CoChat
Sign Up
Cited by 193Information and Cyber SecurityNetwork Security and Intrusion DetectionPrivacy-Preserving Technologies in Data

An Insider Data Leakage Detection Using One-Hot Encoding, Synthetic Minority Oversampling and Machine Learning Techniques

Open access
Al-Shehari, Taher, Alsowail, Rakan A.·2021·Entropy
DOI 10.3390/e23101258PMC PMC8535057
Open this paper in CoChat — free accountOpen PDF

Abstract

Insider threats are malicious acts that can be carried out by an authorized employee within an organization. Insider threats represent a major cybersecurity challenge for private and public organizations, as an insider attack can cause extensive damage to organization assets much more than external attacks. Most existing approaches in the field of insider threat focused on detecting general insider attack scenarios. However, insider attacks can be carried out in different ways, and the most dangerous one is a data leakage attack that can be executed by a malicious insider before his/her leaving an organization. This paper proposes a machine learning-based model for detecting such serious insider threat incidents. The proposed model addresses the possible bias of detection results that can occur due to an inappropriate encoding process by employing the feature scaling and one-hot encoding techniques. Furthermore, the imbalance issue of the utilized dataset is also addressed utilizing the synthetic minority oversampling technique (SMOTE). Well known machine learning algorithms are employed to detect the most accurate classifier that can detect data leakage events executed by malicious insiders during the sensitive period before they leave an organization. We provide a proof of concept for our model by applying it on CMU-CERT Insider Threat Dataset and comparing its performance with the ground truth. The experimental results show that our model detects insider data leakage events with an AUC-ROC value of 0.99, outperforming the existing approaches that are validated on the same dataset. The proposed model provides effective methods to address possible bias and class imbalance issues for the aim of devising an effective insider data leakage detection system.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.3390/e23101258

Cites

76 of 77 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • AlShehari et al. [35] achieved an F-score for RF of 99%.

    “This method achieved an F-score for the employed algorithms as (LR: 67%, DT: 99%, RF: 99%, NB: 85%, KNN: 98%).”

    From Enhancing Insider Threat Detection in Imbalanced Cybersecurity Settings Using the Density-Based Local Outlier Factor Algorithm (2024) · cites this paper as [35]

    Section 4.3 reports that, with SMOTE, RF was among the algorithms whose F-measure scores were between 98% and 99%. The passage does not specify RF’s exact F-measure, so it does not establish the cited 99% figure. (LLM, conf=0.82)

    Experimental — accuracy not yet measured

  • AlShehari et al. [35] achieved an F-score for KNN of 98%.

    “This method achieved an F-score for the employed algorithms as (LR: 67%, DT: 99%, RF: 99%, NB: 85%, KNN: 98%).”

    From Enhancing Insider Threat Detection in Imbalanced Cybersecurity Settings Using the Density-Based Local Outlier Factor Algorithm (2024) · cites this paper as [35]

    Section 4.3 (SMOTE) reports that KNN was among the algorithms whose precision, recall and F-measure scores were between 98% and 99%. This supports a high KNN F-score, but the passage does not establish that its F-score specifically was 98%. (LLM, conf=0.80)

    Experimental — accuracy not yet measured

  • AlShehari et al. [35] achieved an F-score for DT of 99%.

    “This method achieved an F-score for the employed algorithms as (LR: 67%, DT: 99%, RF: 99%, NB: 85%, KNN: 98%).”

    From Enhancing Insider Threat Detection in Imbalanced Cybersecurity Settings Using the Density-Based Local Outlier Factor Algorithm (2024) · cites this paper as [35]

    Section 4.3 (page unavailable) reports that, with SMOTE, DT, RF and KNN attained precision, recall and F-measure scores between 98% and 99%. This supports a high DT F-score, but the passage does not specify whether DT’s F-score was exactly 99%. (LLM, conf=0.78)

    Experimental — accuracy not yet measured

  • AlShehari et al. [35] achieved an F-score for LR of 67%.

