Original title: A Bayesian Correlated Equilibrium for Early Insider-Threat Detection
Javed M. Shah, Ian A. Kash, Natalie Parde · September 2026
Insiders with system access can steal data before security teams notice. To solve this, researchers designed a dynamic game where a platform coordinates multiple reviewers called certifiers. A central system sends private, step-by-step instructions to users and certifiers, checking that everyone follows along. The design accounts for real human psychology, including loss aversionThe psychological tendency where losses feel more painful than equivalent gains are pleasurable. and present biasThe tendency to favor immediate rewards, leading people to act impulsively., which means people prefer quick payoffs over future consequences. This psychological setup helps the system catch attacks 1.7--4.5 days earlier than rational models. Testing on the CERT r6.2 dataset, the method detected up to 28.3% of threats before data was stolen, while keeping false alarms below 1.6%. Two standard baselines caught almost nothing before theft under comparable limits.
Imagine you are managing a group project where some members might try to steal ideas for their own benefit. It's hard to catch them in the act because they act subtly, and by the time you notice, the damage is done. In this paper, a system coordinates a committee to monitor users privately, issuing timed warnings to catch malicious actions before any data is exfiltrated, even when people might act on impulse or fear.
Companies and organizations face costly data breaches from insiders who steal information. Catching these threats earlier can prevent significant financial and reputational damage.
The abstract does not state specific limitations, but the system is evaluated only on the CERT r6.2 dataset, so its performance in real-world, diverse environments is not established.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
A Bayesian Correlated Equilibrium for Early Insider-Threat Detection — Javed M. Shah, Ian A. Kash, Natalie Parde
Abstract licence: CC0
Explanation generated by Synthesis from the abstract — it is not the original paper. This is a preprint, so it hasn't necessarily been peer reviewed.