Rapid Prototyping Insider Threat Inference Enterprise Model Workflows Using Ontology-Template Approach

Abstract

An approach is proposed to assist modelers in developing models of insider threat inference enterprises. A key challenge in inference enterprise modeling (IEM) is addressing complexities such as vast quantities of data and low probability of occurrence of an insider threat. These complexities make development of a modeling workflow a difficult and time-consuming task. The ontology-template-based modeling approach described in this paper is applied to specific examples of insider threat detection problems. This approach assists modelers so that they can quickly create new models for new inference enterprise scenarios, thus improving the efficiency of building inference enterprise models. Efficiency improvements provide opportunities to enhance the performance of insider threat inference enterprises. The paper describes theoretical concepts and presents an example of building an IEM workflow using the proposed approach.