# Insider Threat Detection Based on User Behavior Modeling and Anomaly Detection Algorithms
## 4 Results
### Insider-Threat Detection with Daily Activity Summaries  
Tables 10-12 show the insider-threat detection performance of six individual anomaly detectors with the best combination we determined (i.e., Parzen + PCA), based on the daily activity summary dataset for the three roles: \"Electrical Engineer\", \"IT Admin\", and \"Salesman\". As explained in the previous section, we tested all combinations of individual models and the \"Parzen + PCA\" combination resulted in the best performance for 10 out of 21 cases (three roles with seven cut-off rankings) followed by \"Gauss + Parzen + PCA\" (5 cases). The anomaly detection performances of all possible ensemble models are provided in Tables A4-A6 in the Appendix A. Table A7 summarizes the number of best cases for each ensemble model. The proposed method exhibits effective detection performance. For example, among the top 1% of the anomaly scores predicted by Gauss for \"Electrical Engineer\", half of the actual abnormal behaviors are successfully detected, which is more than 50 times higher than a random model that randomly determines 1% of test instances as anomalous behaviors. For the \"Electrical Engineer\" role, when the top 1% of suspicious daily behaviors are monitored, the system can detect at most 53.66% of the actual insider threats (KMC with K = 10). It means that among the 141 test instances belonging to the 1% of highest anomaly score ranking, 5.367 out of 10 actual malicious behaviors are correctly detected, which can improve the monitoring efficiency of insider surveillance systems by prioritizing suspicious behaviors with high accuracy. This detection rate increases up to 76.33%, 79.33%, and 90% when the coverage of monitoring activities increases to the top 5%, 10%, and 15% anomaly scores, respectively. For the \"IT Admin\" role, detection performance is not as apparent as for \"Electrical Engineer\", but it is still much better than the random guess model. The lift of the true detection rate against the random guess is 9.71 with 1% cut-off and 4.35 with 5% cut-off. For the \"Salesman\" role, although the detection performance is not as good as for \"Electrical Engineer\" with the higher cut-off values (1-15%), actual malicious activities are gradually detectedwhen the cut-off values are lowered (15-30%). Hence, when the cut-off value is set to the top 30% of anomaly scores, 94.79% of the actual malicious behaviors are identified by the Parzen + PCA combination, which is the highest detection rate among the three roles (90% for \"Electrical Engineer\" and 40.87% for \"IT Admin\"). Among the single algorithms, Parzen yielded the best detection rate for eight cases out of 21 cases (seven cut-off values and three roles). Although both Gauss and Parzen are based on density estimation, the assumption of Gauss, i.e., single multivariate Gaussian distribution for the entire dataset, is too strict to be applied to real datasets, which results in the worst performances in many cases. On the other hand, Parzen estimates the probability distribution in a more flexible manner, so it can be well fitted to non-Gaussian shape distributions. Note also that the Parzen + PCA combination yields the best detection performance in most cases. Compared to the detection performance of single algorithms, [PERSON] + PCA outperformed the single best algorithms for 10 cases. The effect of model combination is especially noticeable for the \"Salesman\" role.