Fighting against insider threats involves two distinct aspects:
profiling the behavioral aspects of the insider and profiling the behavior of the data. Although the two approaches can be
performed individually, studying them collectively helps developing a better understanding of threats. We envision
detection and protection against the insider threat as a set of coordinated processes that collect network and service data,
analyze patterns of network accesses and interactions, and correlate events in order to expose the tracks of malicious
behavior.