Abstract: Partial orders of subjects and of objects in the system and mapping relationship between them are defined by using the access control relationship. On this basis, a hierarchy-mapping based insider threat model is developed. The analytic hierarchy process is used to decompose and quantify the insider threat features of subjects and objects in the model. Then full real time assessment is obtained by using the mapping between subjects and objects. Compared with other models, this model improves the precision and objectivity of the quantization by the combination of qualitative and quantitative analysis. Experimental results show that the hierarchy-mapping based insider threat model can effectively assess the insider threat in real-time and can be used to build the insider threat sense system.

Key words: mapping, insider threat, assessment, subject, object