Abstract:An insider threat scenario refers to the outcome of a set of malicious activities caused by intentional or unintentional misuse of the organization’s systems, networks, data, and resources. Prevention of insider threat is difficult, since trusted partners of the organization are involved in it, who have authorized access to these confidential/sensitive resources. The state-of-the-art research on insider threat detection mostly focuses on developing unsupervised behavioral anomaly detection techniques with the objective of finding out anomalousness or abnormal changes in user behavior over time. However, an anomalous activity is not necessarily malicious that can lead to an insider threat scenario. As an improvement to the existing approaches, we propose a technique for insider threat detection from time-series classification of user activities. Initially, a set of single-day features is computed from the user activity logs. A time-series feature vector is next constructed from the statistics of each single-day feature over a period of time. The label of each time-series feature vector (whether malicious or nonmalicious) is extracted from the ground truth. To classify the imbalanced ground-truth insider threat data consisting of only a small number of malicious instances, we employ a cost-sensitive data adjustment technique that undersamples the nonmalicious class instances randomly. As a classifier, we employ a two-layered deep autoencoder neural network and compare its performance with other popularly used classifiers: random forest and multilayer perceptron. Encouraging results are obtained by evaluating our approach using the CMU Insider Threat Data, which is the only publicly available insider threat data set consisting of about 14-GB web-browsing logs, along with logon, device connection, file transfer, and e-mail log files. We observe that both deep autoencoder and random forest classifiers classify the data-adjusted time-series feature set with high precision, recall, and f-score. Although multilayer perceptron has a high recall, it suffers from a lower precision and f-score compared to the other two classifiers.

Insider Threat Modeling: An Adversarial Risk Analysis Approach

Model Based Analysis of Insider Threats

Dynamical System approach to insider threat detection

Insight into Insiders: A Survey of Insider Threat Taxonomies, Analysis, Modeling, and Countermeasures

Insight into Insiders and IT: A Survey of Insider Threat Taxonomies, Analysis, Modeling, and Countermeasures

Defense for Advanced Persistent Threat with Inadvertent and Malicious Insider Threats

Defense for Advanced Persistent Threat with Inadvertent or Malicious Insider Threats

Analysis of Research on Specific Insider Information Security Threats

A Probabilistic Analysis Framework for Malicious Insider Threats.

Insider Threats in a Financial Institution: Analysis of Attack-Proneness of Information Systems Applications

Insider Threat Detection Based on User Behavior Modeling and Anomaly Detection Algorithms

Potential Malicious Insiders Detection Based on a Comprehensive Security Psychological Model

A Graph Based Framework for Malicious Insider Threat Detection

Defense of Advanced Persistent Threat on Industrial Internet of Things With Lateral Movement Modeling

Insider Threats Mitigation: Role of Penetration Testing

Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data

Evaluating Attacker Risk Behavior in an Internet of Things Ecosystem

Insider threats in Cyber Security: The enemy within the gates

Research of Insider Threat Based on Bayesian Learning Theory

A Hybrid Model Based On Multi-Dimensional Features For Insider Threat Detection

Scenario-Based Insider Threat Detection From Cyber Activities