arXiv CS open access

A Bayesian Correlated Equilibrium for Early Insider-Threat Detection

2026 · arxiv_cs

arXiv CS · Papers · 2026

cryptography cybersecurity privacy security

Conceptio Open Archive

Analyze & explore related research in Conceptio

Connect this record directly into your research workflow or AI agent. Explore citations across open repositories, query full text, and export structured proof bundles.

Explore in Search →Connect via MCP / API ↗

A Bayesian Correlated Equilibrium for Early Insider-Threat Detection

arXiv:2609.03096v1 [cs.CR] 2 Sep 2026

Javed M. Shah1 [0009-0009-7472-5614] , Ian A. Kash1 [0000-0002-7826-8555] , and Natalie Parde1 [0000-0003-0072-7499] University of Illinois Chicago, Chicago, United States jshah93@uic.edu, iankash@uic.edu, parde@uic.edu

Abstract. We model insider threat detection as a dynamic Bayesian game in which a platform coordinates a committee of strategic certifiers to sustain equilibrium among honest users and detect malicious deviations before exfiltration. Certifiers and users operate under a Bayesian Temporal Correlated Equilibrium (BTCE), where a sealed-envelope correlating device issues private recommendations over time and obedience is verified at every on-path information state. Unlike Stackelberg formulations, BTCE coordinates heterogeneous certifiers without requiring commitment power. We incorporate present bias and loss aversion to capture impulsive escalation dynamics, enabling 1.7–4.5 days earlier detection than rational baselines. We prove three guarantees: (1) calibrated intervention losses make recommended behavior a current-self best response despite behavioral biases, (2) controlled evidence accumulation guarantees intervention in bounded expected time before exfiltration, and (3) median aggregation confines implemented actions to the honest recommendation range when fewer than half of certifiers are Byzantine. On CERT r6.2 our mechanism achieves up to 28.3% pre-exfiltration detection with false positives below 1.6%, while both a transformer baseline and a streaming provenance approximation (HOLMESLite) achieve near-zero pre-exfiltration detection under comparable constraints. Keywords: Bayesian beliefs, correlated equilibrium, insider threat

Introduction

Insider threats arise when authorized users misuse legitimate access to exfiltrate data, sabotage systems, or abuse privileges. While the detection of these threats remains one of the most intractable challenges in enterprise security, traditional approaches still rely on a theoretical framework that assumes a "rational actor". Existing insider risk modeling uses classical rational paradigms [17,10] where malicious insiders are expected-utility maximizers with exponential discounting. Insiders are assumed to trade off immediate payoffs from reconnaissance and exfiltration against the perceived probability and cost of detection. We point to a growing body of empirical and theoretical work that shows systematic deviations from this benchmark. In fact, decision makers are found to often exhibit

Shah et al.

present bias and time inconsistency, placing disproportionate weight on immediate rewards relative to delayed consequences [6]. They also display reference dependence and loss aversion, evaluating outcomes relative to a psychological reference point and becoming risk-seeking in the loss domain [23]. These phenomena are salient for insider scenarios. Disgruntled employees may perceive themselves to be in a loss domain, and opportunistic insiders may act impulsively when presented with a rare vulnerability, even if they previously intended to behave safely [8,15]. This gap between modeled and actual insiders often explains why static anomaly detection fails to stop irreversible harm. We approach this as a dynamic multiagent interaction between platform users and a committee of certifier agents. Certifiers can be automated detectors, rule engines, or human reviewers. They condition on the publicly recorded history Hut , maintaining a local posterior over latent user state, and recommend an intervention cti,u ∈ Ac for each user u at time t (Def. 1). The platform implements a single outcome dtu = g(ctu ) by aggregating ctu with an order-statistic rule on (Ac , ⪯). Here ⪯ orders interventions by stringency, from low-friction monitoring to access suspension. Routine regimes use a median-type outcome, while high-risk regimes use a fail-safe max rule (Algorithm 1). Motivating High Profile Exfiltration Episode. We draw attention to several high profile publicly documented insider episodes that illustrate precisely the out-ofequilibrium deviations that BTCE is designed to intercept. In Tesla–Tripp (2018) [9], sabotage following a denied promotion can be represented as a behavioral regime shift where an adverse organizational event raised the user’s reference point rut and moved the user into the loss domain. Actions such as code edits and scripted exports he later made are actually coordinated sequences rather than isolated anomalies. Standard security models failed to intercept Tripp because his access privileges remained valid and his behavior, while aggressive, looked like "technician work" to static systems. The BTCE model, however, would ingest the "precipitating event" (reassignment) to update the user’s latent Behavioral State (btu ), dynamically computing an Insider Threat Score (ITS) (Def. 9) and forcing earlier intervention. This would allow certifiers to flag the subsequent action sequence (modifying code, exporting data) as a coordinated attack. More recently, the attack surface has increased even further with the proliferation of non-human identities such as service accounts, API keys and automated agents. As the boundaries of trust erode, the central challenge is building systems that stay secure when trust itself is weaponized. This paper asks: can we design a system that reliably detects and eliminates malicious actors under extreme sparsity before exfiltration begins? Contributions We introduce a Bayesian Temporal Correlated Equilibrium (BTCE) for a telemetry-driven governance mechanism: the BTCE characterizes consistent, history-dependent strategies for certifier recommendations, platform aggregation, and user responses. To keep the equilibrium verification operational, we use an on-path one-shot obedience check: at each realized information state,

Bayesian Correlated Equilibrium for Insider-Threat Detection.

following the current recommendation must dominate any single-period deviation, with future play returning to the recommended protocol (Lemma 1). By explicitly modeling the temporal evolution of disgruntled users, we make three main contributions. 1 We give interpretable sufficient conditions under which calibrated intervention loss makes the recommended action a current-self best response in a Bayesian Temporal Correlated Equilibrium, even with Prospecttheoretic utilities and quasi-hyperbolic discounting (Theorem 1). 2 We establish early detection guarantees, showing that under positive evidence drift the posterior crosses the intervention threshold in bounded expected time before substantial exfiltration, with behavioral modeling yielding 1.7–4.5 days earlier detection than rational baselines (Theorem 2). 3 We show that median-based order-statistic aggregation keeps the implemented action within the honest recommendation range whenever fewer than half of certifiers are compromised, preserving both equilibrium enforcement and early detection guarantees (Proposition 2). Together, these results yield an auditable1 , drift-robust mechanism that combines heterogeneous certifiers and supports escalation before meaningful data loss even when evidence is sparse.

Related Work

Game-theoretic security has largely emphasized Stackelberg [20] or Bayesian [2] models in which defenders commit and attackers best-respond, while repeated games with private monitoring [12] motivate history-dependent coordination but do not combine causal signal dependencies, behavioral bias, and loyalty-type evolution. BTCE instead uses correlated equilibrium [1] to coordinate heterogeneous certifiers without commitment power, while incorporating present bias [13,19], loss aversion [11,23], and insider psychology [8]. ML approaches ranging from Isolation Forest [7] and LSTMs [22] to Transformer-UBS [5] often achieve user-level detection but struggle on timing-sensitive early-warning metrics; we use a DBNinspired evidence accumulation layer [25] inside the game-theoretic mechanism, and Byzantine-robust aggregation [14] motivates the median order-statistic rule in Algorithm 1 and Proposition 2. Provenance systems such as HOLMES [18] and KAIROS [4] reason over causal host-level telemetry, whereas BTCE targets enterprise control planes (cloud and data access) where coordinated misuse can unfold across users and devices without a single host-level execution chain; we therefore benchmark against a streaming approximation, HOLMESLite, rather than treating provenance reconstruction as the main task. Finally, BTCE operates under sparsity comparable to credit card fraud detection (∼ 0.17% prevalence [3,21]) but avoids class imbalance entirely by combining equilibrium analysis with controlled evidence accumulation rather than reducing features or rebalancing the training distribution. 1

BTCE is designed as an auditable coordination layer on top of systems enterprises already operate, rather than a replacement for SIEM, EDR, DLP, identity, HR, or human-review workflows.

