Abstract:An insider threat scenario refers to the outcome of a set of malicious activities caused by intentional or unintentional misuse of the organization’s systems, networks, data, and resources. Prevention of insider threat is difficult, since trusted partners of the organization are involved in it, who have authorized access to these confidential/sensitive resources. The state-of-the-art research on insider threat detection mostly focuses on developing unsupervised behavioral anomaly detection techniques with the objective of finding out anomalousness or abnormal changes in user behavior over time. However, an anomalous activity is not necessarily malicious that can lead to an insider threat scenario. As an improvement to the existing approaches, we propose a technique for insider threat detection from time-series classification of user activities. Initially, a set of single-day features is computed from the user activity logs. A time-series feature vector is next constructed from the statistics of each single-day feature over a period of time. The label of each time-series feature vector (whether malicious or nonmalicious) is extracted from the ground truth. To classify the imbalanced ground-truth insider threat data consisting of only a small number of malicious instances, we employ a cost-sensitive data adjustment technique that undersamples the nonmalicious class instances randomly. As a classifier, we employ a two-layered deep autoencoder neural network and compare its performance with other popularly used classifiers: random forest and multilayer perceptron. Encouraging results are obtained by evaluating our approach using the CMU Insider Threat Data, which is the only publicly available insider threat data set consisting of about 14-GB web-browsing logs, along with logon, device connection, file transfer, and e-mail log files. We observe that both deep autoencoder and random forest classifiers classify the data-adjusted time-series feature set with high precision, recall, and f-score. Although multilayer perceptron has a high recall, it suffers from a lower precision and f-score compared to the other two classifiers.

Dimensionality reduction techniques to support insider trading detection

A machine learning approach to support decision in insider trading detection

Detecting Insider Trading in the Era of Big Data and Machine Learning

Network-based Anomaly Detection for Insider Trading

A Random Forest approach to detect and identify Unlawful Insider Trading

Sentiment-driven deep learning framework for insider trading detection in Indian stock market

Identification of Insider Trading in the Securities Market Based on Multi-task Deep Neural Network

Mining Illegal Insider Trading of Stocks: A Proactive Approach

A Regularized High-Dimensional Positive Definite Covariance Estimator with High-Frequency Data

Predicting shareholder litigation on insider trading from financial text: An interpretable deep learning approach

Large-Dimensional Positive Definite Covariance Estimation for High Frequency Data via Low-rank and Sparse Matrix Decomposition

Stock Price Manipulation Detection based on Autoencoder Learning of Stock Trades Affinity

Deep Semi-Supervised Anomaly Detection for Finding Fraud in the Futures Market

Stock Price Manipulation Detection using Variational Autoencoder and Recurrence Plots

Pattern Recognition in Microtrading Behaviors Preceding Stock Price Jumps: A Study Based on Mutual Information for Multivariate Time Series

Patterns of trading profiles at the Nordic Stock Exchange. A correlation-based approach

Applied Machine Learning to Anomaly Detection in Enterprise Purchase Processes

Discrimination on Insider manipulation With Data Mining Methods

Scenario-Based Insider Threat Detection From Cyber Activities

Stock Market Data Using Data Mining For Feature Extraction

Anomaly detection in cross-country money transfer temporal networks