Image-Based Feature Representation for Insider Threat Classification
Open accessAbstract
Cybersecurity attacks can arise from internal and external sources. The attacks perpetrated by internal sources are also referred to as insider threats. These are a cause of serious concern to organizations because of the significant damage that can be inflicted by malicious insiders. In this paper, we propose an approach for insider threat classification which is motivated by the effectiveness of pre-trained deep convolutional neural networks (DCNNs) for image classification. In the proposed approach, we extract features from usage patterns of insiders and represent these features as images. Hence, images are used to represent the resource access patterns of the employees within an organization. After construction of images, we use pre-trained DCNNs for anomaly detection, with the aim to identify malicious insiders. Random under sampling is used for reducing the class imbalance issue. The proposed approach is evaluated using the MobileNetV2, VGG19, and ResNet50 pre-trained models, and a benchmark dataset. Experimental results show that the proposed method is effective and outperforms other state-of-the-art methods.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Gayathri et al. [23] model got a precision of 99.32%.
“They applied the random under sampling method to address the imbalance issue in the dataset and obtained an accuracy score of 99%, precision of 99.32%, and recall of 99.32%.”
From Enhancing Insider Threat Detection in Imbalanced Cybersecurity Settings Using the Density-Based Local Outlier Factor Algorithm (2024) · cites this paper as [23]
Gayathri et al. [23] model got a recall of 99.32%.
“They applied the random under sampling method to address the imbalance issue in the dataset and obtained an accuracy score of 99%, precision of 99.32%, and recall of 99.32%.”
From Enhancing Insider Threat Detection in Imbalanced Cybersecurity Settings Using the Density-Based Local Outlier Factor Algorithm (2024) · cites this paper as [23]
Gayathri et al. [23] model got an accuracy score of 99%.
“They applied the random under sampling method to address the imbalance issue in the dataset and obtained an accuracy score of 99%, precision of 99.32%, and recall of 99.32%.”
From Enhancing Insider Threat Detection in Imbalanced Cybersecurity Settings Using the Density-Based Local Outlier Factor Algorithm (2024) · cites this paper as [23]
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474 · see citing works
Convolutional neural networks: an overview and application in radiology
Yamashita, R., Nishio, M., Do, R. K. G., & Togashi, K. (2018) · Insights into Imaging · doi:10.1007/s13244-018-0639-9 · Cited by 4,682 · cited 5× · see citing works
“Deep Convolutional Neural Networks(DCNNs or DeepCon-vNets) proved to be highly efficient in handling visual data, such as images and videos [1].”
MethodInfluentialBridging the Gap: A Pragmatic Approach to Generating Insider Threat Data
Glasser, J., & Lindauer, B. (2013) · 2013 IEEE Security and Privacy Workshops · doi:10.1109/spw.2013.37 · Cited by 344 · see citing works
Insider Threat Detection with Deep Neural Network
Yuan, F., Cao, Y., Shang, Y., Liu, Y., Tan, J., & Fang, B. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-93698-7_4 · Cited by 168 · see citing works
Scenario-Based Insider Threat Detection From Cyber Activities
Chattopadhyay, P., Wang, L., & Tan, Y.-P. (2018) · IEEE Transactions on Computational Social Systems · doi:10.1109/tcss.2018.2857473 · Cited by 115 · see citing works
Anomaly-Based Insider Threat Detection Using Deep Autoencoders
Liu, L., De Vel, O., Chen, C., Zhang, J., & Xiang, Y. (2018) · 2018 IEEE International Conference on Data Mining Workshops (ICDMW) · doi:10.1109/icdmw.2018.00014 · Cited by 79 · see citing works
Self-citationDeep Learning Based Attribute Classification Insider Threat Detection for Data Security
Meng, F., Lou, F., Fu, Y., & Tian, Z. (2018) · 2018 IEEE Third International Conference on Data Science in Cyberspace (DSC) · doi:10.1109/dsc.2018.00092 · Cited by 74 · see citing works
Classification of Insider Threat Detection Techniques
Sanzgiri, A., & Dasgupta, D. (2016) · Proceedings of the 11th Annual Cyber and Information Security Research Conference · doi:10.1145/2897795.2897799 · Cited by 68 · see citing works
Classifier Suites for Insider Threat Detection
Noever, D. (2019) · arXiv · doi:10.48550/arxiv.1901.10948 · Cited by 16 · see citing works
Image Anomaly Detection with Capsule Networks and Imbalanced Datasets
Piciarelli, C., Mishra, P., & Foresti, G. L. (2019) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-30642-7_23 · Cited by 10 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Alzaabi, F. R., & Mehmood, A. (2024) · IEEE Access · doi:10.1109/access.2024.3369906 · Cited by 204 · see citing works
“Unsupervised learning approaches, including clustering algorithms like K-Means and hierarchical clustering, are adept at grouping similar behavioral patterns and flagging outliers [61], [70], [71], [72].”
