Anomaly Detection At Multiple Scales (ADAMS)

The recent disclosure of sensitive and classified government documents through WikiLeaks demonstrates a new systemic threat, exfiltration and broad global broadcast of government confidential data and information. We propose to develop techniques and mechanisms for identifying likely malicious insiders within an organization by leveraging automatically generated misinformation and modern system and network monitoring technologies such as Data Leakage Prevention (DLP). The proposed scheme focuses on and exploits what malicious insiders seek (illicitly acquired information), as opposed to incidental signs of misbehavior, providing a robust alternative and a good complement to such mechanisms. We propose to develop a baseline system that will demonstrate the feasibility of identifying specific types of insiders by developing a prototype for automatically generating and distributing believable misinformation based on administrator-defined templates, and then tracking access and attempted misuse of it. The technology to be commercialized has been licensed and transferred from Columbia University. The proposed prototype will integrate the deception technology and host sensors with open source Data Leak Prevention technology to demonstrate the essential functions and core features of a product suitable for government customers to mitigate the insider threat and thwart the exfiltration of sensitive government information.