Multi-Granularity User Anomalous Behavior Detection
Source abstract
Abstract
Insider threats pose significant risks to organizational security, often going undetected due to their familiarity with the systems. Detection of insider threats faces challenges of imbalanced data distributions and difficulties in fine-grained detection. Specifically, anomalous users and anomalous behaviors take up a very small fraction of all insider behavior data, making precise detection of anomalous users challenging. Moreover, not all behaviors of anomalous users are anomalous, so it is difficult to detect their behaviors by standardizing with single rules or models. To address these challenges, this paper presents a novel approach for insider threat detection, leveraging machine learning techniques to conduct multi-granularity anomaly detection. We introduce the Multi-Granularity User Anomalous Behavior Detection (MG-UABD) system, which combines coarse-grained and fine-grained anomaly detection to improve the accuracy and effectiveness of detecting anomalous behaviors. The coarse-grained module screens all of the user activities to identify potential anomalies, while the fine-grained module focuses on specific anomalous users to refine the detection process. Besides, MG-UABD employs a combination of oversampling and undersampling techniques to address the imbalance in the datasets, ensuring robust model performance. Through extensive experimentation on the commonly used dataset CERT R4.2, we demonstrate that the MG-UABD system achieves superior detection rate and precision. Compared to the suboptimal model, the accuracy has increased by 3.1% and the detection rate has increased by 4.1%. Our findings suggest that a multi-granularity approach for anomaly detection, combined with tailored sampling strategies, is highly effective in addressing insider threats.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Anomaly Detection Techniques and Applications · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of New Networks, Pengcheng Laboratory, Shenzhen 518055, China
School of Computer Science and Technology, Harbin Institute of Technology (Shenzhen), Shenzhen 518055, China
Funding
Pengcheng Laboratory · Shenzhen Science and Technology Program · National Natural Science Foundation of China · opening project of science and technology on communication networks laboratory
References (29)
Show source-provided references
1. CISA (2020). Defining Insider Threats, CISA.
2. Cybersecurity Insiders (2023). 2023 REPORT Insider Threat, Cybersecurity Insiders.
3. Safety Internal Reference (2021, June 18). UEBA Practical Implementation: Data Quality Determines Everything. Available online: https://www.secrss.com/articles/31990.
4. Enhancing False Negative and Positive Rates for Efficient Insider Threat Detection10.1016/j.cose.2022.103066 ↗
5. Aldairi, M., Karimi, L., and Joshi, J. (August, January 30). A Trust Aware Unsupervised Learning Approach for Insider Threat Detection. Proceedings of the 2019 IEEE 20th International Conference on Information Reuse and Integration for Data Science, IRI, Los Angeles, CA, USA.10.1109/IRI.2019.00027 ↗
6. Besnaci, S., Hafidi, M., and Lamia, M. (2023, January 6–7). Dealing with Extremly Unbalanced Data and Detecting Insider Threats with Deep Neural Networks. Proceedings of the 2023 International Conference on Advances in Electronics, Control and Communication Systems, ICAECCS, Blida, Algeria.10.1109/ICAECCS56710.2023.10105103 ↗
7. Ge, D., Zhong, S., and Chen, K. (2022, January 23–25). Multi-Source Data Fusion for Insider Threat Detection Using Residual Networks. Proceedings of the 2022 3rd International Conference on Electronics, Communications and Information Technology, CECIT, Sanya, China.10.1109/CECIT58139.2022.00069 ↗
8. Hall, A.J., Pitropakis, N., Buchanan, W.J., and Moradpoor, N. (2018, January 10–13). Predicting Malicious Insider Threat Scenarios Using Organizational Data and a Heterogeneous Stack-Classifier. Proceedings of the 2018 IEEE International Conference Big Data (Big Data), Seattle, WT, USA.10.1109/BigData.2018.8621922 ↗
9. He, W., Wu, X., Wu, J., Xie, X., Qiu, L., and Sun, L. (2021, January 9–11). Insider Threat Detection Based on User Historical Behavior and Attention Mechanism. Proceedings of the 2021 IEEE International Conference on Data Science in Cyberspace, Cyberspace DSC, Shenzhen, China.10.1109/DSC53577.2021.00089 ↗
10. Huang, W., Zhu, H., Li, C., Lv, Q., Wang, Y., and Yang, H. (2021, January 5–8). ITDBERT: Temporal-semantic Representation for Insider Threat Detection. Proceedings of the 2021 IEEE Symposium on Computers and Communications, ISCC, Athens, Greece.10.1109/ISCC53001.2021.9631538 ↗
11. Igbe, O., and Saadawi, T. (2018, January 8–10). Insider Threat Detection Using an Artificial Immune System Algorithm. Proceedings of the 2018 9th IEEE Annual Ubiquitous Computing, Electronics & Mobile Communication Conference, UEMCON, New York, NY, USA.10.1109/UEMCON.2018.8796583 ↗
