The DOI matches its DataCite record; 1 of the 1 references it cites were found in a registry or an index.
Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams
Abstract
Analysis of an organization's computer network activity is a key component of early detection and mitigation of insider threat, a growing concern for many organizations. Raw system logs are a prototypical example of streaming data that can quickly scale beyond the cognitive power of a human analyst. As a prospective filter for the human analyst, we present an online unsupervised deep learning approach to detect anomalous network activity from system logs in real time. Our models decompose anomaly scores into the contributions of individual user behavior features for increased interpretability to aid analysts reviewing potential cases of insider threat. Using the CERT Insider Threat Dataset v6.2 and threat detection recall as our performance metric, our novel deep and recurrent neural network models outperform Principal Component Analysis, Support Vector Machine and Isolation Forest based anomaly detection baselines. For our best model, the events labeled as insider threat activity in our dataset had an average anomaly score in the 95.53 percentile, demonstrating our approach's potential to greatly reduce analyst workloads.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“BRITD* | | - | 0.9730 | 0.8072 | 0.8540”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Tuor et al. (2017)
In the citing paper
“During the behavior feature extraction, Tuor et al. divide each type of behavior into four more types according to when the behavior occurred (i.e., 12am-6am, 6am-12pm, 12pm-6pm, and 6pm-12am).”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Tuor et al. (2017)
In the citing paper
“Tuor et al. (2017): Tuor et al. extract 408 behavior features from user behavior logs and obtain the userday feature vectors by counting the behavior features.”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Tuor et al. (2017)
In the citing paper
“They use the deep feedforward neural network to reconstruct the user behavior feature vectors while fitting the user behavior feature distribution with a multivariate Gaussian distribution to obtain a decomposable reconstruction error (which is also the anomaly score).”
From BRITD: behavior rhythm insider threat detection with time awareness and user adaptation (2024) · cites this paper as Tuor et al. (2017)
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
LSTM-based Encoder-Decoder for Multi-sensor Anomaly Detection
Malhotra, P., Ramakrishnan, A., Anand, G., Vig, L., Agarwal, P., & Shroff, G. (2016) · arXiv · doi:10.48550/arxiv.1607.00148 · Cited by 819
Research works printed but not linked: 18
- Carter, K. M., and Streilein, W. W. 2012. Probabilistic reasoning for streaming anomaly detection. In Proc. SSP, 377-380.
- Chandola, V.; Banerjee, A.; and Kumar, V. 2012. Anomaly detection for discrete sequences: A survey. IEEE TKDE 24(5):823-839.
- Chauhan, S., and Vig, L. 2015. Anomaly detection in ecg time signals via deep long short- term memory networks. In Proc. DSAA, 1-7.
- Debar, H.; Becker, M.; and Siboni, D. 1992. A neural network component for an intrusion detection system. In Proc. IEEE Symposium on Research in Security and Privacy, 240-250.
- Gavai, G.; Sricharan, K.; Gunning, D.; Hanley, J.; Singhal, M.; and Rolleston, R. 2015. Supervised and unsupervised methods to detect insider threat from en- terprise social and online activity data. Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications 6(4):47-63.
- Glasser, J., and Lindauer, B. 2013. Bridging the gap: A pragmatic approach to generating insider threat data. In Proc. SPW, 98-104.
- Hochreiter, S., and Schmidhuber, J. 1997. Long short-term memory. Neural computation 9(8):1735-1780.
- Kingma, D., and Ba, J. 2014. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980. · arXiv
- Lindauer, B.; Glasser, J.; Rosen, M.; Wallnau, K. C.; and ExactData, L. 2014. Generating test data for insider threat detectors. Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applica- tions 5(2):80-94.
- Liu, F. T.; Ting, K. M.; and Zhou, Z.-H. 2008. Isolation forest. In Proc. ICDM.
- Marchi et al. 2015a] Marchi, E.; Vesperini, F.; Eyben, F.; Squartini, S.; and Schuller, B. 2015a. A novel approach for automatic acoustic novelty detection using a denoising autoencoder with bidirectional LSTM neural networks. In Proc. ICASSP, 1996-2000.
- Marchi et al. 2015b] Marchi, E.; Vesperini, F.; Weninger, F.; Eyben, F.; Squartini, S.; and Schuller, B. 2015b. Non-linear prediction with LSTM recurrent neural networks for acous- tic novelty detection. In Proc. IJCNN, 1-7.
- Markou, M., and Singh, S. 2003. Novelty detection: a reviewpart 2:: neural network based ap- proaches. Signal processing 83(12):2499-2521.
- Pedregosa, F.; Varoquaux, G.; Gram- fort, A.; Michel, V.; Thirion, B.; Grisel, O.; Blondel, M.; Prettenhofer, P.; Weiss, R.; Dubourg, V.; Vanderplas, J.; Pas- sos, A.; Cournapeau, D.; Brucher, M.; Perrot, M.; and Duch- esnay, E. 2011. Scikit-learn: Machine learning in Python. Journal of Machine Learning Research 12:2825-2830.
- Ryan, J.; Lin, M.-J.; and Miikkulainen, R. 1998. Intrusion detection with neu- ral networks. Advances in neural information processing systems 943-949.
- Shyu, M.-L.; Chen, S.-C.; Sarinnapakorn, K.; and Chang, L. 2003. A novel anomaly detection scheme based on principal component classifier. In Proc. ICDM. [Sommer and Paxson 2010]
- Sommer, R., and Paxson, V. 2010. Outside the closed world: On using machine learn- ing for network intrusion detection. In Proc. Symposium on Security and Privacy. [Veeramachaneni and Arnaldo 2016]
- Veeramachaneni, K., and Arnaldo, I. 2016. AI 2 : Training a big data machine to defend. In Proc. HPSC and IDS.
Cited by
Machine Learning and Deep Learning Methods for Intrusion Detection Systems: A Survey
Liu, H., & Lang, B. (2019) · Applied Sciences · doi:10.3390/app9204396 · Cited by 1,133
A Survey of Deep Learning Methods for Cyber Security
Berman, D. S., Buczak, A. L., Chavis, J. S., & Corbett, C. L. (2019) · Information · doi:10.3390/info10040122 · Cited by 569
Liu, F., Wen, Y., Zhang, D., Jiang, X., Xing, X., & Meng, D. (2019) · Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3319535.3363224 · Cited by 319
Deep learning for insider threat detection: Review, challenges and opportunities
Yuan, S., & Wu, X. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102221 · Cited by 271
Al-Shehari, T., & Alsowail, R. A. (2021) · Entropy · doi:10.3390/e23101258 · Cited by 193
Metadata
- Authors
- Tuor, A., Kaplan, S., Hutchinson, B., Nichols, N., & Robinson, S.
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2017
- arXiv
- 1710.00811
- References
- 1
- Type
- Preprint
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
