# Insider Threat Detection Based on User Behavior Modeling and Anomaly Detection Algorithms
## 3 Insider-Threat Detection
It is possible to estimate the density of the given dataset by adding all kernel function values for a certain location and dividing the sum by the total number of observations. If the density of a new observation is low, it is highly likely that it is abnormal. PCA is a statistical method that finds a new set of axes that preserves the variance of the original dataset as much as possible [34]. Once these axes are determined, the high-dimensional original dataset can be mapped to a lower dimensional space without significant loss of information [15]. Solving PCA for the dataset \(X\in R^{n\times p}\) is equivalent to finding the eigenvector matrix \(V\in R^{n\times p}\) and the corresponding eigenvalues \(\lambda_{1},\lambda_{2},\cdots,\lambda_{p}\) (\(\lambda_{1}>\lambda_{2}>\cdots>\lambda_{p}\)). Applying PCA, an instance \(x\in R^{p}\) is mapped into a k -dimensional space (k < p) using the first k eigenvectors:  
\[\mathrm{x^{\prime}}=\mathrm{V^{\prime}}^{\mathrm{T}}\mathrm{x} \tag{7}\]  
where, \(V^{\prime}\in R^{n\times k}\) consists of the first k eigenvectors. In PCA, the reconstruction error e(x), which is the difference between the original vector and its image reconstructed from the lower dimensional space to the original space, can be used as an anomaly score:  
\[\mathrm{e(x)}=\left\|\mathrm{x-V^{\prime}}\mathrm{V^{\prime}}^{\mathrm{T}} \mathrm{x}\right\|^{2}=\left\|\mathrm{x}\right\|^{2}-\left\|\mathrm{V^{\prime} }\mathrm{V^{\prime}}^{\mathrm{T}}\mathrm{x}\right\|^{2} \tag{8}\]  
KMC is a clustering method that assigns each observation (\(x_{j}\)) to the closest centroid (\(c_{i}\)) so that observations assigned to the same centroid form a cluster [15]:  
\[\mathrm{argmax}_{\mathrm{c}}\sum_{i=1}^{K}\sum_{x_{j}\in\mathrm{C}_{i}}\left\| \mathrm{x}_{j}-\mathrm{c}_{i}\right\|^{2} \tag{9}\]  
where, K is the number of clusters and is an algorithm-specific hyper-parameter that must be determined prior to executing the algorithm. We examined three K values (3, 5, and 10) in this study. Once KMC is completed based only on normal instances, the distance information between a new instance and its closest centroid is used to compute the anomaly score, as shown in Figure 4d [35]. \(D_{i}\) is the distance between the test instance and its closest centroid while R is the radius of the cluster (the distance between the centroid and the farthest instance from the centroid in the cluster). The relative distance \(D_{i}/R\) is the commonly used anomaly score in KMC-based anomaly detection. In addition to the individual anomaly detection algorithms, we also consider a combination of these algorithms. Even when learning the same data, the methodology for building the optimal model for each algorithm is different, so there is no single algorithm that is superior in all situations in the machine learning field [36]. In this situation, combining different techniques can be advantageous as they generally improve the prediction performance compared to a single algorithm [36; 37; 38; 39]. Hence, we examined all possible combinations of four individual anomaly detectors to determine the best combination for the given task and dataset. Since each algorithm has a different range of anomaly scores, we used the rank instead of score to produce the ensemble output. More specifically, for each test instance, its anomaly score ranking for each model in the ensemble is computed and the inverse of the averaged ranks was used as the anomaly score of the ensemble.