Shah et al.

Section 3 introduces the signal model and game; Section 4 develops the behavioral utilities, type evolution, and belief updates; Section 5 defines the BTCE equilibrium; Section 6 analyzes early detection, graduated intervention, and Byzantine robustness; and Section 7 presents empirical results.

Bayesian Game Design

Model overview (informal). We first give an informal story of the model before the formal specification. Each period, a user u takes an unobserved operational action xtu (e.g., normal work, negligent behavior, or malicious steps). A committee of certifiers i ∈ C maintain beliefs about the user’s latent loyalty state θut and latent behavioral state btu . The platform observes only telemetry-derived signals stu (§2) and the committee’s implemented intervention outcome dt−1 (e.g., u approve, monitor, escalate, suspend). Based on the public history Hut and their (possibly noisy) local posteriors, certifiers recommend interventions cti,u ∈ Ac . The platform aggregates recommendations into a single implemented action dtu via a rule g. Users then respond to the intervention environment and their own present bias (§4.1). Next, we present a definition of the game, observations, strategies and a sample per-period, per-user sequence of play. Definition 1 (Behavioral temporal Bayesian game). A behavioral temporal Bayesian game is a tuple t G = T , C, U, Θuser , B, µ0 , ν 0 , Au , Ac , gκ , S, Gsig , Ps , τΘ , τB , (Uut )t∈T , (Uc,i )t∈T ,i∈C . Here T = {0, . . . , T } is the finite horizon, C = {1, . . . , m} is the certifier committee, and U is the user population. The loyalty type space is Θuser = {Loyal, Negligent, Disgruntled, Malicious}, with θut ∈ Θuser and common prior µ0 ∈ ∆(Θuser ); the finite behavioral state space is B, with btu ∈ B and prior ν 0 ∈ ∆(B). Under common priors, each 0 certifier initializes µ0i,u = µ0 and νi,u = ν 0 . Users choose xtu ∈ Au , certifiers t recommend ci,u ∈ Ac , and Ac is totally ordered by stringency ⪯. Writing ctu = (cti,u )i∈C ∈ (Ac )m , the platform implements dtu = gκtu (ctu ) ∈ Ac , κtu ∈ {1, . . . , m}, where gQ κ is the order-statistic aggregation rule of §6.1. The public signal space is S = j∈I Sj = [0, 1]K , K = |I|, and stu = (stu,j )j∈I ∈ S is the period-t telemetry vector. The graph Gsig = (I, E) is a directed acyclic graph over signal components, and the signal kernel Ps (· | θ, b, x, d) admits a density that factorizes Q t t t t t t−1 as ps (stu | θut , btu , xtu , dt−1 . u )= j∈I ps,j su,j su,Parents(j) , θu , bu , xu , du Latent states evolve according to the loyalty type kernel τΘ (θut+1 | θut , xtu , dtu ) ∈ ∆(Θuser ), and the behavioral type kernel τB (bt+1 | btu , θut , xtu , dtu ) ∈ ∆(B). Fiu t t nally, (Uu )t and (Uc,i )t,i are user and certifier stage utilities. User utility is the behavioral utility Ubeh of Def. 4, based on intrinsic payoff ρ : Au → R and Prospect-theoretic value v(·). Certifier i has per-user

Bayesian Correlated Equilibrium for Insider-Threat Detection.

P t t t utility Uct (θut , btu , cti,u , stu , µti,u ), and platform-level utility Uc,i = u∈U Uc (θu , t t t t t bu , ci,u , su , µi,u ), where µi,u ∈ ∆(Θuser ) is certifier i’s belief over user u’s loyalty type. Since the horizon is finite, utilities are undiscounted except for the behavioral present-bias term; equivalently, the baseline discount factor is δ = 1, with the extension to δ ∈ (0, 1] immediate. Certifiers observe the public history of past signals and implemented committee outcomes {(sτu , dτu )}τ <t . User actions xtu are not directly observable; they influence play only through the realized signals. Only the implemented outcome dtu is publicly observed, the individual certifier recommendations (cti,u )i are not. A (possibly mixed) user strategy for user u is a sequence πu := (πut )t∈T where, for each t, πut : Θuser × B × Hut → ∆(Au ), and Hut denotes the set of feasible public histories Hut . Because certifiers observe the period-t public signal before acting, a (possibly mixed) certifier strategy for certifier i is a sequence σi := (σit )t∈T where, for each t, σit : Hut × S → ∆(Ac ), so that σit (Hut , stu ) is the distribution over certifier actions after observing (Hut , stu ). In the pure-strategy case, σit (Hut , stu ) is a point mass on an element of Ac . π := (πu )u∈U and σ := (σi )i∈C denote the strategy profiles. Gameplay (per period t, per user u ∈ U) proceeds as follows: the user moves first, the signal realizes, certifiers recommend after observing stu , and transitions occur under dtu . Only dtu enters Ps , τΘ , and τB ; the recommendation profile ctu matters only through the aggregation that produces it. Full timing appears in Table 1. We model the telemetry process with a two-slice DBN: Definition 2 (Exploit-chain dependency graph). We model public telemetry stu ∈ [0, 1]K with a controlled DBN, conditional on (θut , btu , xtu , dtu ), over the channel ontology used in the CERT r6.2 [16] dataset, I = {Logon, LDAP, Device, File, Email, http}. Conditional on (θut , btu , xtu , dt−1 u ), channels factorize along a stylized kill-chain DAG Gsig = (I, Esig ) with Esig ⊇ {(Logon, File), (Logon, Device), (File, Email), (File, http)}. This yields standard hidden-state filtering updates for the joint posterior βut (θ, b) (Proposition 1), which feeds into (i) certifier recommendation policies and (ii) the platform’s temporal correlating device that generates recommendations over time (Def. 6). The equilibrium concept (BTCE, Def. 7) enforces temporal obedience: given their information, users and certifiers do not profitably deviate from recommendations. Thus file/device anomalies are interpreted in logon context, and exfiltration channels are interpreted in the context of prior file aggregation. Each channel uses a Beta likelihood whose shape parameters depend on type, behavioral state, and control, allowing the filter to assign higher likelihood to coordinated access–collection–exfil sequences than to isolated negligent anomalies.

Behavioral Utility, Type Evolution and Belief System

This section develops the behavioral machinery the rest of the paper depends on. The introduction argued that real insiders depart from the rational-actor bench-

Shah et al. Table 1. Within-period update journey and time indexing.

# Actor 0 Public history (All parties) 1 User move (User u) 2 Signal emission (Telemetry) 3 Belief filtering (Common posterior)

Update (inputs → output) Start of period t history: Hut = 0 0 t−1 t−1 −1 (su , du ), . . . , (su , du ) ; default du = NoAct Given latent state (θut , btu ) and history Hut , user samples xtu ∼ πut (· | θut , btu , Hut ) stu ∼ Ps (· Q | θut , btu , xtu , dt−1 u ); DBN factorization: t ps (su | ·) = j∈I ps,j (stu,j | stu,Pa(j) , θ, b, x, dt−1 u ) t Compute action-marginalized likelihood L (θ, b) = u P t t t t−1 π (x | θ, b, H ) p (s | θ, b, x, d ), then ups u u u u x∈Au date belief βeut (θ, b) ∝ Ltu (θ, b) βut (θ, b).

