Insider Threat Detection in User Activity Data Using Optimized LSTM-AE
摘要
Insider threat is exploiting the user’s authorized access, which poses significant risks to the organization. Insider attacks are a distinct and sophisticated form of security hazards within the organization. Insiders can be employees of an organization, business partners, and vendors. In order to identify and detect insider threats, enormous traditional security actions such as firewalls and antivirus software exist. However, these actions focus on detecting external attacks rather than insider threats. This insufficiency encourages cybersecurity researchers to develop and implement a more refined insider threat detection technique. To overcome the abovementioned issues, this research concentrates on an optimized sequential neural network approach to detect insider threats with a high detection rate. It is evaluated using the benchmark dataset of CMU CERT r5.2 consisting of heterogeneous and highly imbalanced user activity logs. The proposed approach includes three modules to rectify the challenges in the dataset: (i) Obtaining the selective samples based on user activity for the curse of dimensionality, (ii) Implementing clustered sampling to cluster scenario-based samples that solve class imbalance problem which has the majority of benign samples and minority of insiders, and (iii) Deploying optimized Long Short-Term Memory (LSTM)-Autoencoder (AE) to detect the potential insiders with high detection rate 0.99 and less false negative rate 0.03 within an organization. The performance of the proposed approach is ensured by comparing it with state-of-the-art methods.