Towards a User and Role-Based Behavior Analysis Method for Insider Threat Detection

摘要: Organizations are experiencing an ever-growing concern of how to identify and defend against insider threats. Existing methods have distinguished the minority users who show suspicious behavior from majority users. However, these failed apply features reflecting deviation between behaviors those their user groups within similar job roles. This paper focuses on threat detection by conducting both role analysis. It extracts multiple that represent details activities conducted each deviations groups. The malicious then detected using unsupervised algorithm, Isolation Forest Algorithm, which evaluates variance exhibits across attributes, compared other To evaluate performance proposed models comprehensively, we implement a series experiments with data lasting 17 months. We compare method existing state-of-the-art results demonstrate robust method.