Skip to main content

INTERACTIVE INSIDER THREAT DETECTION DEMO

Run synthetic security scenarios through behavioral normalization, sequencing, and anomaly scoring.

A security engineering portfolio project by Vyshyvka Studio

Select an incident and commence the procedure
5-stage behavioral detection pipeline
Raw Vendor Logs
2021-11-08T09:12:04Z [celFS Audit Log]
{"action":"READ","path":"/models/alpha-a/params/decorrelation","user":"jwu","workstation":"QUANT-WS-114","value":"0.85","ticket":null}
OCSF Normalization
2021-11-08T09:12:04Z [celFS Audit Log]
{"action":"READ","path":"/models/alpha-a/params/decorrelation","user":"jwu","workstation":"QUANT-WS-114","value":"0.85","ticket":null}
[File System Activity]2021-11-08T09:12:04Z
class_uid=1001activity_id=4status_id=1severity_id=1disposition_id=1
Source User: jwuSource User UID: UID-4821Source Host: QUANT-WS-114File Name: decorrelationFile Path: /models/alpha-a/params/decorrelation
2021-11-08T09:14:37Z [celFS Audit Log]
{"action":"WRITE","path":"/models/alpha-a/params/decorrelation","user":"jwu","workstation":"QUANT-WS-114","oldValue":"0.85","newValue":"0.12","ticket":null}
[File System Activity]2021-11-08T09:14:37Z
class_uid=1001activity_id=2status_id=1severity_id=1disposition_id=1
Source User: jwuSource User UID: UID-4821Source Host: QUANT-WS-114File Name: decorrelationFile Path: /models/alpha-a/params/decorrelation
2021-11-08T09:31:02Z [PAM System]
{"action":"DEPLOY_REQUEST","model":"alpha-a","requestor":"jwu","status":"auto-approved","configHash":"a3f8c21d"}
[Process Activity]2021-11-08T09:31:02Z
class_uid=1007activity_id=1status_id=1severity_id=1integrity_id=3disposition_id=1
Source User: jwuProcess Name: model-deployCommand Line: pam deploy alpha-a --config a3f8c21d
2022-01-15T10:42:18Z [celFS Audit Log]
{"action":"WRITE","path":"/models/alpha-b/params/decorrelation","user":"jwu","workstation":"QUANT-WS-114","oldValue":"0.78","newValue":"0.04","ticket":null}
[File System Activity]2022-01-15T10:42:18Z
class_uid=1001activity_id=2status_id=1severity_id=1disposition_id=1
Source User: jwuSource User UID: UID-4821Source Host: QUANT-WS-114File Name: decorrelationFile Path: /models/alpha-b/params/decorrelation
2022-01-15T11:05:44Z [PAM System]
{"action":"DEPLOY_REQUEST","model":"alpha-b","requestor":"jwu","status":"auto-approved","configHash":"e7b2d19f"}
[Process Activity]2022-01-15T11:05:44Z
class_uid=1007activity_id=1status_id=1severity_id=1integrity_id=3disposition_id=1
Source User: jwuProcess Name: model-deployCommand Line: pam deploy alpha-b --config e7b2d19f
2022-03-02T14:18:55Z [celFS Audit Log]
{"action":"WRITE","path":"/models/alpha-d/params/decorrelation","user":"jwu","workstation":"QUANT-WS-114","oldValue":"0.72","newValue":"0.02","ticket":"CELFS-2891"}
[File System Activity]2022-03-02T14:18:55Z
class_uid=1001activity_id=2status_id=1severity_id=1disposition_id=1
Source User: jwuSource User UID: UID-4821Source Host: QUANT-WS-114File Name: decorrelationFile Path: /models/alpha-d/params/decorrelation
2022-03-02T14:44:31Z [PAM System]
{"action":"DEPLOY_REQUEST","model":"alpha-d","requestor":"jwu","status":"auto-approved","configHash":"c4a1f83b"}
[Process Activity]2022-03-02T14:44:31Z
class_uid=1007activity_id=1status_id=1severity_id=1integrity_id=3disposition_id=1
Source User: jwuProcess Name: model-deployCommand Line: pam deploy alpha-d --config c4a1f83b
2022-05-11T09:33:12Z [celFS Audit Log]
{"action":"WRITE","path":"/models/alpha-e/params/decorrelation","user":"jwu","workstation":"QUANT-WS-114","oldValue":"0.80","newValue":"0.01","ticket":"CELFS-3204"}
[File System Activity]2022-05-11T09:33:12Z
class_uid=1001activity_id=2status_id=1severity_id=2disposition_id=1
Source User: jwuSource User UID: UID-4821Source Host: QUANT-WS-114File Name: decorrelationFile Path: /models/alpha-e/params/decorrelation
2022-05-11T09:55:48Z [PAM System]
{"action":"DEPLOY_REQUEST","model":"alpha-e","requestor":"jwu","status":"auto-approved","configHash":"f912ab4e"}
[Process Activity]2022-05-11T09:55:48Z
class_uid=1007activity_id=1status_id=1severity_id=2integrity_id=3disposition_id=1
Source User: jwuProcess Name: model-deployCommand Line: pam deploy alpha-e --config f912ab4e
2022-08-19T11:07:22Z [celFS Audit Log]
{"action":"BATCH_WRITE","paths":["/models/alpha-f/params/decorrelation","/models/alpha-g/params/decorrelation","/models/alpha-h/params/decorrelation"],"user":"jwu","workstation":"QUANT-WS-114","newValues":["0.01","0.03","0.00"],"ticket":"CELFS-3587"}
