Comparative evaluation of data imbalance addressing techniques for CNN-based insider threat detection

Area of Science:

• Cybersecurity
• Machine Learning
• Data Science

Background:

• Insider threats are a major cybersecurity challenge requiring robust detection.
• Imbalanced datasets are common in cybersecurity, hindering model performance.
• Existing research lacks consensus on optimal data imbalance techniques for insider threat detection.

Purpose of the Study:

• To comparatively evaluate data imbalance techniques for Convolutional Neural Network (CNN)-based insider threat detection.
• To enhance the accuracy and robustness of insider threat detection models on imbalanced datasets.
• To resolve the lack of consensus regarding the superiority of specific data imbalance techniques.

Main Methods:

• Integration of CNN with three data imbalance techniques: Synthetic Minority Over-sampling Technique (SMOTE), Borderline-SMOTE, and Adaptive Synthetic Sampling (ADASYN).
• Utilizing a human behavior-based dataset (CERT) comprising IT activities for analysis.
• Comparative evaluation of hybrid models (CNN + imbalance addressing techniques) against state-of-the-art studies.

Main Results:

• Adaptive Synthetic Sampling (ADASYN) coupled with CNN achieved a 96% ROC curve.
• ADASYN demonstrated superior performance over SMOTE and Borderline-SMOTE in enhancing detection accuracy.
• Hybrid models were compared based on ROC, recall, and accuracy metrics.

Conclusions:

• ADASYN is the most effective data imbalance technique when combined with CNN for insider threat detection.
• The findings contribute to advancing methodologies for detecting insider threats in cybersecurity.
• CNN-based models integrated with ADASYN offer improved accuracy and robustness for imbalanced datasets.