Visible Hut

Compute scalar risk score, ITS(u, t) = Pk ITS t su,j j=1 wj Each certifier outputs recommendation cti,u ∈ Ac

ITS

Aggregate and implement dtu := g(ctu ) ∈ Ac

dtu

Propagate filtered belief βeut through (τΘ , τB ) to obtain βut+1 , the prior for period t+1

βut+1

5 6 7

ITS gate (Platform) Certifier recs (Certifiers i ∈ C) Aggregation (Committee) Belief propagation (Filter) Type evolution (User dynamics)

no stu µt,sys u

cti,u

Transition to next latent state: θut+1 ∼ τΘ (· | no θut , xtu , dtu ); bt+1 ∼ τB (· | btu , θut , xtu , dtu ) u

mark through present bias and loss aversion; we now make those forces precise and tie them to our guarantees. We specify (i) certifier payoffs that calibrated sanctions will later target (Def. 3), (ii) a prospect-theoretic, quasi-hyperbolic user utility encoding loss-domain risk-seeking and time inconsistency (Defs. 4– 5), and (iii) the type- and behavioral-state kernels through which adverse events move a user toward the loss domain and impulsive escalation (§4.1–§4.2). Together these supply the current-self objective whose obedience Theorem 1 certifies and the evidence process whose drift Theorem 2 bounds. Throughout we use the within-period timing of Def. 1: the user action xtu precedes the signal t stu ∼ Ps (· | θut , btu , xtu , dt−1 u ), certifiers act after observing su , and payoffs are t evaluated using the implemented outcome du . Fix a baseline intervention ā ∈ Ac and let Iint (d) := I{ā ⪯ d} (triggering when d is restrictive enough); write Θbenign := Θuser \ {Malicious}. Define detection events using dtu : Idet (u, t) := I{θut = Malicious} Iint (dtu ), Imiss (u, t) := I{θut = Malicious} (1 − Iint (dtu )), Ifp (u, t) := I{θut ∈ Θbenign } Iint (dtu ). Let Rdet > 0 be the reward for correctly intervening on a malicious user, Cmiss > 0 the cost of a miss, and Cfp > 0 the cost of a false positive. Definition 3 (Certifier stage payoff ). The certifier’s per-user stage payoff is Ūct θut , btu , cti,u , stu , dtu := Rdet Idet (u, t) − Cmiss Imiss (u, t) − Cfp Ifp (u, t). The

Bayesian Correlated Equilibrium for Insider-Threat Detection. t platform-level certifier stage utility is the sum across users, Uc,i t t t t t t Ūc θu , bu , ci,u , su , du .

u∈U

Definition 4 (Behavioral user stage utility). For α ∈ (0, 1], λ > 1, and reference point r, define v(z) = z α for z ≥ 0 and v(z) = −λ(−z)α for z < 0. Let ρ : Au → R be intrinsic action payoff, C > 0 the penalty from detection, and let b = (r(b), ψpb (b)) with r(b) ∈ R+ and ψpb (b) ∈ (0, 1]. Given ptdet,u := pdet (xtu , dtu , stu , µt,sys ) ∈ [0, 1], the user stage utility is u Ubeh = (1 − ptdet,u )v(ρ(xtu ) − r(btu )) + ptdet,u v(−C − r(btu )). We set Uut ≡ Ubeh in Def. 1. Definition 5 (Quasi-hyperbolic present-biased evaluation). At time t, a user with ψpb ∈ (0, 1] evaluates a continuation stream {U τ }Tτ=t as U t + PT ψpb τ =t+1 U τ . When ψpb = 1, preferences are time-consistent and reduce, under δ = 1, to the undiscounted continuation sum. Thus Ubeh captures reference dependence and loss-domain risk taking, while the quasi-hyperbolic criterion makes the time-t self overweight the current period relative to future sanctions. The continuation and current-self value functionals used for temporal obedience are introduced in §5.1. 4.1

Type Evolution

Loyalty types evolve through a multinomial-logistic kernel τΘ in which toxic access drives Disgruntled→Malicious, probing pushes Loyal→Disgruntled, and honest behavior stabilizes the current type, while reverse transitions to t ) evolves through τB : the refLoyal are rare. The behavioral state (rut , ψpb,u erence point rises under sustained adverse interventions (deepening the loss domain), and present bias sharpens under stress. Discretization is presented in Appendix A. While loyalty types evolve in response to strategic behavior and organizational feedback, behavioral states capture psychological dynamics driven by organizational experience. We encode loss-domain effects, stress, and time inconsistency by letting the behavioral state btu ∈ B contain at least a reference t point and a present-bias parameter. Let B ⊆ R×(0, 1] and write btu ≡ (rut , ψpb,u ), t is the quasi-hyperbolic present-bias pawhere rut is the reference point and ψpb,u rameter (Def. 4). 4.2

Bayesian Belief System

At each period t, public monitoring reveals the realized signal vector stu and the implemented outcome dtu , so all certifiers condition on the same public history Hut . Given the controlled signal model Ps (· | θ, b, x, d) and the statetransition kernels, the platform runs a controlled Bayesian filter to form a canonical posterior over the latent user state (θut , btu ). We write this joint belief as βut ∈ ∆(Θuser × B), and we use its marginal on Θuser as the system-level loyalty belief µt,sys ∈ ∆(Θuser ) that drives belief-threshold policies and the BTCE u obedience constraints.

Shah et al.

Controlled DBN filter. Let d−1 = NoAct and let πut (· | θ, b, Hut ) ∈ ∆(Au ) u be the user’s possibly mixed policy.P Since xtu is unobserved, define the actiont marginalized likelihood Lu (θ, b) := x∈Au πut (x | θ, b, Hut ) ps (stu | θ, b, x, dt−1 u ), with ps factorized as in Def. 1. Observing stu also updates the posterior over the latent action: ωut (x | θ, b) := Pr(xtu = x | θ, b, Hut+1 ) =

t t ps (stu | θ, b, x, dt−1 u ) πu (x | θ, b, Hu ) , t Lu (θ, b)

for Ltu (θ, b) > 0; if the signal is uninformative about x, then ωut = πut . Proposition 1 (DBN-filtered Bayesian belief update). Fix P u ∈ U andPt ∈ T . The next-step belief βut+1 ∈ ∆(Θuser ×B) satisfies βut+1 (θ′ , b′ ) = θ∈Θuser b∈B P t t ′ t ′ t et βeut (θ, b) x∈Au πu (x | θ, b, Hu ) τΘ (θ | θ, x, du ) τB (b | b, θ, x, du ), where βu is t the filtered belief after observing su , given by: βeut (θ, b) = P

Lt (θ, b) βut (θ, b) Pu , t ′′ ′′ t ′′ ′′ θ ′′ ∈Θuser b′′ ∈B Lu (θ , b ) βu (θ , b )

where Ltu (θ, b) is the action-marginalized emission likelihood (§4.2). The per-user per-period update costs O(|Θuser ||B||Au |K), where K = |I| = 6. With |Θuser | = 4 and |B| ≈ 102 , this scales to N ≈ 104 users on commodity hardware, and the DBN-likelihood computation parallelizes across users.