[File System Activity]2022-08-19T11:07:22Z
class_uid=1001activity_id=2status_id=1severity_id=3disposition_id=1
Source User: jwuSource User UID: UID-4821Source Host: QUANT-WS-114File Name: decorrelationFile Path: /models/alpha-{f,g,h}/params/decorrelation
2022-08-19T11:38:09Z [PAM System]
{"action":"BATCH_DEPLOY","models":["alpha-f","alpha-g","alpha-h"],"requestor":"jwu","status":"auto-approved","configHashes":["b88e1a2c","d44f7e91","a21c09b5"]}
[Process Activity]2022-08-19T11:38:09Z
class_uid=1007activity_id=1status_id=1severity_id=3integrity_id=3disposition_id=1
Source User: jwuProcess Name: model-deployCommand Line: pam deploy alpha-f,g,h --batch
2022-11-03T15:22:41Z [Model Correlation Monitor]
{"alert":"HIGH_CORRELATION","modelPairs":"alpha-a/alpha-b, alpha-d/alpha-e, alpha-f/alpha-g","correlationCoeff":0.97,"expectedRange":"0.15-0.35","assignedTo":null}
[Network Activity]2022-11-03T15:22:41Z
class_uid=4001activity_id=1status_id=1severity_id=4direction_id=0action_id=1
Source Host: model-correlation-monitorDestination Host: alpha-cluster
Behavioral Tokenization
[File System Activity]
class_uid=1001activity_id=4status_id=1severity_id=1
File:Read:Success:Info:Allowed3102
[File System Activity]
class_uid=1001activity_id=2status_id=1severity_id=1
File:Modify:Success:Info:Allowed3155
[Process Activity]
class_uid=1007activity_id=1status_id=1severity_id=1
Process:Launch:Success:Info:System:Allowed5044
[File System Activity]
class_uid=1001activity_id=2status_id=1severity_id=1
File:Modify:Success:Info:Allowed3155
[Process Activity]
class_uid=1007activity_id=1status_id=1severity_id=1
Process:Launch:Success:Info:System:Allowed5044
[File System Activity]
class_uid=1001activity_id=2status_id=1severity_id=1
File:Modify:Success:Info:Allowed3155
[Process Activity]
class_uid=1007activity_id=1status_id=1severity_id=1
Process:Launch:Success:Info:System:Allowed5044
[File System Activity]
class_uid=1001activity_id=2status_id=1severity_id=2
File:Modify:Success:Low:Allowed3158
[Process Activity]
class_uid=1007activity_id=1status_id=1severity_id=2
Process:Launch:Success:Low:System:Allowed5102
[File System Activity]
class_uid=1001activity_id=2status_id=1severity_id=3
File:Modify:Success:Medium:Allowed3190
[Process Activity]
class_uid=1007activity_id=1status_id=1severity_id=3
Process:Launch:Success:Medium:System:Allowed5190
[Network Activity]
class_uid=4001activity_id=1status_id=1severity_id=4
Network:Traffic:Success:High:Unknown:Allowed6844
Sequence Assembly
SOS0
Start of Sequence
Narrative Analysis
09:12:04File:Read:Success:Info:AllowedResearcher reads decorrelation parameter for Model A — routine access
09:14:37File:Modify:Success:Info:AllowedParameter write to Model A decorrelation — value reduced significantly
09:31:02Process:Launch:Success:Info:System:AllowedModel A deployment via PAM — follows parameter modification
10:42:18File:Modify:Success:Info:AllowedSame parameter write pattern now on Model B — sequence repeating
11:05:44Process:Launch:Success:Info:System:AllowedModel B deploy — write→deploy pattern now seen twice for this identity
14:18:55File:Modify:Success:Info:AllowedThird model targeted — same celFS write pattern, decorrelation near-zero
14:44:31Process:Launch:Success:Info:System:AllowedThird write→deploy in sequence — behavioral frequency diverging from baseline
09:33:12File:Modify:Success:Low:AllowedFourth model — identical pattern is now statistically anomalous
09:55:48Process:Launch:Success:Low:System:AllowedFourth deploy — write→deploy→write→deploy is now a locked behavioral loop
11:07:22File:Modify:Success:Medium:AllowedBatch write across three models at once — acceleration of established anomalous pattern
11:38:09Process:Launch:Success:Medium:System:AllowedBatch deploy of three models — same identity, same pattern, scaling up
15:22:41Network:Traffic:Success:High:Unknown:AllowedModels showing 0.97 correlation where 0.15-0.35 expected — the mirror effect

What Happened

Quantitative researcher Jian Wu at Two Sigma systematically reduced decorrelation parameters to near-zero across 14 algorithmic investment models over 21 months. Models stopped generating independent alpha and began mirroring profitable positions, inflating his compensation from $2.75M to $23.5M. No system detected it. An anonymous social media post did.