Portfolio

Ph.D. Thesis – Prediction of Insider Cyber Threats Using Behavioral Analysis

Predicting insider cyber threats — Using behavioral analysis.

PhD thesis at GLS University on predicting insider cyber threats using behavioral analysis (submitted 2021; degree conferred March 2022). Part of the SATARK research lineage.

This page summarizes my doctoral research. The fuller project history, publication list, and current open-source rebuild live on satark.org.

Thesis

Title: Prediction of Insider Cyber Threats Using Behavioral Analysis
Institution: Department of Computer Application and IT, GLS University
Thesis year: 2021
Degree conferred: March 2022

Research question

How can behavioral signals help identify people who already have legitimate access, yet may still pose a cyber risk inside an organization?

What I worked on

The thesis builds on earlier SATARK research into insider-threat prediction. That line of work treats insider risk as something you can reason about from behavior and technical precursors, not only from a single alert after damage is done.

  • Behavioral analysis — looking at patterns that may precede harmful insider activity.
  • Threat scoring — earlier published work described assigning users a dynamic Threat-Rank on a 1–10 scale from behavioral and technical precursors (Bhavsar & Trivedi, ICT4SD / Springer, 2016).
  • Deep learning — I presented “Predicting Insider Threats by Behavioural Analysis using Deep Learning” at SAM’18 (2018).
  • Endpoint forensics — related work on Windows forensic analysis for insider-threat detection was presented at ICT4SD 2021 and later appeared in Springer (2022).

Timeline (from the SATARK history record)

  • 10 August 2020 — PhD synopsis submitted to GLS University.
  • 26 July 2021 — Complete thesis submitted for formal defense.
  • 5 August 2021 — Windows forensic analysis paper presented at ICT4SD 2021.
  • 10 October 2021 — Finalized thesis resubmitted after review-committee feedback.
  • March 2022 — PhD degree conferred.

How this connects to SATARK

SATARK began as product and research work on insider risk — including monitoring signals such as program, file, and USB activity — and later became the academic context for this thesis. Today SATARK is being rebuilt in public as an open-source security analytics framework with a plugin-first detect → score → explain pipeline. The thesis is the doctoral validation step in that lineage, not a claim that the current open-source package is the same binary as the 2010s product.

Limits

This page does not republish dataset details, measured accuracy figures, or confidential deployment results. For confirmed publication metadata and the project timeline, see the SATARK research and history pages.

Links