Bayesian–Temporal Correlated Equilibrium

With beliefs and behavioral utilities fixed, we now define the solution concept that coordinates certifiers and users over time. We develop an equilibrium notion that coordinates heterogeneous certifiers without assuming any of them can commit (unlike Stackelberg models) and that can be verified locally, at each on-path information state, rather than over entire strategies. Bayesian–Temporal Correlated Equilibrium (BTCE, Def. 7) provides a disciplined coordination model for this setting, where a sealed-envelope device issues private recommendations that depend on the realized history. Obedience is checked at each on-path information state, and the current recommendation must dominate any one-period deviation followed by a return to the protocol. The two results of this section connect this local check to the rest of the mechanism: Lemma 1 records the immediate no-one-shot-deviation implication of BTCE obedience, and Theorem 1 gives conditions under which calibrated sanctions make the recommended action a present-biased user’s current-self best response. Following Aumann [1] and Bergemann–Morris [2], we coordinate participants through a temporal correlating device issuing private recommendations over time, via the extensive-form “sealedenvelope” construction [24]. The correlating device samples an entire contingent recommendation plan ex ante and reveals only the currently relevant recommendation when an agent reaches the corresponding information set. In our setting, the period-t public signal stu is realized after the user acts and before certifiers

Bayesian Correlated Equilibrium for Insider-Threat Detection.

act, so recommendations are revealed sequentially within each period (user first, then certifiers conditional on stu ), while remaining jointly coupled through the single ex-ante draw. Definition 6 (Temporal correlating device (sealed-envelope form)). Fix a user u and horizon T . A temporal correlating distri device is a probability t t bution ζu over recommendation plans ζu = (ζu,x )Tt=0 , (ζu,c )Tt=0 , where for t t each t, ζu,x : Θuser × B × Hut → Au , ζu,c : Hut × S → (Ac )m are measurable maps. At time 0, the device samples a plan ζu and keeps it fixed. In period t, after the public history Hut is realized, the device privately recommends to the t user x btu = ζu,x (θut , btu , Hut ). After the public signal stu is realized and observed, t the device privately recommends to the certifiers b ctu = ζu,c (Hut , stu ).

The recommendations induce an “extended” game where players additionally consider them when choosing actions. For a formal treatment, see Definition 2.2 of [24]. Note that conditioning on the sampled plan ζu , recommendations are deterministic. Integrating out ζu induces the history-dependent recommendat t (· | H, s) as the corresponding pushforward (· | θ, b, H) and ζu,c tion kernels ζu,x t t (H, s). If we fix a sealed-envelope temporal distributions of ζu,x (θ, b, H) and ζu,c correlating device ζu and platform rule dtu = gκtu (ctu ), Φζuu denotes the distribution over complete play paths (induced path measure). Expectations in Def. 7 are taken with respect to Φζuu . The equilibrium concept treats the device as committing ex ante to a recommendation plan and revealing only the relevant recommendation as play unfolds, requiring obedience at every on-path history. Definition 7 (Bayesian-temporal correlated equilibrium (BTCE)). Fix a user u ∈ U and a temporal correlating device ζ (Def. 6). Let Φζu denote the induced path measure under obedient play. Let beliefs be given by the regular conditional distributions induced by Φζu on the extended on-path information available to each player (i.e., public history together with the realized recommendations they have observed), using Bayes’ rule wherever the relevant conditioning event has positive probability. For the user, define the recommendation history up to t := (b bt−1 (but not including) t as x b0:t−1 x0u , x b1u , . . . , x u ) ∈ (Au ) , and the correu 0:t−1 t ). For certifier sponding augmented user information state as Ibu,t := (Hu , x bu 0:t−1 t−1 t 0 1 t b t := := c0:t−1 i, define b ci,u (b ci,u , b ci,u , . . . , b ci,u ) ∈ (Ac ) , Ii,u,t (Hu , su , b i,u ). For an information state and recommended action, define the continuation payoff under obedience as the conditional expected total payoff from period t onward (with the player obeying from t onward): " # θut = θ, btu = b, Hut = H, 0:t−1 Uu (t, θ, b, H, x b ; x̂) := EΦζu Uu 0:t−1 . x bu =x b0:t−1 , x btu = x̂ Similarly, for certifier i, " Ui (t, H, s, b c0:t−1 ; ĉi ) i

:= EΦζu Ui

Hut = H, stu = s, b c0:t−1 =b c0:t−1 , b cti,u = ĉi i,u i

# .

Shah et al.

Similarly, let Uu (t, θ, b, H, x b0:t−1 ; x′ ) (resp. Ui (t, H, s, b c0:t−1 ; c′i )) denote the i same conditional expectation when the player deviates only at time t to x′ ∈ Au (resp. c′i ∈ Ac ) and obeys thereafter. We say ζ is a BTCE if the following obedience constraints hold at every on-path information state: (i) User obedience. For every t ∈ {0, . . . , T }, every (θ, b, H, x b0:t−1 , x̂) such

b0:t−1 = x b0:t−1 , x btu = x̂ > 0, and every that Φζu θut = θ, btu = b, Hut = H, x u x′ ∈ Au , Uu (t, θ, b, H, x b0:t−1 ; x̂) ≥ Uu (t, θ, b, H, x b0:t−1 ; x′ ). (ii) Certifier obedience. For every certifier i ∈ C, every t ∈ {0, . . . , T },every c0:t−1 =b c0:t−1 , b cti,u = ĉi > 0, (H, s, b c0:t−1 , ĉi ) such that Φζu Hut = H, stu = s, b i,u i i and every c′i ∈ Ac , Ui (t, H, s, b c0:t−1 ; ĉi ) ≥ Ui (t, H, s, b c0:t−1 ; c′i ). i i The sealed-envelope construction lets recommendations be correlated across agents and time while preserving the within-period information order. The user acts, the public signal is realized, and then certifiers act conditional on (Hut , stu ). Under the finite-horizon and bounded-utility assumptions used below, this construction induces a well-defined path measure Φζu . 5.1

Temporal Obedience and Current-Self Best Response

We formalize a continuation value and a present-biased current-self objective. Throughout, fix a user u, a user policy πu = (πut )t∈T , and a certifier profile σ, which we suppress from the value functions. Write the payoff-relevant information state Kut := (θut , btu , Hut ) (generic value K = (θ, b, H)), abbreviate the public := µsys (Hut ), and let Hut+1 = (Hut , (stu , dtu )) append the realized pair. belief µt,sys u Definition 8 (Continuation and current-self values). With VuT +1 ≡ 0, the continuation value is h i t+1 t+1 t Vut (I) := E Ubeh xtu , dtu , stu , µt,sys , b + V K K = K , u u u u where the period-t variables follow the on-path kernels: xtu ∼ πut (· | K), stu ∼ t t t t t t+1 Ps (· | θ, b, xtu , dt−1 ∼ τΘ (· | u ), ci,u ∼ σi (· | H, su ) with du = gκtu (cu ), and θu t t t t t+1 θ, xu , du ), bu ∼ τB (· | b, θ, xu , du ). The present-biased current-self objective is Vut with the current action fixed to x and the continuation weighted by ψpb (b): h i t+1 t+1 t t Wut (K; x) := E Ubeh x, dtu , stu , µt,sys , b +ψ (b) V K K = K, x = x . pb u u u u u A present-biased best response is any πu⋆ such that, with V evaluated under πu⋆ , supp πu⋆,t (· | K) ⊆ arg maxx∈Au Wut (K; x) for all (t, K). Users evaluate continuation streams using Ubeh (Def. 4) and the present-biased objective W (Def. 8). Honest certifiers use the per-user stage payoffs in Def. 3 and evaluate continuation streams by the induced finite-horizon sum of stage payoffs. Accordingly, the obedience inequalities in Def. 7 hold at every on-path information state. This yields the structural implication below.

Bayesian Correlated Equilibrium for Insider-Threat Detection.

