A graph empowered insider threat detection framework based on daily activities.

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Insider threats pose significant challenges to organizational security.
• Existing methods for detecting insider threats often struggle with effective feature engineering and classification.
• The complexity of insider behavior necessitates advanced analytical approaches.

Purpose of the Study:

• To develop an integrated feature engineering solution for improved insider threat detection.
• To propose a novel deep learning architecture for analyzing sequential user activities.
• To enhance the accuracy and performance of insider threat detection systems.

Main Methods:

• An integrated feature engineering approach combining manually-selected and automatically-extracted features.
• Utilized a Long Short-Term Memory (LSTM) auto-encoder for automatic feature extraction from sequential activities.
• Developed a residual hybrid network (ResHybnet) incorporating Graph Neural Networks (GNN) and Convolutional Neural Networks (CNN) with an organizational graph.

Main Results:

• The LSTM auto-encoder efficiently extracted hidden patterns from sequential activities, improving the F1 score by 0.56%.
• The proposed ResHybnet model, featuring a residual link, outperformed existing models by 1.97% on the same features.
• The integrated approach demonstrated superior performance in classifying and detecting insider threats.

Conclusions:

• The proposed LSTM auto-encoder and ResHybnet model offer a significant advancement in insider threat detection.
• Combining automated feature extraction with advanced network architectures enhances detection capabilities.
• The developed methods provide effective solutions for managing complex insider threats.