The model of the set of information spaces in the problem of insider detection

In the problem of insider detection, the approach to combining compromising data observed in different information spaces is developed. Accumulation of information in each space is considered as a random process. The considered approach is based on bans and semibans of probability measures in different information spaces. Boolean variables communicate with the help of sequences of events observed in the information spaces. Appearance of semibans corresponds to value “1” of the appropriate Boolean variables. Sequences of Boolean variables in different information spaces easily communicate by means of logical expressions. The expressions describe dangerous tendencies observed in different information spaces.