METHOD AND SYSTEM FOR ELECTRONIC INSIDER THREAT PREDICTION

1 . An electronic security system comprising:

at least one processor;

at least one memory;

a forensic data source stored on the at least one memory;

a threat prediction module stored on the at least one memory; and

a data collection module stored on the at least one memory, configured to, when executed by the at least one processor:

collect subject data of a subject from the forensic data source; and

transmit the subject data to the threat prediction module;

wherein the threat prediction module is configured to, when executed by the at least one processor:

receive the subject data from the data collection module; and

analyze the subject data to generate an insider threat output characterizing the insider threat level of the subject.

2 . The system of claim 1 , wherein the forensic data source comprises a plurality of forensic data sources.

3 . The system of claim 1 , wherein the forensic data source includes any one or more of personal computers, smartphones, building access systems or surveillance systems.

4 . The system of claim 1 , wherein the insider threat output generation comprises comparing the subject data to historical insider threat subject data.

5 . The system of claim 1 , wherein the insider threat output generation comprises applying a machine learning based method to the subject data.

6 . The system of claim 1 , wherein the insider threat output generation comprises comparison of the subject data to a baseline profile.

7 . The system of claim 1 , wherein the subject data comprises subclasses, wherein the subclasses comprise world wide web browsing history, peripheral device logs, email records, file transfer records or calendar data.

8 . The system of claim 1 , further comprising a response module stored on the at least one memory, wherein the response module is configured to, when executed by the at least one processor: receive the insider threat output from the threat prediction module, and execute a response.

9 . The system of claim 1 , wherein the subject data is collected continuously.

10 . The system of claim 1 , wherein the insider threat output is updated continuously.

11 . A computer-implemented method of insider threat prediction, the method comprising:

collecting subject data of a subject from a forensic data source via a data collection module;

analyzing the subject data via a threat prediction module; and

generate an insider threat output via the threat prediction module characterizing the insider threat level of the subject.

12 . The method of claim 11 , wherein the forensic data source comprises a plurality of forensic data sources.

13 . The method of claim 11 , wherein the forensic data source comprises personal computers, smartphones, building access systems or surveillance systems.

14 . The method of claim 11 , wherein the insider threat output generation comprises comparing the subject data to historical insider threat subject data.

15 . The method of claim 11 , wherein the insider threat output generation comprises applying a machine learning based method to the subject data.

16 . The method of claim 11 , wherein the insider threat output generation comprises comparison of the subject data to a baseline profile.

17 . The method of claim 11 , wherein the subject data comprises subclasses, wherein the subclasses comprise world wide web browsing history, peripheral device logs, email records, file transfer records or calendar data.

18 . The method of claim 11 , further comprising transmitting the insider threat output from the threat prediction module to a response module, and executing a response.

19 . The method of claim 11 , wherein the subject data is collected continuously.

20 . The method of claim 11 , wherein the insider threat output is updated continuously.