12. CISA (2020). Detecting and Identifying Insider Threats, CISA.
13. Deep learning for insider threat detection: Review, challenges and opportunities10.1016/j.cose.2021.102221 ↗
14. Al-Mhiqani, M.N., Ahmad, R., Zainal Abidin, Z., Yassin, W., Hassan, A., Abdulkareem, K.H., Ali, N.S., and Yunos, Z. (2020). A Review of Insider Threat Detection: Classification, Machine Learning Techniques, Datasets, Open Challenges, and Recommendations. Appl. Sci., 10.10.3390/app10155208 ↗
15. Raut, M., Dhavale, S., Singh, A., and Mehra, A. (2020, January 3–5). Insider Threat Detection using Deep Learning: A Review. Proceedings of the 2020 3rd International Conference on Intelligent Sustainable Systems (ICISS), Thoothukudi, India.10.1109/ICISS49785.2020.9315932 ↗
16. Tang, B., Hu, Q., and Lin, D. (2017, January 18–21). Reducing False Positives of User-to-Entity First-Access Alerts for User Behavior Analytics. Proceedings of the 2017 IEEE International Conference on Data Mining Workshops, Workshop ICDMW, New Orleans, LA, USA.10.1109/ICDMW.2017.111 ↗
17. Shashanka, M., Shen, M.Y., and Wang, J. (2016, January 5–8). User and Entity Behavior Analytics for Enterprise Security. Proceedings of the 2016 IEEE International Conference on Big Data, Washington, DC, USA.10.1109/BigData.2016.7840805 ↗
18. Varsha Suresh, P., and Lalitha Madhavu, M. (2021, January 6–8). Insider Attack: Internal Cyber Attack Detection Using Machine Learning. Proceedings of the 2021 12th International Conference on Computing Communication and Networking Technologies, ICCCNT, Kharagpur, India.10.1109/ICCCNT51525.2021.9579549 ↗
19. Singh, M., Mehtre, B.M., and Sangeetha, S. (2021, January 21–23). User Behaviour Based Insider Threat Detection in Critical Infrastructures. Proceedings of the 2021 2nd International, Conference on Secure Cyber, Computing and Communications, ICSCCC, Jalandhar, India.10.1109/ICSCCC51823.2021.9478137 ↗
20. Analyzing Data Granularity Levels for Insider Threat Detection Using Machine Learning10.1109/TNSM.2020.2967721 ↗
21. A New Intelligent Multilayer Framework for Insider Threat Detection10.1016/j.compeleceng.2021.107597 ↗
22. Pantelidis, E., Bendiab, G., Shiaeles, S., and Kolokotronis, N. (2021, January 26–28). Insider Threat Detection Using Deep Autoencoder and Variational Autoencoder Neural Networks. Proceedings of the 2021 IEEE International Conference on Cyber Security and Resilience, CSR, Virtual.10.1109/CSR51186.2021.9527925 ↗
23. Glasser, J., and Lindauer, B. (2013, January 23–24). Bridging the Gap: A Pragmatic Approach to Generating Insider Threat Data. Proceedings of the 2013 IEEE Security and Privacy Workshops, San Francisco, CA, USA.10.1109/SPW.2013.37 ↗
24. Zhu, D., Sun, H., Li, N., Mi, B., and Huang, X. (2023, January 24–26). SPYRAPTOR: A Stream-based Smart Query System for Real-Time Threat Hunting within Enterprise. Proceedings of the 2023 26th International Conference on Computer Supported Cooperative Work in Design (CSCWD), Rio de Janeiro, Brazil.10.1109/CSCWD57460.2023.10152577 ↗
25. Zhang, F., Ma, X., and Huang, W. (2022, January 18–23). SeqA-ITD: User Behavior Sequence Augmentation for Insider Threat Detection at Multiple Time Granularities. Proceedings of the 2022 International Joint Conference on Neural Networks (IJCNN), Padua, Italy.10.1109/IJCNN55064.2022.9892163 ↗
26. Zhu, D., Huang, X., Li, N., Sun, H., Liu, M., and Liu, J. (2022, January 18–23). RAP-Net: A Resource Access Pattern Network for Insider Threat Detection. Proceedings of the 2022 International Joint Conference on Neural Networks (IJCNN), Padua, Italy.10.1109/IJCNN55064.2022.9892183 ↗
27. Behavioral Based Insider Threat Detection Using Deep Learning10.1109/ACCESS.2021.3118297 ↗
28. Li, P., Wang, Y., Li, Q., Liu, Z., Xu, K., Ren, J., Liu, Z., and Lin, R. (2023, January 10–14). Learning from Limited Heterogeneous Training Data: Meta-Learning for Unsupervised Zero-Day Web Attack Detection across Web Domains. Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, Melbourne, Australia.10.1145/3576915.3623123 ↗
29. Chen, Y., Ding, Z., and Wagner, D. (2023, January 9–11). Continuous Learning for Android Malware Detection. Proceedings of the 32nd USENIX Security Symposium (USENIX Security 23), Anaheim, CA, USA.