Abstract:An insider threat scenario refers to the outcome of a set of malicious activities caused by intentional or unintentional misuse of the organization’s systems, networks, data, and resources. Prevention of insider threat is difficult, since trusted partners of the organization are involved in it, who have authorized access to these confidential/sensitive resources. The state-of-the-art research on insider threat detection mostly focuses on developing unsupervised behavioral anomaly detection techniques with the objective of finding out anomalousness or abnormal changes in user behavior over time. However, an anomalous activity is not necessarily malicious that can lead to an insider threat scenario. As an improvement to the existing approaches, we propose a technique for insider threat detection from time-series classification of user activities. Initially, a set of single-day features is computed from the user activity logs. A time-series feature vector is next constructed from the statistics of each single-day feature over a period of time. The label of each time-series feature vector (whether malicious or nonmalicious) is extracted from the ground truth. To classify the imbalanced ground-truth insider threat data consisting of only a small number of malicious instances, we employ a cost-sensitive data adjustment technique that undersamples the nonmalicious class instances randomly. As a classifier, we employ a two-layered deep autoencoder neural network and compare its performance with other popularly used classifiers: random forest and multilayer perceptron. Encouraging results are obtained by evaluating our approach using the CMU Insider Threat Data, which is the only publicly available insider threat data set consisting of about 14-GB web-browsing logs, along with logon, device connection, file transfer, and e-mail log files. We observe that both deep autoencoder and random forest classifiers classify the data-adjusted time-series feature set with high precision, recall, and f-score. Although multilayer perceptron has a high recall, it suffers from a lower precision and f-score compared to the other two classifiers.

CPID: Insider Threat Detection using Profiling and Cyber-Persona Identification

Dynamical System approach to insider threat detection

Proactive Insider Threat Detection through Graph Learning and Psychological Context

Behavioral Based Insider Threat Detection Using Deep Learning

Towards in-situ Psychological Profiling of Cybercriminals Using Dynamically Generated Deception Environments

Recognition of Cyber-Intrusion patterns in user cognitive behavioural characteristics for remote identification

User Behaviour based Insider Threat Detection using a Hybrid Learning Approach

Scenario-Based Insider Threat Detection From Cyber Activities

Personalized User Profiles-based Insider Threat Detection for Distributed File System

Enhancing societal security: a multimodal deep learning approach for a public person identification and tracking system

Analysis of Encrypted Network Traffic for Enhancing Cyber-security in Dynamic Environments

GraphCH: A Deep Framework for Assessing Cyber-Human Aspects in Insider Threat Detection

Darknet Traffic Big-Data Analysis and Network Management to Real-Time Automating the Malicious Intent Detection Process by a Weight Agnostic Neural Networks Framework

An Insider Threat Detection Approach Based on Mouse Dynamics and Deep Learning

Intrusion Detection using Network Traffic Profiling and Machine Learning for IoT

User Behavior Traffic Analysis Using a Simplified Memory-Prediction Framework

A PREDICTIVE USER BEHAVIOUR ANALYTIC MODEL FOR INSIDER THREATS IN CYBERSPACE

Detection of Insider Threats using Artificial Intelligence and Visualisation

Deep Learning and Dempster-Shafer Theory Based Insider Threat Detection

User identification in cyber-physical space: a case study on mobile query logs and trajectories.

A Novel Network Forensic Framework for Advanced Persistent Threat Attack Attribution Through Deep Learning