Abstract: The insider behaviors in the traditional Operating System are distrustful, because the access control theories in the traditional Operating System is a kind of ＂gate control＂, which don＇t permit someone who has no the right identity to come in, but once t

Key words: User behavior, Insider threat, Open authorization, Behavior tree, OS behavior tree, User behavior tree, Behavior trace, Behavior monitoring