Student or educator? Sign up with your school email and get 6 months of Pro free.
CoChat
Sign Up
PreprintCited by 28

The DOI matches its DataCite record; 1 of the 1 references it cites were found in a registry or an index.

Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams

Tuor, Aaron, Kaplan, Samuel, Hutchinson, Brian, Nichols, Nicole, Robinson, Sean·2017·arXiv
DOI 10.48550/arxiv.1710.00811arXiv 1710.00811
Open this paper in CoChat — free account

Abstract

Analysis of an organization's computer network activity is a key component of early detection and mitigation of insider threat, a growing concern for many organizations. Raw system logs are a prototypical example of streaming data that can quickly scale beyond the cognitive power of a human analyst. As a prospective filter for the human analyst, we present an online unsupervised deep learning approach to detect anomalous network activity from system logs in real time. Our models decompose anomaly scores into the contributions of individual user behavior features for increased interpretability to aid analysts reviewing potential cases of insider threat. Using the CERT Insider Threat Dataset v6.2 and threat detection recall as our performance metric, our novel deep and recurrent neural network models outperform Principal Component Analysis, Support Vector Machine and Isolation Forest based anomaly detection baselines. For our best model, the events labeled as insider threat activity in our dataset had an average anomaly score in the 95.53 percentile, demonstrating our approach's potential to greatly reduce analyst workloads.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.1710.00811

Cites

1 of 1 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Show all 1 references

Research works printed but not linked: 18

  1. Carter, K. M., and Streilein, W. W. 2012. Probabilistic reasoning for streaming anomaly detection. In Proc. SSP, 377-380.
  2. Chandola, V.; Banerjee, A.; and Kumar, V. 2012. Anomaly detection for discrete sequences: A survey. IEEE TKDE 24(5):823-839.
  3. Chauhan, S., and Vig, L. 2015. Anomaly detection in ecg time signals via deep long short- term memory networks. In Proc. DSAA, 1-7.
  4. Debar, H.; Becker, M.; and Siboni, D. 1992. A neural network component for an intrusion detection system. In Proc. IEEE Symposium on Research in Security and Privacy, 240-250.
  5. Gavai, G.; Sricharan, K.; Gunning, D.; Hanley, J.; Singhal, M.; and Rolleston, R. 2015. Supervised and unsupervised methods to detect insider threat from en- terprise social and online activity data. Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications 6(4):47-63.
  6. Glasser, J., and Lindauer, B. 2013. Bridging the gap: A pragmatic approach to generating insider threat data. In Proc. SPW, 98-104.
  7. Hochreiter, S., and Schmidhuber, J. 1997. Long short-term memory. Neural computation 9(8):1735-1780.
  8. Kingma, D., and Ba, J. 2014. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980. · arXiv
  9. Lindauer, B.; Glasser, J.; Rosen, M.; Wallnau, K. C.; and ExactData, L. 2014. Generating test data for insider threat detectors. Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applica- tions 5(2):80-94.
  10. Liu, F. T.; Ting, K. M.; and Zhou, Z.-H. 2008. Isolation forest. In Proc. ICDM.
  11. Marchi et al. 2015a] Marchi, E.; Vesperini, F.; Eyben, F.; Squartini, S.; and Schuller, B. 2015a. A novel approach for automatic acoustic novelty detection using a denoising autoencoder with bidirectional LSTM neural networks. In Proc. ICASSP, 1996-2000.
  12. Marchi et al. 2015b] Marchi, E.; Vesperini, F.; Weninger, F.; Eyben, F.; Squartini, S.; and Schuller, B. 2015b. Non-linear prediction with LSTM recurrent neural networks for acous- tic novelty detection. In Proc. IJCNN, 1-7.
  13. Markou, M., and Singh, S. 2003. Novelty detection: a reviewpart 2:: neural network based ap- proaches. Signal processing 83(12):2499-2521.
  14. Pedregosa, F.; Varoquaux, G.; Gram- fort, A.; Michel, V.; Thirion, B.; Grisel, O.; Blondel, M.; Prettenhofer, P.; Weiss, R.; Dubourg, V.; Vanderplas, J.; Pas- sos, A.; Cournapeau, D.; Brucher, M.; Perrot, M.; and Duch- esnay, E. 2011. Scikit-learn: Machine learning in Python. Journal of Machine Learning Research 12:2825-2830.
  15. Ryan, J.; Lin, M.-J.; and Miikkulainen, R. 1998. Intrusion detection with neu- ral networks. Advances in neural information processing systems 943-949.
  16. Shyu, M.-L.; Chen, S.-C.; Sarinnapakorn, K.; and Chang, L. 2003. A novel anomaly detection scheme based on principal component classifier. In Proc. ICDM. [Sommer and Paxson 2010]
  17. Sommer, R., and Paxson, V. 2010. Outside the closed world: On using machine learn- ing for network intrusion detection. In Proc. Symposium on Security and Privacy. [Veeramachaneni and Arnaldo 2016]
  18. Veeramachaneni, K., and Arnaldo, I. 2016. AI 2 : Training a big data machine to defend. In Proc. HPSC and IDS.

Cited by

Metadata

Authors
Tuor, A., Kaplan, S., Hutchinson, B., Nichols, N., & Robinson, S.
Venue
arXiv
Publisher
arXiv
Published
2017
DOI
10.48550/arxiv.1710.00811
arXiv
1710.00811
References
1
Type
Preprint
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

Data sources

Bibliographic data: Semantic Scholar, OpenAlex, Crossref.

Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).

Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.