The PI's publications page: http://sneakers.cs.columbia.edu/ids/publications_l.html http://sneakers.cs.columbia.edu/ids/publications_l.html "Baiting Inside Att

The PI's publications page: http://sneakers.cs.columbia.edu/ids/publications_l.html http://sneakers.cs.columbia.edu/ids/publications_l.html "Baiting Inside Attackers Using Decoy Documents" http://www.cs.columbia.edu/~bmbowen/papers/DecoyDocumentsCameraReadySECCOM09.pdf http://www.cs.columbia.edu/~bmbowen/papers/DecoyDocumentsCam... I'm not sure how this could catch a Bradley Manning without potentially influencing policy thanks to non-malicious users having access to the same documents. Also referenced in the proposal: "Designing Host and Network Sensors to Mitigate the Insider Threat" http://www.cs.columbia.edu/~bmbowen/papers/DesigningSensorsInsider.pdf http://www.cs.columbia.edu/~bmbowen/papers/DesigningSensorsI...