GUARD (Generating Unified Assessment of Risk with Dashboard and Drilldown)

Any organization, from a small business to a national government agency, is vulnerable to insider threats. According to the National Insider Threat Task Force (NITTF), incidents of insider threats are steadily increasing and ōaccount for billions of dollars annually in æactualÆ and æpotentialÆ lost revenueö. Any individual entrusted with privileged information that could damage the organization represents a potential risk. Identifying individuals that present high levels of risk to the organization is vital for preventing threats, both malicious and unintentional, that could cause considerable damage and disruption to an organization. The proposed solution ¢ called GUARD (Generating Unified Assessment of Risk with Dashboard and Drilldown) ¢ will be designed to be integrated into the Insider Threat Program Maturity Framework to assist C-InT personnel by 1) identifying pertinent information about Possible Threat Actors (PTAs), 2) developing an overall rating of their potential threat risk, and 3) displaying a summary of the risk levels and supporting data, such that the information can be quickly digested and acted upon. We believe the combination of a suite of Machine Learning (ML) algorithms trained for PTA risk assessment, explainable AI (XAI) techniques to elucidate the black-box nature of the ML algorithms, and a variety of visualization tools that display the risk scores and underlying information to counter-insider threat (C-InT) analysts will make GUARD a powerful tool in the fight against insider threats. Approved for Public Release | 24-MDA-11906 (16 Sep 24)