.png){kind=icon}
返回
Behavioral Based Insider Threat Detection Using Deep Learning
.png){kind=icon}
OA
AI
DOI：10.1109/ACCESS.2021.3118297.png)
.png){kind=icon}
.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
The most detrimental cyber attacks are usually not originated by malicious outsiders or malware but from trusted insiders. The main advantage insider attackers have over external elements is their ability to bypass security checks and remain undiscovered, this may cause serious damage to the organizational assets. This paper focuses on insider threat detection through behavioral analysis of users. User behavior is categorized as normal or malicious based on user activity. A series of events and activities are analyzed for feature selection to efficiently detect adversarial behavior. Selected feature vectors are used for model training during the implementation phase. A deep learning based approach is proposed that detects insiders with greater accuracy and low false positive rate. A rich event / user role based feature set containing Logon/Logoff events, User_role, Functional_unit etc are used for detection. The dataset used is the CMU CERT synthetic insider threat dataset r4.2. Performance of our proposed algorithm has been compared to other well-known techniques i.e. long short term Memory- convolutional neural network, random forest, long short term memory- recurrent neural network, one class support vector machine, Markov chain model, multi state long short term memory & convolutional neural network, gated recurrent unit & skipgram. The comparison proved that our novel approach produces relatively good accuracy(90.60%), precision(97%) and F1 Score (94%).
Keyword:
Feature extraction
Deep learning
Anomaly detection
Training
Hidden Markov models
Data models
Time series analysis
Insider threat
deep learning
machine learning
user behavior
information security
期刊
IF:
3.6
论文数:
9.8W
被引数:
29.4W
机构
引用论文
Reconstruction of metastatic acetabular defects using a modified Harrington procedure使用改良Harrington术重建转移性髋臼缺损.png)
IF0
PREAI
分享收藏Amidolytic activity in normal human plasma assessed with chromogenic substances使用生色物质评估的正常人血浆中的激酶活性
PREAI
分享收藏Insider-threat detection using Gaussian Mixture Models and Sensitivity ProfilesCOMPUTERS & SECURITY
OAAI
COMPUTERS & SECURITYIF5.4
OAAI分享收藏
查看更多内容