Insider Threat Detection Based on User Behaviour Analysis

摘要: Insider threat detection is a major challenge for security in organizations. They are the employees/users of an organization, posing to it by performing any malicious activity. Existing methods detect insider threats based on psycho-physiological factors, statistical analysis, machine learning and deep methods. predefined rules or stored signatures fail new unknown attacks. To overcome some limitations existing methods, we propose behaviour method. The characterized user activity (such as logon-logoff, device connect-disconnect, file-access, http-url-requests, email activity). Isometric Feature Mapping (ISOMAP) used feature extraction Emperor Penguin Algorithm optimal selection. features include time (time at which particular performed) frequency (number times performed). Finally, Multi-fuzzy-classifier with three inference engines F1, F2, F3, classify users normal malicious. proposed method tested using CMU-CERT dataset its performance. outperforms following metrics: accuracy, precision, recall, f-measure, AUC-ROC parameters. results show significant improvement over