Evaluating Insider Threat Detection Workflow Using Supervised and Unsupervised Learning
Authors:
- Duc C. LeDLDuc C. Le
- A. Nur Zincir-HeywoodAZA. Nur Zincir-Heywood
- 1 May 2018
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- p. 270-275
Abstract
Insider threat is a prominent cyber-security danger faced by organizations and companies. In this research, we study and evaluate an insider threat detection workflow using supervised and unsupervised learning algorithms. To this end, we study data exploration and analysis, anomaly detection and malicious behaviour classification on a publicly available data set. We evaluate several supervised and unsupervised learning algorithms - HMM, SOM, and DT - using this workflow.Keywords
This publication has 9 references indexed in Scilit:
- Packet Momentum for Identificationof Anonymity NetworksJournal of Cyber Security and Mobility, 2017
- An assessment of opportunity-reducing techniques in information security: An insider threat perspectiveDecision Support Systems, 2016
- A New Take on Detecting Insider Threats2016
- Hive oversight for network intrusion early warning using DIAMoND: a bee-inspired method for fully distributed cyber defenseIEEE Communications Magazine, 2016
- Explaining and Aggregating Anomalies to Detect Insider Threats2016
- Benchmarking the Effect of Flow Exporters and Protocol Filters on Botnet Traffic ClassificationIEEE Systems Journal, 2014
- Detecting insider threats in a real corporate database of computer usage activity2013
- Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data2013
- An artificial immune system architecture for computer security applicationsIEEE Transactions on Evolutionary Computation, 2002