Page 20 - ISCI’2017

3 MCRIM-Method to Identify Insiders Within a Critical Infrastructure

The Matrix method (MM) and the Base criteria method (CRIM), their essence, advantages, and

disadvantages were described in the following publications (Kavun, Sorbat and Kalashnikov, 2012;
Kavun and Brumnik, 2013). One of the disadvantages of the CRIM is in that the analysis of the input

data use the same number of the considered criteria’s for different job categories, which does not
allow us to allocate the risk zone Z (Kavun and Sorbat, 2012). Therefore, a modification of the CRIM

has been carried out based on the CRIM multistage filtration, thus yielding the MCRIM method.

At the first stage of the filtration, some coefficients of an importance of the criterion should
be selected – kvpi (in our example, for 10 criteria from Table 2). In this case, a one-dimension matrix

of these importance of the criterion can be built as KVP = {kvpi} = 1÷100. At the same time, all

volumes of the indicators have been detected with the help of the expert method (employer can hire
some expert, or that may be the organization’s employee):

� = 100, (1)

=1
where i is the number of criteria estimations (reasons).

At the second stage, a dynamic accounting of criteria is introduced. The matrix PDKD

dynamic accounting criteria is also determined, which will be different of increasing of the number
of columns that eventually allows counting the days, months, weeks, etc.

The rows of the matrix PDKD are the job categories of the organization’s employees (for
example, it can be a hospital or any other medical establishment), and the columns are days, months,

and years (any time period). The sum of all the criteria (features) identified in a single day of the

month (Table 3) is put in the last cell. Parameter dr has been introduced for the dynamic accounting.

Table 2 – The coefficient matrix of the importance of the criterion (feature), KVP
№ the criterion (feature) kvpi № the criterion (feature) kvpi

1 P1 8 6 P6 14

2 P2 12 7 P7 11
3 P3 6 8 P8 8

4 P4 5 9 P9 16

5 P5 13 10 P10 7
∑ = ( over all values) 5600

20