Lemma 1 (No profitable on-path one-shot deviation). If ζ is a BTCE, then at every Φζu -on-path information state no user or certifier has a profitable one-shot deviation from the revealed recommendation. Proof. Immediate from the user- and certifier-obedience constraints in Definition 7, which compare obeying the revealed recommendation with any one-shot deviation x′ ∈ Au or c′i ∈ Ac at each on-path information state. Assumption 1 (Risk–reward alignment and bounded continuation) Fix an on-path user information state (t, θ, b, H, x̂0:t−1 , x̂) under a BTCE, with onpath detection risk p̄t (·) and intrinsic stage payoff ρ(·), so that the expected stage utility at sanction level C ≥ 0 is ρ(x) − C p̄t (x) (Def. 8), and write V t+1 (x) := E Vut+1 (Kut+1 ) | K, xtu = x for the expected continuation it induces (this already integrates the detection outcome dtu ). Assume the aggressiveness order ⪯ is total on Au , so every feasible x ̸= x̂ satisfies x ≻ x̂ or x ≺ x̂. (A) Risk–reward alignment. There exist payoff-gap constants ∆ρ+ , ∆ρ− ≥ + − 0 and risk-change constants ∆qL , ∆qU > 0 such that – every more-aggressive deviation x+ ≻ x̂ satisfies ρ(x+ ) − ρ(x̂) ≤ ∆ρ+ + and p̄t (x+ ) − p̄t (x̂) ≥ ∆qL ; – every less-aggressive deviation x− ≺ x̂ satisfies ρ(x̂) − ρ(x− ) ≥ ∆ρ− and − p̄t (x̂) − p̄t (x− ) ≤ ∆qU . (B) Bounded continuation effect. There exists ∆V < ∞ bounding the presentbias-weighted continuation effect of the current action: ψpb (b) V t+1 (x) − V t+1 (x̂) ≤ ∆V for every feasible x at this information state. −

≤ ∆ρ∆q−∆V . (C) Separation. ∆ρ∆q+∆V + − L

Theorem 1 (Sufficient condition for current-self obedience). h + i Suppose ∆ρ +∆V ∆ρ− −∆V (A)–(C) hold. Then the interval [Cmin , Cmax ] := , ∆q− is nonempty, ∆q + L

and for every sanction level C ∈ [Cmin , Cmax ] the recommended action x̂ is a current-self best response (objective W ,Def. 8) at this information state. Equiv− ∆ρ+ 1 1 alently, (C) reads ∆ρ − ≥ ∆V + , and in particular requires ∆q − ∆q + ∆q + ∆q − U

∆ρ− ≥ ∆V (strictly whenever ∆ρ+ + ∆V > 0): the reward-per-unit-risk forfeited by cautionmust exceed that gained by aggression by a margin of at least ∆V ∆q1 + + ∆q1 − , covering the continuation slack in both directions. Without L

(C), only one-sided obedience is guaranteed. + − Remark 1. The constants ∆ρ± , ∆qL , ∆qU , ∆V are evaluated at a fixed on-path BTCE continuation. Thus [Cmin , Cmax ] is a local obedience interval. Interpreting it as a design range requires the same continuation bound ∆V to hold uniformly for all sanction levels in that range. Proof. Write the deviation gain as ∆W (x) = ρ(x)−ρ(x̂) −C p̄t (x)− current-self p̄t (x̂) + ψpb (b) V t+1 (x) − V t+1 (x̂) , whose last term is bounded by ∆V in ab+ solute value by (B). Since ∆ρ+ , ∆V ≥ 0 and ∆qL > 0 we have Cmin ≥ 0; hence

Shah et al.

any C ≥ Cmin is nonnegative, and multiplying the risk inequalities of (A) by C preserves their direction. For a more-aggressive x+ ≻ x̂, (A) gives reward gain + + ≤ ∆ρ+ and risk increase ≥ ∆qL , so ∆W (x+ ) ≤ ∆ρ+ − C∆qL + ∆V ; this upper + bound is nonpositive iff C ≥ Cmin , hence ∆W (x ) ≤ 0 for every such C. For a less-aggressive x− ≺ x̂, (A) gives reward forfeit ≥ ∆ρ− and risk reduction − − ≤ ∆qU , so ∆W (x− ) ≤ −∆ρ− + C∆qU + ∆V ; this upper bound is nonpositive − iff C ≤ Cmax , hence ∆W (x ) ≤ 0 for every such C. Condition (C) is exactly Cmin ≤ Cmax , so [Cmin , Cmax ] is nonempty; fix any C in it. By totality of ⪯ on Au , every feasible x ̸= x̂ is some x+ ≻ x̂ or some x− ≺ x̂, so the two cases exhaust all deviations and ∆W (x) ≤ 0 for all x ∈ Au . Hence x̂ ∈ arg maxx∈Au W (K; x), i.e. a current-self best response. When malicious users deviate, evidence accumulates to trigger intervention in finite expected time before exfiltration. We prove this under a positive-drift assumption on the per-period log-likelihood ratio (Theorem 2).

Early Detection Mechanism

We now develop an operational early-warning policy from the BTCE specification. In practice, a platform observing sparse, noisy telemetry must decide when to intervene before exfiltration is complete. Concretely, we (i) map the system belief, or its calibrated score proxy ITS(u, t) (Def. 9), to an operational decision rule; (ii) specify how a committee of certifiers aggregates recommendations into a single intervention dtu ; and (iii) define the resulting intervention dynamics over time. The platform maintains a joint posterior βut (θ, b) ∈ ∆(Θuser × B) updated by the DBN filter of Proposition 1. This belief drives both calibrated sanctions for equilibrium enforcement and evidence accumulation for detection. Definition 9 (Insider Threat Score (ITS)). The Insider Threat Score at time t for user u is a weighted linear combination of signal components: ITS(u, t) = Pk (wITS )⊤ stu = j=1 wjITS stu,j , where wITS = (w1ITS , . . . , wkITS ) ∈ Rk is a weight vector calibrated from historical telemetry (e.g., breach labels) to maximize discrimination between malicious and benign behavior patterns. Formally, we do and ITS; rather, calibration is used not assume an exact identity between µt,sys u operationally to select thresholds that correspond to desired posterior risk levels. Note that the calibration map f can be estimated via logistic regression on labeled telemetry. Let yut ∈ {0, 1} indicate whether user u is malicious at time Pr(y t =1|st ) t. Using features stu , a fitted model takes the form log Pr(yut =0|stu ) = α0 + u u α1 (wITS )⊤ stu = α0 +α1 ITS(u, t). Thus we may set µt,sys (Malicious) ≈ logistic α0 + u α1 ITS(u, t) . So thresholding on ITS(u, t) is approximately equivalent to thresholding on the system belief µt,sys (Malicious). u 6.1

Tiered intervention and evidence drift

Fix thresholds −∞ < ηlow < ηhigh < ∞ that partition ITS(u, t) into low-, mid-, and high-risk tiers. Let (Ac , ⪯) be the totally ordered intervention space, where

Bayesian Correlated Equilibrium for Insider-Threat Detection.

a ⪯ a′ means that a′ is weakly more restrictive, and take NoAct ≺ Monitor ≺ Escalate ≺ SuspendAccess, with Monitor denoting passive low-friction logging or heightened observation without access restriction. Given committee recomt,(1) t,(m) mendations ctu = (ct1,u , . . . , ctm,u ) ∈ (Ac )m , write cu ⪯ · · · ⪯ cu for the t := t,(κ) order statistics and define gκ (cu ) cu , κ ∈ {1, . . . , m}. Algorithm 1 maps filtered belief and signal evidence to an implemented action: low-risk users receive NoAct, isolated mid-risk anomalies receive Monitor, coordinated mid-risk cases use median aggregation κ = ⌈m/2⌉, and high-risk cases use the failsafe max rule κ = m. The DBN posterior gives the dominant type estimate θ̂ut = arg maxθ∈Θuser µt,sys (θ), while the kill-chain flag ρtu records whether the u current signal pattern contains coordinated exploit-chain evidence.

