US Patent 9609010 System and method for detecting insider threats

An approach for detecting an insider threat is described. Embodiments include determining one or more features from one or more network transfers among a plurality of network entities, determining a baseline behavioral profile of the plurality of network entities based on the one or more features; and determining at least one malicious network entity from among the plurality of network entities based on a systematic deviation from the baseline behavioral profile of at least one of the one or more features.