFP 1.54% and 1.58%, respectively.Transformer-UBS misses every malicious user at f = 3 and 95% at f = 9; HOLMES-Lite alerts average within 0.08 days of exfiltration.Source: §7 · p. 16
- Looser thresholds improve Pre-Exfil and MTTD, conservative thresholds increase UserEver-F1, and intermediate thresholds maximize Period-F1.At θ = 0.90, all methods lose meaningful pre-exfiltration coverage.Source: §7 · p. 16, Figure 2 · p. 17
Equilibrium compliance via one-period regret
- On-path audits show target regret rising during the exfiltration window and declining after intervention, while non-target regret remains stable in no-drift runs.The audit estimates W through Monte Carlo rollouts of an obedient baseline against a one-period deviation.Source: §7 · p. 17
Robustness to concept drift
- Under benign covariate shift, MTTD remains bounded across drift start times, but UFP grows with longer exposure to the shifted regime.Non-target excess regret shifts by at most 1.3% of peak no-drift regret; target excess regret dips to roughly −41% mid-window and contracts to under −10% by day 29.Source: §7 · pp. 16–17
8 Conclusion
BTCE reports earlier pre-exfiltration detection than rational and predictive baselines, while its drift results show bounded MTTD with a false-positive cost and its detection guarantee depends on positive evidence drift.
8 Conclusion
- 28.3% pre-exfiltration detection at 1.54% UFP is the reported peak result.The result is reported for BTCE.Source: §8 · p. 17
- 1.7–4.5 days earlier than a rational ablation, BTCE detects threats while transformer and streaming provenance baselines have near-zero pre-exfiltration coverage under identical constraints.Source: §8 · p. 17
- Calibrated present-bias sanctions sustain current-self obedience and bound expected detection time before exfiltration; median aggregation preserves 17.5% pre-exfiltration coverage under nine Byzantine certifiers.Source: §8 · p. 18
- Under covariate shift, the mechanism reenters a reduced post-intervention equilibrium with MTTD bounded across drift starts, while earlier drift widens the false-positive budget.Figure 3 varies drift start time and reports regret restoration, MTTD, and user false positives.Source: §8 · p. 18, Figure 3 · p. 18
- The detection guarantee assumes a positive drift floor λmin > 0; a patient adversary can lower it by staying within benign noise, at an exfiltration-throughput cost.Source: §8 · p. 18
A Type Evolution Dynamics
The section specifies how adverse interventions and stress update users’ reference points and present bias, with behavioral states represented on finite grids.
A Type Evolution Dynamics
- The reference-point update uses a neutral baseline of 0, with λr ∈ [0, 1], κr ≥ 0, and an indicator for adverse interventions.Source: A Type Evolution Dynamics · p. 19
- Reference-point and present-bias updates use stochastic rounding to adjacent grid points; a deterministic specialization applies F and rounds to the grid.Source: A Type Evolution Dynamics · p. 19
- Without adverse decisions, the reference point decays toward 0; persistent adverse outcomes raise it toward κr, deepening the loss domain and risk-seeking response.Source: A Type Evolution Dynamics · p. 19
- Present-bias dynamics distinguish ψimpulsive < ψstable, set a stress threshold γstress, and infer the stress proxy ωt from the public signal.Source: A Type Evolution Dynamics · p. 19