User Behavior Analytics for Anomaly Detection Using LSTM Autoencoder - Insider Threat Detection

Sharma, Balaram; Pokharel, Prabhat; Joshi, Basanta

doi:10.1145/3406601.3406610

Cited by 59 publications

(45 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A recurrent neural network (RNN) structure is exploited for the encoder f enc and the predictor f pre to process sequential data, and it is a commonly used approach to handle time-series data [10,15,19]. The encoder f enc and the predictor f pre are compiled using LSTM cells [24].…”

Section: B Methodology Overviewmentioning

confidence: 99%

“…In recent years, deep learning-based methods have been presented showing better performance [9,10,14,15] compared with the machine learning-based methods. Tuor et al [15] showed a method to detect abnormal network activities from system logs based on a long short-term memory (LSTM) model.…”

Section: Related Workmentioning

confidence: 99%

“…In addition, the model trained with aggregated features may overlook unusual activities. Yuan et al [9] and Sharma et al [10] proposed an LSTM based framework for identifying insider threats. Those methods identify abnormal events according to the reconstruction error.…”

Section: Related Workmentioning

confidence: 99%

“…During this error minimisation process, abstracted features are mapped into a latent space, which are more globalised features than the original inputs. However, according to the previous works [10,16], if a latent feature space is arbitrarily constructed, the randomness may cause uncertainty in reconstructing the input samples [26]. As a result, the uncertainty degenerate prediction performance, and the poorly reconstructed results can degrade the AIED performance.…”

Section: Predictive Auto-regression Modelmentioning

confidence: 99%

“…However, they have a limitation in that they can not cope with unexpected unusual behaviours. To overcome the limitation of using predefined information on unusual behaviours, and as large datasets become available, various deep learning-based approaches have been proposed [8][9][10]. Those approaches tried to detect unusual insider behaviour by analysing unusual movements of input devices or network signals leading to data leakage.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Real-Time Abnormal Insider Event Detection on Enterprise Resource Planning Systems via Predictive Auto-Regression Model

Kim

et al. 2021

IEEE Access

View full text Add to dashboard Cite

With the development of information and communication technology and the globalisation of enterprises, many companies are being operated through an electrical resource management system called Enterprise Resource Planning (ERP) system. An ERP system enables efficient and centralised resource management for enterprises. However, since many enterprise resources are being managed by the system, the threatening behaviour by an insider is one of the most significant risks in operating ERP systems. It is much stealthier and fatal compared with the threat from an outsider since it is considered as normal events that accessing the enterprise resource of insiders. Conventional insider threat detection methods have aimed to detect particular events manually defined by system administrators. Those approaches are not robust to the variation of event patterns, and they can not be used when the predefined cases are not given. In this paper, we present a real-time abnormal insider event detection method using the Predictive Auto-regression Model (PAM). Compared with the conventional approaches, the proposed method compiles a prediction model using normal events and identifies threat when the likelihood of prediction results is lower than a threshold. Experiments are conducted using a dataset including events defined as a sequence of ERP system logs. The logs are captured in a practical situation of an enterprise. The results demonstrate that the proposed method can successfully identify abnormal events of on ERP systems.

show abstract

Section: B Methodology Overviewmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%