CoChat
Sign Up
PreprintCited by 27Information and Cyber SecurityNetwork Security and Intrusion DetectionPrivacy-Preserving Technologies in Data

Classifier Suites for Insider Threat Detection

Open access
Noever, David·2019·arXiv
DOI 10.48550/arxiv.1901.10948arXiv 1901.10948
Open this paper in CoChat — free accountOpen PDF

Abstract

Better methods to detect insider threats need new anticipatory analytics to capture risky behavior prior to losing data. In search of the best overall classifier, this work empirically scores 88 machine learning algorithms in 16 major families. We extract risk features from the large CERT dataset, which blends real network behavior with individual threat narratives. We discover the predictive importance of measuring employee sentiment. Among major classifier families tested on CERT, the random forest algorithms offer the best choice, with different implementations scoring over 98% accurate. In contrast to more obscure or black-box alternatives, random forests are ensembles of many decision trees and thus offer a deep but human-readable set of detection rules (>2000 rules). We address performance rankings by penalizing long execution times against higher median accuracies using cross-fold validation. We address the relative rarity of threats as a case of low signal-to-noise (< 0.02% malicious to benign activities), and then train on both under-sampled and over-sampled data which is statistically balanced to identify nefarious actors.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.1901.10948

Cites

11 of 11 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Unsupervised learning approaches, including clustering algorithms like K-Means and hierarchical clustering, are adept at grouping similar behavioral patterns and flagging outliers.

    “Unsupervised learning approaches, including clustering algorithms like K-Means and hierarchical clustering, are adept at grouping similar behavioral patterns and flagging outliers [61], [70], [71], [72] .”

    From A Review of Recent Advances, Challenges, and Opportunities in Malicious Insider Threat Detection Using Machine Learning Methods (2024) · cites this paper as [71]

    The Discussion and Conclusions says unsupervised methods can cluster individuals’ network traffic by activity type and may help identify previously unseen threats. It discusses k-nearest neighbors and auto-encoders, not K-Means or hierarchical clustering, and does not demonstrate that those named algorithms flag outliers. (LLM, conf=0.86)

    Experimental — accuracy not yet measured

  • Noever [34] model got an accuracy score of 98%.

    “Utilizing the RF classification algorithm and data sampling method, an accuracy score of 98% is obtained.”

    From Enhancing Insider Threat Detection in Imbalanced Cybersecurity Settings Using the Density-Based Local Outlier Factor Algorithm (2024) · cites this paper as [34]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

1 of the 12 references couldn’t be matched to a known paper.

Cited by

Sorted by citations

Related

Authors
Noever, D.
Corresponding author
Noever, David
Venue
arXiv
Publisher
arXiv
Published
2019
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.1901.10948
arXiv
1901.10948
OpenAlex
W2912721768
Cited by
16
References
12
Citations by year
2024: 7 · 2023: 3 · 2022: 3 · 2020: 2 · 2019: 1
Type
posted content
Language
en
Open access
Licence
creativecommons.org/licenses/by-nc-sa/4.0/legalcode
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
Keywords
insider threat detection, classifier comparison, random forest, employee sentiment, network behavior, threat narratives, class imbalance, decision tree rules

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review