# Image-Based Feature Representation for Insider Threat Classification
## 2 Related Work
The model was built and tested using the CMU CERT Insider Threat dataset v6.2. Performance comparison of the proposed technique was done against popular algorithms, such as SVM and Isolation Forest, but it was not compared with deep learning models. [PERSON] et al. [15] formulated a hybrid method using Deep Belief Networks (DBN) for feature reconstruction, and One Class SVM (OCSVM) for insider threat detection. In the first step, the features were learned using the DBN model. Then, the multi-domain features were re-learned, and the hidden features were extracted and trained by the first layer that is visible in DBN, followed by each layer of Restricted Boltzmann Machine (RBM). The last layer was set up with the back-propagation network which receives the feature vector generated from RBM and optimizes the parameters of the entire network. Finally, the last layer of the network is replaced with the trained multilayer structure as a feature extractor. These features were fed to OCSVM to train the insider threat detection model. Each day was divided into intervals of fixed time to calculate the activity frequency from the resource log files. The evaluation of the method using CMU CERT Insider Threat dataset achieved an accuracy of 87.79%. [PERSON] et al. [16] presented a user behavior anomaly detection-based insider threat detection technique using Deep Neural Network (DNN). User actions sequences were fed to a Long Short-Term Memory (LSTM), which extracts user behavior features and predicts the next user action. A sequence of hidden states of the LSTM model were used to create a feature matrix of fixed-size, which is given to the Convolutional Neural Network (CNN), that it normal or anomaly. The hidden units of the LSTM efficiently captures the temporal behavior patterns. Hence, the temporal dependencies on user action sequence in a long-term were recorded by LSTM. CMU CERT Insider Threat dataset V4.2 was used for experimentation and the results are promising with an area under the curve (AUC) of 0.9449. [PERSON] et al. [17] focused on the unsupervised deep learning model DBN. The pre-processing stage included the collection and analysis of the insider behavior logs to extract the behavior feature in the format of a tuple. It included the time of the occurrence of the behaviors, the behavior subject, the host that produces the behaviors, and the specific behaviors. All kinds of logs had the first three items common in it. The fourth item behavior depended on the behavior types and was more difficult to integrate. 1/N code discretization was used on the extracted features for data normalization. The deep learning network model DBN used these features for threat detection. More than one RBM hidden layer with the sigma activation function was used. Back propagation was used to fine tune the network parameters to get an optimized DBN model. CMU CERT Insider Threat dataset was used for method validation. [PERSON] [18] proposed an approach for insider threat detection based on classification of time-series user activities. Features of each day and related statistics were computed to construct the time-series features. Since the dataset is highly imbalanced, a cost-sensitive technique for data adjustment was used to randomly undersample the instances belonging to non-malicious class. A deep autoencoder with two layers was used for the classification. The observations showed that random forest and deep autoencoder classified the time-series feature vectors with high precision, recall and f-score. Using Multilayer perceptron gave a higher recall, but it resulted in a low f-score and precision than the other classifiers. A behavioral analysis framework (BAIT) was proposed by [PERSON] et al. [19] for insider threat detection using a semi-supervised classification method that learns from highly imbalanced data. In this work, a one-person game was designed, and 795 players were recruited to play the game on Amazon Mechanical Turk. A few subjects were added to behave maliciously, thereby introducing imbalance.