Insider Threat Detection Using Usupervised Learning

Abstract

In recent years, there has been a noticeable upsurge in insider threat incidents, resulting in substantial losses to companies and organizations. The escalating frequency of these incidents poses a formidable challenge to the realm of internal network security. Traditional intrusion detection methods, predominantly engineered to detect external threats, have proven insufficient in identifying the intricate and often subtle malicious behaviors of insiders. Consequently, this has propelled the urgent need for innovative and effective solutions within the domain of insider threat detection technology. This research project addresses the imperative call to action by introducing a novel and holistic approach to insider threat detection. Our methodology is firmly grounded in two pivotal components, each meticulously designed to address specific facets of the challenge. The first pillar of our approach employs the tree structure method, a sophisticated technique that meticulously dissects and comprehends user behavior. By employing a hierarchical structure to disentangle user actions, this method meticulously captures the dynamic relationships and dependencies inherent in human- computer interactions. The outcome of this analysis is the creation of feature sequences, chronicles of user actions ordered by time, providing a multifaceted and in-depth view of user behaviors. Complementing this intricate framework is our incorporation of the Copula-Based Outlier Detection (COPOD) method. COPOD harnesses advanced statistical methodologies, notably copulas, to discern outliers and anomalies within the feature sequences derived from our user behavior analysis. This dynamic interplay of analytical methods allows us to single out and flag users whose behavior exhibits deviations from established norms, effectively identifying potential insider threats within the organization. The efficacy and practicality of our approach were rigorously tested using the CERT-IT datasets, which encompasses a wide array of insider threat scenarios. Our experiments revealed the superior performance of our approach when compared to conventional methods, most notably the Isolation Forest technique. Crucial performance metrics, including accuracy, precision, recall, F1-score, and the area under the receiver operating characteristic curve (AUC), underscore the resounding success of our method in safeguarding against insider threats. In summary, this research project stands as a groundbreaking contribution to the field of insider threat detection. Our synthesis of the tree structure method and COPOD offers a potent, versatile, and adaptive solution to the formidable challenges faced by organizations seeking to fortify the security of their internal networks. Moreover, our findings illuminate the vast potential of unsupervised machine learning techniques in combating insider threats with unwavering precision, providing a robust defense against the evolving and intricate threat landscape.