    “This method achieved an F-score for the employed algorithms as (LR: 67%, DT: 99%, RF: 99%, NB: 85%, KNN: 98%).”

    From Enhancing Insider Threat Detection in Imbalanced Cybersecurity Settings Using the Density-Based Local Outlier Factor Algorithm (2024) · cites this paper as [35]

    Section 4.3 discusses F-measure results under SMOTE but gives no LR F-score in the passages available from our copy; it reports an LR AUC-ROC value of 0.79, which is a different metric. Searches for “67%,” “0.67,” and LR F-measure did not locate the claimed 67% figure. (LLM, conf=0.72)

    Experimental — accuracy not yet measured

  • AlShehari et al. [35] achieved an F-score for NB of 85%.

    “This method achieved an F-score for the employed algorithms as (LR: 67%, DT: 99%, RF: 99%, NB: 85%, KNN: 98%).”

    From Enhancing Insider Threat Detection in Imbalanced Cybersecurity Settings Using the Density-Based Local Outlier Factor Algorithm (2024) · cites this paper as [35]

    Section 4.3 discusses F-measure results with SMOTE but does not give an NB F-score in the passages available from our copy. Section 5 reports an NB AUC-ROC value of 0.84, which is a different metric. Searches for “85%” and “Table 11 NB precision recall F-measure 0.85” did not locate the claimed 85% F-score. (LLM, conf=0.68)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

1 of the 78 references couldn’t be matched to a known paper.

Research works printed but not linked: 5

  1. [11]Cappelli D.M. Moore A.P. Trzeciak R.F. The CERT Guide to Insider Threats: How to Prevent, Detect, and Respond to Information Technology Crimes (Theft, Sabotage, Fraud) Addison-Wesley Boston, MA, USA 2012
  2. [15]Alpaydin E. Introduction to Machine Learning MIT Press Cambridge, MA, USA 2020
  3. [31]Rashid T. Agrafiotis I. Nurse J.R. A New Take on Detecting Insider Threats Proceedings of the 8th ACM CCS International Workshop on Managing Insider Security Threats Vienna, Austria 28 October 2016 ACM Press New York, NY, USA 2016 47 56
  4. [34]Gavai G. Sricharan K. Gunning D. Hanley J. Singhal M. Rolleston R. Supervised and unsupervised methods to detect insider threat from enterprise social and online activity data Proceedings of the 7th ACM CCS International Workshop on Managing Insider Security Threats (MIST ’15), Dallas, TX, USA, 30 October 2017 ACM Press New York, NY, USA 2015 13 20
  5. [62]Salzberg S. Book Review-C4. 5: Programs for machine learning Mach. Learn. 1993 240 302

Cited by

Sorted by citations

Related

Authors
Al-Shehari, T., & Alsowail, R. A.
Affiliations
  • Computer Skills, Self-Development Department, Deanship of Common First Year, King Saud University, Riyadh 11362, Saudi Arabia
  • King Saud University (SA)
ORCID
Venue
Entropy
Publisher
MDPI AG
Published
2021-09-27
Volume
23
Issue
10
Pages
1258
ISSN
1099-4300 (ISSN-L)
DOI
10.3390/e23101258
PMC
PMC8535057
OpenAlex
W3202156390
Cited by
193
References
78
Citations by year
2026: 26 · 2025: 50 · 2024: 68 · 2023: 31 · 2022: 18
FWCI
26.45
Type
journal article
Language
en
Open access
Licence
Locations
  • Entropy (publishedVersion, cc-by)
  • PubMed Central (publishedVersion, cc-by)
  • PubMed (publishedVersion)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
Funders
Deanship of Scientific Research, King Saud University (RG-1441-401)
Topics
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
Keywords
insider threat detection, data leakage detection, one-hot encoding, SMOTE, class imbalance, feature scaling, employee departure

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review