Development of a biosignal-based insider threat mitigation system in nuclear facilities

Abstract

This paper develops a biosignal-based insider threat mitigation system for workers in nuclear facilities. To identify insider threats, the first part specifies when and when biosignals should be gathered and processed. The relevance of the behavior observation system is derived from a study of the opportunities and limitations of the physical protection system currently utilized in nuclear facilities. After that, a detailed assessment of biosignal-based behavioral observation methods was carried out. It is concluded that an immediate physiological reaction when a certain stimulus is delivered must be observed in order to properly characterize and detect the malicious activity of insiders. In the second part, a cognitive experiment was designed to detect false reports. Human experiments are used to verify its validity. First, malicious behavior is defined as the act of intentionally concealing or omitting to submit information related to a facility's safety and security, considering the unique characteristics of nuclear facilities. In other words, if a person professes to be uninformed of something but actually knows it, it is reasonable to believe that he or she is acting maliciously. It might be a breach of the reporting requirement. Related information is divided into three types of stimuli in order to identify such actions using biosignals: human faces, numbers, and letters. With prior knowledge, a machine learning-based categorization model is trained using known and unknown stimuli. It then predicts whether or not the unconfirmed information will be recognized. As a result, the 0.8-second interval epoch's single-trial prediction performance was between 60 % and 67 %. The final judgment resulted in 94.1 % predictive accuracy for facial stimulation, 82.4 % predictive accuracy for numeric stimulation, and 83.3 % predictive accuracy with word stimulation, based on repeated trials. In addition, a model was developed that could provide objective information for evaluating the reliability of employees using simple equipment in a short amount of time. The model can predict if confidential information, such as passwords, codes, and passphrases, has been released. It may also be determined whether a given individual is concealing facts about safety and security. It can also confirm the presence of covert terrorist groups within the facility. In other words, this research paves the way for further security measures such as recognizing insiders who might have been involved in malicious behavior and monitoring leaked information.