MethodInsider Threat Detection Using Machine Learning Approach
Bin Sarhan, B., & Altwaijry, N. (2022) · Applied Sciences · doi:10.3390/app13010259 · Cited by 111 · see citing works
Insider threat detection model using anomaly-based Isolation Forest algorithm
Al-Shehari, T., Al-Razgan, M., Alfakih, T., Alsowail, R. A., & Pandiaraj, S. (2023) · IEEE Access · doi:10.1109/access.2023.3326750 · Cited by 52 · see citing works
Temporal feature aggregation with attention for insider threat detection from activity logs
Pal, P., Chattopadhyay, P., & Swarnkar, M. (2023) · Expert Systems with Applications · doi:10.1016/j.eswa.2023.119925 · Cited by 52 · see citing works
Al-Shehari, T. A., Rosaci, D., Al-Razgan, M., Alfakih, T., Kadrie, M., Afzal, H., & Nawaz, R. (2024) · IEEE Access · doi:10.1109/access.2024.3373694 · Cited by 51 · see citing works
Double layer detection of internal threat in enterprise systems based on deep learning
He, D., Lv, X., Xu, X., Chan, S., & Choo, K.-K. R. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3372771 · Cited by 31 · see citing works
Randive, K., Mohan, R., & Sivakrishna, A. M. (2023) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2023.103434 · Cited by 27 · see citing works
Image-Based Insider Threat Detection via Geometric Transformation
Li, D., Yang, L., Zhang, H., Wang, X., Ma, L., & Xiao, J. (2021) · Security and Communication Networks · doi:10.1155/2021/1777536 · Cited by 22 · see citing works
Detecting an Insider Threat and Analysis of XGBoost using Hyperparameter tuning
Mamidanna, S. K., Reddy, C. R. K., & Gujju, A. (2022) · 2022 International Conference on Advances in Computing, Communication and Applied Informatics (ACCAI) · doi:10.1109/accai53970.2022.9752509 · Cited by 14 · see citing works
- Authors
- Gayathri, R. G., Sajjanhar, A., & Xiang, Y.
- Affiliations
- Deakin University (AU)
- Corresponding author
- Sajjanhar, Atul
- ORCID
- Sajjanhar, Atul
- Venue
- Applied Sciences
- Publisher
- MDPI AG
- Published
- 2020-07-18
- Volume
- 10
- Issue
- 14
- Pages
- 4945
- ISSN
- 2076-3417 (ISSN-L)
- OpenAlex
- W2985983260
- Cited by
- 63
- References
- 10
- Citations by year
- 2026: 6 · 2025: 13 · 2024: 14 · 2023: 16 · 2022: 7 · 2021: 6 · 2020: 1
- FWCI
- 3.52
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Applied Sciences (publishedVersion, cc-by)
- arXiv (Cornell University) (submittedVersion)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Figshare (submittedVersion, cc-by)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- insider threat detection, anomaly detection, pre-trained convolutional neural networks, class imbalance, random undersampling, MobileNetV2, VGG19, ResNet50
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