Algorithm 1: Temporal Intervention Protocol Input : ITS(u, t), belief µt,sys ∈ ∆(Θuser ), kill-chain flag ρtu ∈ {0, 1} u certifier committee size m, recommendations ctu ∈ (Ac )m Output: Implemented outcome dtu ∈ Ac , aggregation index κtu , type estimate θ̂ut (θ)// dominant type from DBN posterior κtu ← ⌈m/2⌉, θ̂ut ← arg maxθ∈Θuser µt,sys u // — Type-conditioned intervention — if ITS(u, t) < ηlow then dtu ← NoAct // Loyal: routine ops, all channels stable, θut held at Loyal // Negligent: isolated minor anomaly; no kill-chain follow-on observed else if ITS(u, t) < ηhigh and ρtu = 0 and θ̂ut ̸= Malicious then dtu ← Monitor // Negligent: uncoordinated spike, no cross-channel progression else if ITS(u, t) < ηhigh then dtu ← gκtu (ctu ) // median aggregation in mid-risk tier // Disgruntled: correlated x-channel escalation, rut ↑, loss-domain entry; // Malicious pre-threshold (ρtu =1, ITS < ηhigh ): evidence building else κtu ← m dtu ← gκtu (ctu ) // Malicious: high-risk intervention (Logon→File→Exfil) return (dtu , κtu , θ̂ut )

Evidence drift and escalation time. Here we formalize the operational intuition that interventions shape future telemetry, telemetry updates the malicious posterior, and escalation occurs once the posterior crosses a chosen threshold. Even when the available evidence is sparse, as long as the signals generated under truly malicious behavior contribute evidence at a reliably positive rate, the expected time until the system’s belief crosses µthr is bounded. This implies escalation will occur in finite expected time and potentially before data loss. We use posterior

Shah et al.

log-odds to study escalation timing (M := Malicious): Λtu := logit µt,sys (M ) . u The predictive log-likelihood ratio increment ℓtu satisfies the Bayes recursion shapes the Λt+1 = Λtu + ℓtu , where the previously implemented control dt−1 u u period-t signal model and hence the malicious drift E[ℓtu | Hut , θut = M ]. Fix µthr ∈ (0, 1), define tintervene := inf{t ≥ t0 : µt,sys (M ) ≥ µthr }, u ∆t⋆ :=

logit(µthr ) − logit(µut0 ,sys (M )) . λmin

Theorem 2 (Early detection under controlled evidence accumulation). Suppose Λtu0 < logit(µthr ) and there exist λmin > 0 and ℓmax < ∞ such that, before intervention, E[ℓtu | Hut , θut = M ] ≥ λmin and |ℓtu | ≤ ℓmax for all t ≥ t0 . . Then E[tintervene − t0 | Hut0 , θut0 = M ] ≤ ∆t⋆ + λℓmax min Proof (sketch). Let a = logit(µthr ) and γ = tintervene . For τn = γ ∧ n, summing the stopped drift inequality gives λmin E[τn − t0 ] ≤ E[Λτun ] − Λtu0 . Before crossing, Λtu < a; at the crossing, bounded increments imply Λγu ≤ a + ℓmax . Hence a−Λtu0 +ℓmax = ∆t⋆ + λℓmax . Letting n → ∞ E[Λτun ] ≤ a + ℓmax , so E[τn − t0 ] ≤ λmin min and using monotone convergence gives the claim. Remark 2 (From obedience to exclusion: the post-intervention continuation game). If a malicious user deviates and the evidence crosses the intervention region, the platform implements SuspendAccess: user u is inactive from period t+1 onward with continuation value normalized to zero, and the continuation game t+1 := {v ∈ U : dtv ̸= is the BTCE environment restricted to the active set Uact SuspendAccess}, a reduced game on the remaining population. Interpretation and design takeaway. The theorem converts positive malicious evidence drift into a timeline guarantee: if the controlled LLR has average increment at least λmin > 0, then the posterior reaches the intervention threshold in bounded expected time. In BTCE, correlated access–collection–exfil signals make malicious trajectories systematically more likely under the attack model than the benign model, so behavioral escalation appears empirically as earlier threshold crossing relative to the rational ablation. Byzantine-Resilient Aggregation Let C = {1, . . . , m} index certifiers and let Cbyz ⊆ C be an unknown set of Byzantine certifiers; define Chon = C \ Cbyz . Assume fewer than half are Byzantine: |Cbyz | < m/2. Proposition 2 (Robustness of the median; fail-safe of the max). Fix t,(1) any profile of recommendations ctu ∈ (Ac )m and write its order statistics cu ⪯ t,(m) · · · ⪯ cu . If κ = ⌈m/2⌉, then the implemented action dtu = gκ (ctu ) lies within the range of honest recommendations: min⪯ {cti,u : i ∈ Chon } ⪯ dtu ⪯ max⪯ {cti,u : i ∈ Chon }. Further, if κ = m, then dtu = gm (ctu ) = max⪯ {cti,u : i ∈ C}.

Bayesian Correlated Equilibrium for Insider-Threat Detection.

% 10

Days

0.75 0.85 0.90

20 10 0

1 0

0.75 0.85 0.90

MFN (%)

0.75 0.85 0.90

HOLMESLite

1 0

0.75 0.85 0.90

2 1.5 1 0.5 0

100 %

Transformer-UBS UFP (%)

Days

BTCE (anchor-clip) MTTD (days)

50 0

0.75 0.85 0.90

100 %

BTCE (median) Pre-Exfil (%)

0.75 0.85 0.90

50 0

0.75 0.85 0.90

Fig. 1. UserEarly baseline comparison across thresholds θ, faceted by the Byzantine mix used to generate the closed-loop trajectories (top row f = 3, bottom row f = 9).

Anchor-clip ablation. The median rule is the headline mechanism certified by Proposition 2; we also report a score-level anchor-clip ablation P to separate aggregationfamily effects from the certified median rule. Let µ etu = b βeut (Malicious, b) be m t the filtered malicious marginal Pm and let γ = 0.05;t for scalar reports cu ∈ [0, 1] , 1 t ac t eu , γ) = m i=1 Π[eµtu −γ,eµtu +γ] (ci,u ). Since every clipped report define g (cu ; µ lies in [e µtu − γ, µ etu + γ] ∩ [0, 1], so does their average, even if all scalar reports are adversarial; unlike median aggregation, this gives posterior-anchor containment rather than an honest-range guarantee over ordered intervention actions.

Results and Discussion

We evaluate on CERT r6.2 [16] (January 2010–June 2011), using daily windows with N = 4000 users and 0.125% malicious prevalence (5 malicious users per window). Logs are mapped to continuous channel scores in [0, 1], strategic deviations follow Sec. 3, and the committee has m = 25 certifiers running Algorithm 1, of which f are Byzantine (|Cbyz | = f ). We compare BTCE against Transformer-UBS trained under the same 5/4000 imbalance and evaluated on the same closed-loop trajectories generated under each Byzantine mix f . We also evaluate against HOLMESLite, a streaming provenance-style baseline using exponentially decayed z-score aggregation with cross-channel bonuses [18]. For BTCE, tintervene (u) = inf{t ≥ t0 : µt,sys (M ) ≥ µthr } (we write θ for the threshu old value µthr below); for baselines it is the first calibrated threshold crossing. With first exfiltration texfil (u) and ∆u = tintervene (u) − texfil (u), we report PreExfil (∆u < 0), ∆u mean/median, MTTD, UFP, MFN, and F1 under Period, UserEver, and UserEarly units. Here MTTD (mean time to detection) is the average gap tintervene − t0 from the detection-window start to intervention, UFP (user false-positive rate) is the share of benign users that ever receive an intervention, and MFN (malicious false-negative rate) is the share of malicious

Shah et al.

