Image-Based Feature Representation for Insider Threat Classification

2019-11-13 · Gayathri R G, Atul Sajjanhar, Yong Xiang

Insiders are the trusted entities in the organization, but poses threat to the with access to sensitive information network and resources. The insider threat detection is a well studied problem in security analytics. Identifying the features from data sources and using them with the right data analytics algorithms makes various kinds of threat analysis possible. The insider threat analysis is mainly done using the frequency based attributes extracted from the raw data available from data sources. In this paper, we propose an image-based feature representation of the daily resource usage pattern of users in the organization. The features extracted from the audit files of the organization are represented as gray scale images. Hence, these images are used to represent the resource access patterns and thereby the behavior of users. Classification models are applied to the representative images to detect anomalous behavior of insiders. The images are classified to malicious and non-malicious. The effectiveness of the proposed representation is evaluated using the CMU CERT data V4.2, and state-of-art image classification models like Mobilenet, VGG and ResNet. The experimental results showed improved accuracy. The comparison with existing works show a performance improvement in terms of high recall and precision values.

📄 PDF Abstract BibTeX arXiv:1911.05879

Code (0)

등록된 구현이 없습니다.

Tasks

Classification General Classification image-classification Image Classification

Methods 이 논문이 사용한 방법론

Average Pooling 설명 없음

Global Average Pooling Global Average Pooling is a pooling operation designed to replace fully connected layers in classical CNNs. The idea is to generate one feature map for each corresponding…

1x1 Convolution A 1 x 1 Convolution is a convolution with some special properties in that it can be used for dimensionality reduction,…

Batch Normalization 설명 없음

Bottleneck Residual Block A Bottleneck Residual Block is a variant of the residual block that utilises 1x1 convolutions to create a bottleneck. The…

Kaiming Initialization 설명 없음

Residual Connection 설명 없음

Residual Block Residual Blocks are skip-connection blocks that learn residual functions with reference to the layer inputs, instead of learning unreferenced functions. They were introduced…

AnyThreat: An Opportunistic Knowledge Discovery Approach to Insider Threat Detection

2018-12-01 · Diana Haidar, Mohamed Medhat Gaber, Yevgeniya Kovalchuk

Insider threat detection is getting an increased concern from academia, industry, and governments due to the growing number of malicious insider incidents. The existing approaches proposed for detecting insider threats s…

Feature Engineering General Classification

Using Color To Identify Insider Threats

2021-11-25 · Sameer Khanna

Insider threats are costly, hard to detect, and unfortunately rising in occurrence. Seeking to improve detection of such threats, we develop novel techniques to enable us to extract powerful features and augment attack v…

Benchmarking

Deep Learning for Insider Threat Detection: Review, Challenges and Opportunities

2020-05-25 · Shuhan Yuan, Xintao Wu

Insider threats, as one type of the most challenging threats in cyberspace, usually cause significant loss to organizations. While the problem of insider threat detection has been studied for a long time in both security…

BIG-bench Machine Learning Deep Learning Feature Engineering

Anomaly Detection for Scenario-based Insider Activities using CGAN Augmented Data

2021-02-15 · R G Gayathri, Atul Sajjanhar, Yong Xiang, Xingjun Ma

Insider threats are the cyber attacks from within the trusted entities of an organization. Lack of real-world data and issue of data imbalance leave insider threat analysis an understudied research area. To mitigate the …

Anomaly Detection General Classification Generative Adversarial Network Multi-class Anomaly Detection+1

Which side are you on? Insider-Outsider classification in conspiracy-theoretic social media

2022-03-08 · ACL 2022 5 · Pavan Holur, Tianyi Wang, Shadi Shahsavari, Timothy Tangherlini 외

Social media is a breeding ground for threat narratives and related conspiracy theories. In these, an outside group threatens the integrity of an inside group, leading to the emergence of sharply defined group identities…

Language Modeling Language Modelling