# Insider Threat Detection Based on User Behavior Modeling and Anomaly Detection Algorithms
## 2 Dataset and User Activity Modeling
### User Activity Modeling Based on Daily Activity Summaries  
In the CERT dataset, user behaviors are stored in five data tables: logon, USB, http, file, and email. To comprehensively utilize heterogeneous user behavior data, it is necessary to integrate the behavioral information into one standardized data table in chronological order. Because the proposed user-level \begin{table}
\begin{tabular}{c c} \hline \hline
**Recorded Item** & **Description** \\ \hline ID & Primary key of an observation \\ Date & Day/Month/Year \\ User & User ID \\ Personal computer (PC) & Key number of a PC logged on \\ Activity & Log on or log off (Binary type) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Log records of logon activities. insider-threat detection models developed in this study work on a daily or weekly basis, we first integrated a user's fragmented activity records for each day and summarized them to quantify the intensity of activity, which becomes an input variable in the detection model. For example, based on the information stored in the logon table, it is possible to extract the number of times a user has logged on to the computer during a specific day. To determine candidate input variables for insider-threat detection, we examined the input variables used in past studies, as shown in Table 2. From these references, we created all possible input variables that can be extracted from the CERT dataset. The total number of candidate input variables is 60 and the description of each variable is provided in the Appendix A, Table 10. Once this daily summarization process was completed, a total of 1,394,010 instances were obtained. Each instance represents a behavior summary of a specific day for a specific user. Among more than 1 million instances, only 73 instances are potentially actual insider threats. To identify the characteristics of malicious insiders, we investigated the roles of the 73 abnormal instances, as shown in Table 3. We found that most abnormal activities (nearly 90%) are committed by three roles: \"Salesman\", \"Information Technology (IT) Admin\", and \"Electrical Engineer\". If a role has no abnormal instances, or in the case of roles with less than three abnormal instances, it is not only impossible to build a good detection model, it is also impossible to verify the performance of the developed model. For this reason, we constructed role-dependent insider-threat detection models and evaluated the performance of the developed model for the above three roles. The frequency of normal instances and abnormal instances in the three roles are shown in Table 4. \begin{table}
\begin{tabular}{c c} \hline \hline
**Relc** & **Number of Anomalous Records** \\ \hline Salesman & 32 \\ IT Admin & 23 \\ Electrical Engineer & 10 \\ Computer Programmer & 3 \\ Manager & 2 \\ Director & 1 \\ Production line worker & 1 \\ Software developer & 1 \\ Total & 73 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Frequency of records of three roles. \begin{table}
\begin{tabular}{c c} \hline \hline
**Research Papers** & **Authors** & **Year** \\ \hline Supervised and unsupervised methods to detect insider threat & [PERSON] et al. [16] & 2015 \\   from enterprise and online activity data & [PERSON] et al. [21] & 2015 \\   Detecting insider threats using ben-ware: beneficial intelligent & 2015 \\   software for identifying anomalous human behavior & 2015 \\   Multi-source fusion for anomaly detection: using & [PERSON] et al. [10] & 2014 \\   across-domain and across-time peer-group consistency checks & 2015 \\   Use of domain knowledge to detect insider threats in & [PERSON] et al. [22] & 2013 \\   computer activities & 2015 \\   Insider threat simulation and performance analysis of insider & 2015 \\   detection algorithms with role-based models & [PERSON] [23] & 2010 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Referred articles for variable selection.