Table 2. Behavioral vs. rational BTCE on early-warning timing under median aggregation over 10 runs. ∆ = tintervene − texfil and MTTD = tintervene − t0 . ∆ mean θ

Model

∆ median

MTTD

Earlier by

f =3 f =9 f =3 f =9 f =3 f =9 f =3 f =9

Behavioral 0.75 Rational

0.55 2.46

0.40 2.69

0.90 2.05

0.76 2.46

0.93 2.69

1.70

1.76

0.85

Behavioral Rational

1.73 5.02

1.76 4.61

2.00 4.20

1.95 3.70

1.63 5.02

1.99 4.61

3.39

2.62

0.90

Behavioral Rational

2.88 7.13

2.88 6.93

3.10 6.10

2.90 5.85

2.63 7.13

2.92 6.93

4.50

4.01

users never flagged. The rational ablation sets ψpb = 1; concept-drift runs use two counterfactual rollout replicates and introduce a benign covariate shift at td ∈ {5, 10, 15} with shift magnitude 0.12 and noise scale 0.03. Shift magnitude is the benign mean displacement after drift; noise scale is the standard deviation of added per-channel perturbations. Across these runs, the medianaggregation variant satisfies Proposition 2: when f < m/2, the implemented action remains within the honest recommendation range; the anchor-clip variant satisfies posterior-anchor containment, with the aggregate score remaining etu + γ]. within [e µtu − γ, µ Findings. We evaluate four key objectives below: 1. Early detection with bounded user-level false alarms: At loose-to-moderate thresholds, where intervention is operationally meaningful, BTCE is the only method with useful pre-exfiltration coverage (Fig. 1). At θ = 0.75, median BTCE achieves Pre-Exfil 28.3% at f = 3 and 17.5% at f = 9, with UFP 1.54% and 1.58%, respectively. Transformer-UBS misses every malicious user in the f = 3 runs and 95% of malicious users in the f = 9 runs; HOLMESLite’s MTTD is small, but that speed buys little early warning because its alerts land within 0.08 days of exfiltration on average, making it effectively post-hoc. At θ = 0.90, all methods lose meaningful pre-exfiltration coverage because the required evidence does not accumulate before the exfiltration window closes. Fig. 2 shows the within-BTCE tradeoff: looser thresholds improve Pre-Exfil and MTTD, conservative thresholds improve UserEver-F1, and intermediate thresholds maximize Period-F1. Anchor-clip improves Period-F1: in the closed-loop simulator, the aggregation rule changes the belief path, user actions, and attack-window labels, keeping the score above threshold across more of the kill-chain window, even when UserEver-F1 is similar. Median remains the headline mechanism because it trades this empirical aggressiveness for the honest-range guarantee of Proposition 2. 2. Behavioral vs. rational: Removing present bias delays detection at every threshold and Byzantine mix (Table 2). Behavioral BTCE has lower MTTD than rational BTCE throughout, confirming that impulsive escalation is the mechanism by which evidence drift becomes positive in finite time (Theo-

Bayesian Correlated Equilibrium for Insider-Threat Detection. BTCE (median) MTTD (days) 0.8

0.6 0.4

F1 (UserEver)

F1 (Period)

3 F1

Days

BTCE (anchor-clip)

1 0.8 0.6 0.4 0.2

Pre-Exfil (%) 30

1 0.8 0.6 0.4 0.2

1 0.2

0.75 0.85 0.90

0.8

3 F1

20 15 10 5 0

0.75 0.85 0.90 Days

0.6 0.4

1 0.75 0.85 0.90

0.75 0.85 0.90

0.2

0.75 0.85 0.90

Fig. 2. BTCE tradeoff between timing-sensitive detection and user-level capture (top row f = 3, bottom row f = 9). Lower thresholds (θ) improve Pre-Exfil and MTTD; more conservative thresholds increase UserEver-F1.

rem 2). At f = 9, anchor-clip preserves stronger timing-sensitive classification in Fig. 2, but its absolute behavioral ∆u and MTTD are comparable to or worse than median. 3. Equilibrium compliance via one-period regret: We audit on-path states using Regret(Iut ) = maxx∈Au {W (x | Iut ) − W (x̂ | Iut )}, estimating W by Monte Carlo rollouts of an obedient baseline against a one-period deviation. Fig. 3 top panel reports the audit as excess regret normalized by peak no-drift regret for drift-perturbed runs. In no-drift runs, non-target users exhibit stable regret, while target regret rises during the exfiltration window (Day 7–20) and declines after intervention, supporting restoration of obedience on the active population (Lemma 1 and Theorem 1). 4. Robustness to concept drift: We introduce a single change-point covariate shift in the benign signal distribution at td ∈ {5, 10, 15} while holding the attack process fixed, a stylized merger or system migration. MTTD remains bounded across drift start times while UFP grows with longer exposure to the shifted benign regime (Fig. 3 bottom panel). Covariate shift perturbs non-target excess regret by at most 1.3% of peak no-drift regret throughout the horizon, while target excess regret dips to roughly −41% mid-window and contracts to under −10% by day 29, indicating that the median mechanism reenters a reduced post-intervention equilibrium even under benign-distribution shift, but at the cost of a larger false-positive budget when drift arrives earlier.

Conclusion

BTCE achieves up to 28.3% pre-exfiltration detection at 1.54% UFP and detects 1.7–4.5 days earlier than a rational ablation, while both a transformer baseline and a streaming provenance system reach near-zero pre-exfiltration coverage under identical constraints. Each outcome traces back to a formal guarantee:

Shah et al. Restoration (Non-targets)

0 −20 −40 0

25 29

Excess regret (%)

Restoration (Targets) 0 −0.5 −1 −1.5

25 29

MTTD

User false positives 40 %

Days

Day

4 2 0

Day

none

Drift start

20 0

none

Drift start

Fig. 3. Concept-drift stress test for median aggregation. Top panels show restoration as excess one-step regret normalized by peak no-drift regret; solid lines are the no-drift reference, drifts start at days 5, 10, and 15. Bottom panels report MTTD and user false positives as a function of drift start time.

calibrated present-bias sanctions sustain current-self obedience, producing the impulsive escalation that drives positive evidence drift and bounds expected detection time before exfiltration; one-shot obedience rules out patient multi-period alternatives; and median aggregation preserves 17.5% pre-exfiltration coverage even under nine Byzantine certifiers. Under covariate shift the mechanism reenters a reduced post-intervention equilibrium, with MTTD bounded across all drift start times, though earlier drift widens the false-positive budget. Together these results show that grounding insider-threat detection in equilibrium coordination makes early warning auditable and creates opportunities for robust implementation in a way that purely predictive baselines cannot match.

