# Insider Threat Detection Based on User Behavior Modeling and Anomaly Detection Algorithms
## 2 Dataset and User Activity Modeling
### User Activity Modeling Based on \(E\)-mail Contents  
A user's daily e-mail usage logs (number of sent and received e-mails) are stored as shown in Table 6. Although some summary statistics are included in the input variables in Table 5, it is sometimes more important to analyze the content of each e-mail than to rely on simple statistics. Because the e-mail data table in the CERT dataset also contains content information as well as log records as shown in Table 6, we can conduct an individual e-mail-level content analysis. To do so, we employed topic modeling to transform a sequence of words (e-mail body) to a fixed size of numerical vectors to be used for training the insider-threat detection models. Topic modeling is a method of text analysis that uncovers main topics that permeate in a large collection of documents [25; 26]. Topic models assume that each document is a mixture of topics (Figure 1(c-1)) and each topic has its own word selection probability distribution (Figure 1(c-2)). Hence, the purpose of topic modeling is to estimate the parameters of the probabilistic document generation process such as topic distribution per document and word distribution per topic. Latent Dirichlet allocation (LDA) is the most widely used topic modeling algorithm [25]. The document generation process and two outputs of the LDA are shown in Figure 1. By observing actual words \(w_{d,i}\) in each document, LDA estimates the topic distribution per document \(\theta_{d}\) and the word distribution per topic \(\varphi_{k}\) given the hyper-parameter \(\alpha\). In this study, we set the number of topics to 50 and the value of \(\alpha\) to 1. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Number** & **Electrical Engineer** & **IT Admin** & **Salesman** \\ \hline
1 & numlogoffNight & numlogoffNight & numlogonDay \\
2 & numPClogoffNight & onoffNostsameDay & numPClogonDay \\
3 & numOpenOnPCNight & numConnectionDay & onoffNostsameNight \\
4 & numAttachmentNight & numCopyFromDeviceNight & numConnectionNight \\
5 & numSendNight & numWriteFromDeviceNight & numWriteFromDeviceNight \\
6 & numEmailSentwithAttachNight & numWebAccNight & numUploadNight \\
7 & numPClogonDay & numDownloadNight & numSendDay \\
8 & numOpenOnPCDay & numPClogoffNight & numlogonNight \\
9 & numAttachmentDay & numPCwithUSBDay & onoffNostsameDay \\
10 & numSendDay & numCopy2 DeviceNight & numPCwithUSBNight \\
11 & numEmailSentwithAttachDay & numCopyFromDeviceNight & numWrite2 DeviceDay \\
12 & Electrical engineer & numWebAccDay & numOpenOnPCDay \\
13 & numlogoffNight & numURLAccessedNight & numAttachmentDay \\
14 & numPClogoffNight & numRecievedDay \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Selected variables for each role. Table 7 shows the data format for insider-threat detection based on e-mail content analysis using LDA. The \"ID\" is a unique string that distinguishes a specific e-mail from other observations. The columns \"Topic 1\" through \"Topic 50\" indicate the probabilities assigned to the 50 topics per individual e-mail and are used as an input variable of the anomaly detection model. Note that the sum of the probabilities of the 50 topics is always 1. The \"Target\" is a variable that indicates whether the e-mail is normal (0) or abnormal (1). Table 8 shows the number of normal and abnormal e-mails for each of the three roles. We assumed that the e-mail topic distributions in each role are similar. Thus, if a topic distribution of a certain e-mail is significantly different from that of the other e-mails, it should be suspected as abnormal/malicious behavior. \begin{table}
\begin{tabular}{c c} \hline \hline
**Email** & **Description** \\ \hline ID & Primary key of an observation \\ Date & Day/Month/Year Hour:Min:Sec \\ User & Primary key of a user \\ PC & Primary key of a PC \\ To & Receiver \\ Cc & Carbon Copy \\ Bcc & Blind carbon copy \\ From & Sender \\ Activity & Activity (Send/Receive) \\ Size & Size of an email \\ Attachments & Attachment file name \\ Content & Content of an email \\ \hline \hline \end{tabular}
\end{table}