Image-Based Insider Threat Detection via Geometric Transformation

Abstract

Insider threat detection has been a challenging task over decades; existing approaches generally employ the traditional generative unsupervised learning methods to produce normal user behavior model and detect significant deviations as anomalies. However, such approaches are insufficient in precision and computational complexity. In this paper, we propose a novel insider threat detection method, Image-based Insider Threat Detector via Geometric Transformation (IGT), which converts the unsupervised anomaly detection into supervised image classification task, and therefore the performance can be boosted via computer vision techniques. To illustrate, our IGT uses a novel image-based feature representation of user behavior by transforming audit logs into grayscale images. By applying multiple geometric transformations on these behavior grayscale images, IGT constructs a self-labelled dataset and then trains a behavior classifier to detect anomaly in a self-supervised manner. The motivation behind our proposed method is that images converted from normal behavior data may contain unique latent features which remain unchanged after geometric transformation, while malicious ones cannot. Experimental results on CERT dataset show that IGT outperforms the classical autoencoder-based unsupervised insider threat detection approaches, and improves the instance and user based Area under the Receiver Operating Characteristic Curve (AUROC) by 4% and 2%, respectively.

Insider Threat Detection Model Enhancement Using Hybrid Algorithms between Unsupervised and Supervised Learning

“…Le et al [18] proposed an unsupervised learning based abnormal detection method for insider threat detection by using four unsupervised learning methods with different workings and exploring various representations of data with temporal information. Li et al [23] converted audit logs into grayscale images, and identified anomalies by applying geometric transformations to the grayscale image. Aldairi et al [24] used the abnormal scores generated by the unsupervised algorithm from the previous cycle as the trust scores for each user, which were fed into the next cycle of the model, and showed their importance and impact in detecting insiders.…”

A Review of Recent Advances, Challenges, and Opportunities in Malicious Insider Threat Detection Using Machine Learning Methods

“…Early strategies included the development of access control mechanisms and user authentication systems, such as password-based systems and user access logs. While effective at identifying unauthorized access, these methods had limitations when it came to detecting subtler insider threats, like privileged users abusing their access rights [3] [6].…”

“…User Entity Behavior Analytics (UEBA) has emerged as a pivotal technology for profiling and analyzing user behavior to discern potential threats. The future trajectory of UEBA VOLUME 4, 2016 involves heightened sophistication, incorporating diverse contextual factors [3], [6], [60]. The integration of graph analytics within UEBA systems is projected to unveil intricate relationships between users and entities, thereby providing a nuanced understanding of potential threats.…”

Memory-Augmented Insider Threat Detection with Temporal-Spatial Fusion

“…Given that the basic feature extraction is usually closely related to domain knowledge, here we take the CERT dataset as an example to design a series of basic features such as the number of copying le from other's PC during o hours and the number of visiting recruiting website on o ce computers during working hours. Here, note that the basic feature extraction is not the focus of this paper, and MAITD adopts the basic features proposed in our previous work, see literature [7] for details.…”

“…In fact, the performance of insider threat detection depends on not only the anomaly detection algorithm but also the representation quality of user behavior. In our previous work [7], we performed related studies on the feature extractions of user behavior, and categorized them into two types: (i) statistical features based on artificial definition; (ii) hidden features based on representation learning. Although previous methods [8][9][10][11][12][13] have their own unique insights, they are still faced with the following limitations:…”