# Insider Threat Detection Based on User Behavior Modeling and Anomaly Detection Algorithms
## 1 Introduction  
Insider threat is a security issue that arises from persons who have access to a corporate network, systems, and data, such as employees and trusted partners [1]. Although insider threats do not occur frequently, the magnitude of damage is greater than from external intrusions [2; 3]. Because insiders are very familiar with their organization's computer systems and operational processes, and have the authorization to use these systems, it is difficult to determine when they behave maliciously [4]. Many system protection technologies have been developed against intrusions attempted by outsiders, e.g., quantifying the pattern of connection Internet protocols (IPs) and types of attacks [5]. However, past research on the security of a company's internal information has mainly focused on detecting and preventing intrusion from the outside, and few studies have addressed methods to detect insider threats [6]. There are three research mainstream strategies for insider threat detection. The first strategy is to develop a rule-based detection system [7; 8]. In this strategy, a pool of experts generates a set of rules to identify insiders' malicious activities. Then, each user's behavior is recorded as a log and is tested to determine whether it meets any of the pre-designed rules. [PERSON] et al. [9] discussed the types of insider threats and domain knowledge to prevent/detect insider threats. Rule-based detection methods have a critical limitation in that the rules must be constantly updated through the knowledge of domain experts, so the risk of someone circumventing the rules always exists [10]. Hence, rule-basedmethods based on expert knowledge are inflexible to changing insider threats methods, which results in unsatisfactory detection performance [7; 10; 11]. The second strategy is to build a network graph to identify suspicious users or malicious behaviors by monitoring the changes of the graph structure [12]. Graph-based insider threat identification does not only analyze the value of the data itself but also analyzes the relationships among the data. The relationships among the data are represented by edges connecting the nodes of the graph, and its properties can be analyzed to determine the relationships of specific nodes to insider threats. [PERSON] et al. [12] defined an abnormal activity if modifications, insertions, or deletions occur in the underlying structure of a normal data graph. To determine the structure of a normal data graph, they employed a graph-based knowledge discovery system called \"SUBDUE\". [PERSON] et al. [13] used graph-based anomaly detection (GBAD)-MDL, GBAD-P and GBAD-MPS to determine the ideal structure of a graph, and added an ensemble-based approach to detect abnormal insider activities in the \"1998 Lincoln Laboratory Intrusion Detection\" dataset. The third strategy is to build a statistical or machine learning model based on previous data to predict potential malicious behavior [14]. Machine learning is a methodology in which a computer learns an algorithm to optimize appropriate performance criteria from training data to perform given tasks [15]. Insider threat detection using machine learning aims at developing a method to automatically identify users who perform unusual activities among all users without prior knowledge or rules. Because the machine learning methodology can continuously learn and update the algorithms from the data, it can perform stable and accurate detection compared to rule-based detection. [PERSON] et al. [16] employed random forest [17] and isolation forest [18] to classify retirees for the 'Vegas' dataset, in which behavior features are extracted from e-mail transmission patterns and contents, logon and logoff records, web browsing patterns, and file access patterns. [PERSON] et al. [4] collected user activity data for 5500 users using a tool called \"SureView\" (Forcepoint, Austin, TX, USA).