Insider Threat Detection Using Behavioural Analysis through Machine Learning and Deep Learning Techniques

Abstract

Insider threats pose a significant security challenge to organizational assets and sensitive information. This paper presents a novel approach to insider threat detection by categorizing features into several behavioral types, including Time-related, User-related, Project and Role-related, Activity-related, Logon-related, USB-related, File-related, and Email-related features. Using a comprehensive dataset of 830 features, this paper addresses the challenge of class imbalance through the Synthetic Minority Over-sampling Technique (SMOTE), which improves the balance and preserves data patterns. Dividing features into distinct behavioral categories enhances the precision of threat detection by focusing on specific patterns and anomalies related to different behaviors. The evaluation of machine learning classifiers demonstrates high accuracy across various feature types: Random Forest achieved 76.4% for Time-related, 96.4% for User-related, 85.3% for Project and Role-related, 91.2% for Activity-related, 65.3% for Logon-related, 81.4% for USB-related, 92.5% for File-related, and 99.8% for email-related features. Artificial Neural Networks (ANN) showed good performance with 72% for Time-related, 85% for User-related, 87.6% for Project and Role-related, 75% for Activity-related, 65.5% for Logon-related, 89.7% for USB-related, 86.5% for File-related, and 90% for email-related features. This work underscores the effectiveness of feature categorization and the SMOTE technique in enhancing classifier performance and provides valuable insights for improving organizational security against insider threats.