Published Paper Details:

Insider threats present a significant cybersecurity challenge due to the legitimate access insiders have to an organization's systems and data, making detection and mitigation particularly complex. Traditional security measures often fail to identify these threats, resulting in considerable damage such as data breaches, intellectual property theft, financial losses, and reputational harm. This paper investigates the use of graph theory for detecting insider threat attacks by analysing the relationships and interactions among various organizational entities. By representing users, devices, and files as nodes, and interactions like access events and communications as edges, we utilize advanced graph-theoretical algorithms to identify anomalous patterns that indicate insider threats. Graph-based approaches offer several benefits, including the visualization of intricate interactions, detection of subtle anomalies, and integration of diverse data sources for a comprehensive organizational overview. We propose a comprehensive system leveraging graph-based analysis, encompassing data collection, graph construction, anomaly detection, and response mechanisms. The system's effectiveness is assessed using a dataset of simulated insider threat scenarios, showcasing its potential to enhance insider threat detection capabilities.