Abstract:In today's interconnected world, cybersecurity has emerged as a critical domain for ensuring the integrity, confidentiality, and availability of digital assets. Within this sphere, insider threats represent a unique and particularly insidious class of security risks, originating not from external hackers but from within the organization itself. These threats are perpetrated by individuals with inside information concerning the organization's security practices, data, and computer systems. Traditional security measures like firewalls, intrusion detection systems, and antivirus software are often inadequate for tackling insider threats effectively, owing to their focus on external threats. This inadequacy underscores the urgent need for the development and implementation of more sophisticated, targeted detection techniques for insider threats. In response to this challenge, our research introduces an innovative approach that employs the Density-Based Local Outlier Factor (DBLOF) algorithm, fine-tuned to specifically tackle the challenges posed by the imbalanced nature of the CERT r4.2 insider threat dataset. This dataset is characterized by a highly skewed distribution, with a significant majority of benign instances and only a minimal proportion of malicious activities. Conventional detection algorithms often fail to effectively identify these rare but dangerous instances, leading to a high rate of false negatives. Our methodology capitalizes on the algorithm's ability to focus on the local density deviation of data points, thereby enabling the precise identification of outliers that are indicative of potential insider threats. Through rigorous testing and validation processes, we have achieved outstanding results, with an of F-score 98%. These remarkable outcomes not only affirm the effectiveness of the DBLOF algorithm as a powerful tool for combating insider threats but also contribute valuable insights to the broader academic and professional discourse on cybersecurity. Importantly, our findings have practical implications, offering organizations actionable recommendations for boosting their internal security mechanisms against the complex and evolving landscape of insider threats.

Distance Measurement Methods for Improved Insider Threat Detection

User Behaviour based Insider Threat Detection using a Hybrid Learning Approach

Dynamical System approach to insider threat detection

A Novel Intrusion Detection System Based on an Optimal Hybrid Kernel Extreme Learning Machine

Insider threat detection using supervised machine learning algorithms

Scenario-Based Insider Threat Detection From Cyber Activities

A Review of Recent Advances, Challenges, and Opportunities in Malicious Insider Threat Detection Using Machine Learning Methods

Deep Learning and Dempster-Shafer Theory Based Insider Threat Detection

Enhancing Insider Threat Detection in Imbalanced Cybersecurity Settings Using the Density-Based Local Outlier Factor Algorithm

E-Watcher: insider threat monitoring and detection for enhanced security

Random resampling algorithms for addressing the imbalanced dataset classes in insider threat detection

Deep Learning for Insider Threat Detection: Review, Challenges and Opportunities

Doc2vec-Based Insider Threat Detection through Behaviour Analysis of Multi-source Security Logs

A Graph Based Framework for Malicious Insider Threat Detection

Machine learning approaches to detect, prevent and mitigate malicious insider threats: State-of-the-art review

Unsupervised User-Based Insider Threat Detection Using Bayesian Gaussian Mixture Models

Detecting and Identifying Insider Threats Based on Advanced Clustering Methods

Insider Threat Detection: Exploring User Event Behavior Analytics and Machine Learning in Security Reviews

Predicting Malicious Insider Threat Scenarios Using Organizational Data and a Heterogeneous Stack-Classifier

Insider Threat Detection Based on User Behavior Modeling and Anomaly Detection Algorithms

Detection of Insider Threats using Artificial Intelligence and Visualisation