Scalable Unsupervised Ensemble Algorithm For Effective Insider Threat Detection

摘要: Insider threats remain one of the oldest and notorious to information security. Early detection remains key preventing insider attacks on an system. The vast amount enterprise data little points pertaining calls for techniques handle rare class problem. This study conceptualised threat as a streaming problem.  Scalability systems represents gap in knowledge this disposition. Building existing unsupervised ensemble stream mining techniques, proposed algorithm evaluated it using Centre Analysis Internet Data (CAIDA) Anonymized trace dataset 2015. CAIDA datasets was used ascertain scalability quantised dictionary construction by applying distributive approach graph based anomaly (GBAD). Pattern learning system processes GBAD approach. Dictionary done Apache Spark top Hadoop stack. PLADS enhanced successfully discovered same anomalous substructure within fraction time (642 seconds) took process entire (59,743 when applied Anonymised 2015 dataset. Application distributed computing framework dictionaries user command depicted reduction processing under varying input sizes number reducers In conclusion, Threat Detection is essential complexity analysis algorithms showed scales increased users implemented prototype scaled increasing workloads showing its usefulness early threats. recommends use ensembles frameworks effective