An approach to internal threats detection based on sentiment analysis and network analysis
Xueyuan Wen,Kaiyan Dai,Qi Xiong,Lili Chen,Jian Zhang,Zhen Wang
DOI: https://doi.org/10.1016/j.jisa.2023.103557
IF: 4.96
2023-08-19
Journal of Information Security and Applications
Abstract:Years into the insider threat, it remains an universal challenge to predict and defend. Concerning this problem, there has been a multitude of solutions, including the detection of sentiment fluctuations of an entity to predict its abnormality degree. Previous research solely focus on the analysis of individual anomalies, but ignore the sociality of individual sentiments. Therefore, in this paper, we propose an approach to internal threats detection based on sentiment and network analysis. Above all, we use Natural Language ToolKit (NLTK) to analyze the sentiment of each preprocessed email, and thus we establish sentiment communication network. The graphs are reconstructed into series and reshaped as matrices. By the singular value decomposition (SVD), the matrix is decomposed into base networks, and we analyze the change in importance of important base networks over time to detect the company's internal conditions. When anomalies occur, we establish combination networks which consist of base networks and can represent the abnormal character patterns of this time. Then compare the eigenvector centrality of both combination networks and total network to identify the employees related to this anomaly. The experiment shows that it can locate the anomaly-related employees accurately, and according to the network graph, the top few of anomaly-related employees are associated in group internal threats. Our approach provides the anomaly-related rank of employees and the abnormal character pattern of the sentiment communication network at the moment of anomaly.
computer science, information systems