Automated detection method for insider threat

Abstract

The present invention provides a system and a method for eliciting information to sensitive questions and reliably detecting whether one is being deceptive, concealing information, or experiencing a heightened emotional response to the question. In particular, the system and the method of the invention are based on analyzing the user behavioral biometric of using one or more input device(s).

What is claimed is: 
     
         1 - 14 . (canceled) 
     
     
         15 . A method for analyzing behavior comprising:
 receiving, from a subject, behavioral biometric information comprised of an input device usage characteristic;   translating the behavioral biometric information into representative data;   comparing the representative data against reference behavioral biometric data, wherein the reference behavioral biometric data is comprised of the subject's behavioral biometric data and the behavioral biometric data of a plurality of non-subjects; and   outputting a result associated with the subject's deceptive intent.   
     
     
         16 . The method of  claim 15 , wherein the input device usage characteristic is received from a pointing device. 
     
     
         17 . The method of  claim 16 , wherein the pointing device is a mouse, a joystick, a stylus, a trackball, a touch screen, or a touch pad. 
     
     
         18 . The method of  claim 15 , wherein the input device characteristic is finger movement, precise timing, or applied pressure between an initial position of a pointer and a second position associated with an input selected by the subject. 
     
     
         19 . The method of  claim 15 , further comprising requesting a second input from the subject based on the result associated with the subject's deceptive intent. 
     
     
         20 . The method of  claim 17 , wherein the second input is selected using a decision tree structure. 
     
     
         21 . The method of  claim 16 , wherein the input device usage characteristic is detected 20 to 100 milliseconds after a signal is generated by the pointing device. 
     
     
         22 . The method of  claim 15 , wherein the representative data is averaged into fixed time intervals. 
     
     
         23 . The method of  claim 15 , wherein the comparison of representative data against reference behavioral biometric data occurs at a remote server. 
     
     
         24 . The method of  claim 15 , wherein the result associated with the subject's deceptive intent is searchable on a management dashboard application. 
     
     
         25 . The method of  claim 15 , wherein the behavioral biometric information is a number of times the subject changes an answer to a query. 
     
     
         26 . The method of  claim 15 , wherein the behavioral biometric information is a total response time associated with the subject. 
     
     
         27 . The method of  claim 15 , wherein the behavioral biometric information is an additional distance traveled by a cursor on the screen relative to an idealized response trajectory for said cursor. 
     
     
         28 . The method of  claim 15 , wherein the behavioral biometric information is an amount of time between key presses. 
     
     
         29 . The method of  claim 16 , wherein the behavioral biometric information is an average overall speed of the pointing device. 
     
     
         30 . A non-transitory computer-readable medium that stores a program for analyzing behavior that, when executed, causes a processor to:
 receive, from a subject, behavioral biometric information comprised of an input device usage characteristic;   translate the behavioral biometric information into representative data;   compare the representative data against reference behavioral biometric data, wherein the reference behavioral biometric data is comprised of the subject's behavioral biometric data and the behavioral biometric data of a plurality of non-subjects; and   output a result associated with the subject's deceptive intent.   
     
     
         31 . The non-transitory computer-readable medium of  claim 30 , wherein the input device usage characteristic is received from a pointing device. 
     
     
         32 . The non-transitory computer-readable medium of  claim 31 , wherein the pointing device is a mouse, a joystick, a stylus, a trackball, a touch screen, or a touch pad. 
     
     
         33 . The non-transitory computer-readable medium of  claim 30 , wherein the input device characteristic is finger movement, precise timing, or applied pressure between an initial position of a pointer and a second position associated with an input selected by the subject. 
     
     
         34 . The non-transitory computer-readable medium of  claim 30 , wherein the program, when executed, further requests a second input from the subject based on the result associated with the subject's deceptive intent. 
     
     
         35 . The non-transitory computer-readable medium of  claim 34 , wherein the second input is selected using a decision tree structure. 
     
     
         36 . The non-transitory computer-readable medium of  claim 31 , wherein the input device usage characteristic is detected 20 to 100 milliseconds after a signal is generated by the pointing device. 
     
     
         37 . The non-transitory computer-readable medium of  claim 30 , wherein the representative data is averaged into fixed time intervals. 
     
     
         38 . The non-transitory computer-readable medium of  claim 30 , wherein the program, when executed, transmits the representative data to a remote server for comparison against reference behavioral biometric data. 
     
     
         39 . The non-transitory computer-readable medium of  claim 30 , wherein the result associated with the subject's deceptive intent is searchable on a management dashboard application. 
     
     
         40 . The non-transitory computer-readable medium of  claim 30 , wherein the behavioral biometric information is a number of times the subject changes an answer to a query. 
     
     
         41 . The non-transitory computer-readable medium of  claim 30 , wherein the behavioral biometric information is a total response time associated with the subject. 
     
     
         42 . The non-transitory computer-readable medium of  claim 30 , wherein the behavioral biometric information is an additional distance traveled by a cursor on the screen relative to an idealized response trajectory for said cursor. 
     
     
         43 . The non-transitory computer-readable medium of  claim 30 , wherein the behavioral biometric information is an amount of time between key presses. 
     
     
         44 . The non-transitory computer-readable medium of  claim 31 , wherein the behavioral biometric information is an average overall speed of the pointing device.