OPERATIONALISATION OF OSINT FEATURES AND A HYBRID MODEL FOR PREDICTING INSIDER INCIDENTS

Abstract

The article proposes a methodological approach to predicting insider incidents. The approach combines the operationalisation of open-source intelligence (OSINT) features with a hybrid model that accounts for the structure of the corporate graph. The behavioural precursors of internal incidents – disgruntlement, financial pressure, external affiliations and job-search activity – often surface in the public digital space earlier than in an organisation’s internal telemetry. Yet their conversion into valid, reliable and lawfully admissible model features remains an unsolved task. Operationalisation is presented as a chain of mappings: a latent construct, an indicator, an OSINT source, a measurement with normalisation, and a ready feature that is merged with internal access and activity metrics. A taxonomy of OSINT features across eight categories is proposed together with four quality criteria: content validity, measurement reliability, temporal lead and lawfulness of collection. A computational experiment on a synthetic set of two thousand user profiles showed that, under the stated scenario assumptions, adding OSINT features raises the area under the ROC curve from 0.685 to 0.772, improves precision on the rare class and provides a noticeable lead of the signal before an incident. The second part of the study addresses the limitations of existing graph-based approaches. Five shortcomings are systematised; the principal ones are the homophily assumption of message passing, oversmoothing of representations at privileged hub nodes, and unexamined adversarial robustness. A hybrid model is built with these in mind. It integrates OSINT features, internal telemetry and the structural signal of the communication and resource-access graph, and performs propagation with heterophily-robust operators. In an experiment harmonised with the first stage in terms of baseline levels, the structural signal raises the area under the ROC curve to 0.831. On the privileged account segment, deep homophilous convolution degrades, whereas heterophily-robust architectures maintain quality at 0.80–0.82 and achieve the lowest calibration error. For the first time in this task, adversarial robustness is quantified. Masking the open digital footprint together with concealing anomalous ties reduces predictive quality to the level of telemetry alone. The proposed defensive fine-tuning with masked augmentation partially restores robustness without a substantial loss of clean-condition quality. The ethical and legal limits to applying OSINT in personnel processes are also outlined in accordance with personal data protection principles.