Limitations and future work The early-detection guarantee assumes a positive drift floor λmin > 0: a patient adversary can stay within the benign noise band and drive λmin toward zero, at the cost of exfiltration throughput. Documented insiders do not appear to behave this way, present bias produces impulsive escalation rather than slow extraction, but a formal stealth–throughput tradeoff parameterized by Gsig remains open. Because drift events are typically scheduled (mergers and acquisitions), a merger-aware refit of the benign emission model on post-td samples is a natural direction for restoring the UFP budget. ITS weights and conditional probability tables should be periodically recalibrated; the DAG Gsig itself is fixed by domain knowledge (§2). We assume trusted implementation of gκ and the belief filter.

Bayesian Correlated Equilibrium for Insider-Threat Detection.

Type Evolution Dynamics

Definition 10 (Reference-point dynamics). Set ru0 = 0 (neutral baseline). Let λr ∈ [0, 1], κr ≥ 0, and Iadverse : Ac → {0, 1}. The pre-discretization update is reut+1 = (1 − λr ) rut + λr κr Iadverse (dtu ). Since B is finite, rut+1 is obtained by stochastic rounding reut+1 to the two adjacent points of R = {r(1) < · · · < r(Kr ) } ⊆ R with probabilities proportional to distance (unbiased). Absent adverse decisions rut decays toward 0; persistent adverse outcomes raise it toward κr , deepening the loss domain and triggering risk-seeking convexity in v(·). Definition 11 (Present-bias dynamics). Let ψimpulsive < ψstable in (0, 1], threshold γstress ∈ R, and stress proxy ωut := rut − ρ(xtu ) (since xtu is unobserved, t+1 ωut is inferred from the public signal). The pre-discretization update is ψepb,u = ( t ψimpulsive if ωu ≥ γstress , t+1 and ψpb,u is obtained by the same stochastic-rounding ψstable otherwise, rule applied to Ψ = {ψ (1) < · · · < ψ (Kψ ) } ⊆ (0, 1]. | btu , θut , xtu , dtu ) ∈ ∆(B) from Def. 1. A Definitions 10–11 instantiate τB (bt+1 u ′ deterministic specialization sets τB (b | b, θ, x, d) = I{b′ = F (b, θ, x, d)}, where F : B × Θuser × Au × Ac → B applies the above updates and rounds to the grid.

References 1. Aumann, R.J.: Correlated equilibrium as an expression of bayesian rationality. Econometrica 55(1), 1–18 (1987), http://www.jstor.org/stable/1911154 2. Bergemann, D., Morris, S.: Bayes correlated equilibrium and the comparison of information structures in games. Theoretical Economics 11(2), 487–522 (2016). https://doi.org/https://doi.org/10.3982/TE1808 3. Chawla, N.V., Bowyer, K.W., Hall, L.O., Kegelmeyer, W.P.: Smote: synthetic minority over-sampling technique. Journal of artificial intelligence research 16, 321– 357 (2002) 4. Cheng, Z., Lv, Q., Liang, J., Wang, Y., Sun, D., Pasquier, T., Han, X.: Kairos: Practical intrusion detection and investigation using whole-system provenance. In: 2024 IEEE Symposium on Security and Privacy (SP). pp. 3533–3551. IEEE (2024) 5. Elbasheer, M., Akinfaderin, A.: User-based sequential modeling with transformer encoders for insider threat detection (2025), https://arxiv.org/abs/2506.23446 6. Frederick, S., Loewenstein, G., O’Donoghue, T.: Time discounting and time preference: A critical review. Journal of Economic Literature 40(2), 351–401 (June 2002). https://doi.org/10.1257/002205102320161311, https://www.aeaweb. org/articles?id=10.1257/002205102320161311 7. Gavai, G., Sricharan, K., Gunning, D., Rolleston, R., Hanley, J., Singhal, M.: Detecting insider threat from enterprise social and online activity data. In: Proceedings of the 7th ACM CCS international workshop on managing insider security threats. pp. 13–20 (2015) 8. Greitzer, F., Purl, J., Leong, Y.M., Becker, D.S.: Sofit: Sociotechnical and organizational factors for insider threat. In: 2018 IEEE Security and Privacy Workshops (SPW). pp. 197–206. IEEE (2018)

Shah et al.

9. Hull, D., Eidelson, J.: Musk says tesla hit with extensive "sabotage" by rogue employee. Bloomberg Technology (2018) 10. Joshi, C., Aliaga, J.R., Insua, D.R.: Insider threat modeling: An adversarial risk analysis approach. IEEE Transactions on Information Forensics and Security 16, 1131–1142 (2021). https://doi.org/10.1109/TIFS.2020.3029898 11. Kahneman, D., Tversky, A.: Prospect theory: An analysis of decision under risk. Econometrica 47(2), 263–291 (1979), http://www.jstor.org/stable/1914185 12. Kandori, M.: Introduction to repeated games with private monitoring. Journal of Economic Theory 102(1), 1–15 (2002) 13. Laibson, D.: Golden eggs and hyperbolic discounting. The Quarterly Journal of Economics 112(2), 443–478 (1997) 14. Lamport, L., Shostak, R., Pease, M.: The Byzantine generals problem, p. 203–226. Association for Computing Machinery, New York, NY, USA (2019), https://doi. org/10.1145/3335772.3335936 15. Legg, P.A.: Visualizing the insider threat: challenges and tools for identifying malicious user activity. In: 2015 IEEE Symposium on Visualization for Cyber Security (VizSec). pp. 1–7. IEEE (2015) 16. Lindauer, B.: Insider Threat Test Dataset (9 2020). https://doi.org/10. 1184/R1/12841247.v1, https://kilthub.cmu.edu/articles/dataset/Insider_ Threat_Test_Dataset/12841247 17. Liu, D., Wang, X., Camp, J.: Game-theoretic modeling and analysis of insider threats. International Journal of Critical Infrastructure Protection 1, 75– 80 (2008). https://doi.org/https://doi.org/10.1016/j.ijcip.2008.08.001, https://www.sciencedirect.com/science/article/pii/S1874548208000036 18. Milajerdi, S.M., Gjomemo, R., Eshete, B., Sekar, R., Venkatakrishnan, V.: Holmes: real-time apt detection through correlation of suspicious information flows. In: 2019 IEEE symposium on security and privacy (SP). pp. 1137–1152. IEEE (2019) 19. O’Donoghue, T., Rabin, M.: Doing it now or later. American Economic Review 89(1), 103–124 (March 1999). https://doi.org/10.1257/aer.89.1.103, https: //www.aeaweb.org/articles?id=10.1257/aer.89.1.103 20. Sinha, A., Fang, F., An, B., Kiekintveld, C., Tambe, M.: Stackelberg security games: Looking beyond a decade of success. IJCAI (2018) 21. Trisanto, D., Rismawati, N., Mulya, M.F., Kurniadi, F.I.: Effectiveness undersampling method and feature reduction in credit card fraud detection. Int. J. Intell. Eng. Syst 13(2), 173–181 (2020) 22. Tuor, A., Kaplan, S., Hutchinson, B., Nichols, N., Robinson, S.: Deep learning for unsupervised insider threat detection in structured cybersecurity data streams. In: AAAI Workshops. pp. 224–231 (2017) 23. Tversky, A., Kahneman, D.: Advances in prospect theory: Cumulative representation of uncertainty. Journal of Risk and Uncertainty 5(4), 297–323 (1992) 24. Von Stengel, B., Forges, F.: Extensive-form correlated equilibrium: Definition and computational complexity. Mathematics of Operations Research 33(4), 1002–1022 (2008) 25. Wall, A., Agrafiotis, I.: A bayesian approach to insider threat detection. Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications 12(2) (2021)

Disclosure of Interests. The authors have no competing interests to declare that are relevant to the content of this article.

A Bayesian Correlated Equilibrium for Early Insider-Threat Detection

Analyze & explore related research in Conceptio

Related documents