# Insider Threat Detection Based on User Behavior Modeling and Anomaly Detection Algorithms
## 4 Results
### Insider-Threat Detection with E-mail Contents  
Tables 13-15 show the insider threat detection performance of six individual anomaly detectors with the best combination of them, i.e., Parzen + PCA, based on the e-mail contents dataset for the three roles. In contrast to the daily activity datasets, anomaly detection is more successful for \"IT Admin\" than the other two roles. Parzen + PCA yields a 37.56% detection rate with the top 1% of cut-off values, and it steadily increases to 98.67% for the top 30% of cut-off values. Anomaly detection performance for \"Electrical Engineer\" and \"Salesman\" are similar, the lift of the true detection rate against the random guess is above 4.5 with 1% of the cut-off value and approximately two-thirds of abnormal activities are detected with the 30% cut-off values.  
Among the anomaly detection algorithms, KMC is the most effective algorithm for \"Electrical Engineer\" but no single algorithm yielded the best performance for \"Salesman\". Another observation that is worth noting is that the performance of single anomaly detection algorithms is highly dependent on the characteristics of the dataset. Parzen + PCA yielded the highest detection rate for \"IT Admin\"  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Anomaly** & **Gauss** & **Parzen** & **PCA** & **KMC (K = 3)** & **KMC (K = 5)** & **KMC (K = 10)** & **Parzen + PCA** \\ \hline
1\% & 0.0000 & 0.0000 & 0.0000 & 0.0000 & 0.0000 & **0.0000** & **0.3756** \\
5\% & 0.2022 & 0.3178 & 0.2867 & 0.0000 & 0.0000 & 0.0000 & **0.6867** \\
10\% & 0.3333 & 0.7533 & 0.4178 & 0.0000 & 0.0000 & 0.0000 & **0.8333** \\
15\% & 0.5156 & 0.8622 & 0.5867 & 0.0000 & 0.0000 & 0.0000 & **0.8667** \\
20\% & 0.6667 & **0.9333** & 0.6867 & 0.0000 & 0.0000 & 0.0000 & 0.9044 \\
25\% & 0.7378 & 0.9356 & 0.8222 & 0.0000 & 0.0000 & 0.0000 & **0.9600** \\
30\% & 0.8667 & 0.9356 & 0.9067 & 0.0000 & 0.0000 & 0.0000 & **0.9867** \\ \hline \hline \end{tabular}
\end{table}
Table 15: True detection rate of each anomaly detection algorithm based on the e-mail contents dataset (Salesman). Best performance is shown in bold and underlined (number of normal behaviors in the test: 64,425, number of malicious behaviors in the test set: 40).  
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Anomaly** & **Gauss** & **Parzen** & **PCA** & **KMC (K = 3)** & **KMC (K = 5)** & **KMC (K = 10)** & **Parzen + PCA** \\ \hline
1\% & 0.0066 & 0.0000 & 0.0600 & 0.0000 & 0.0000 & 0.0000 & **0.3756** \\
5\% & 0.2022 & 0.3178 & 0.2867 & 0.0000 & 0.0000 & 0.0000 & **0.6867** \\
10\% & 0.3333 & 0.7533 & 0.4178 & 0.0000 & 0.0000 & 0.0000 & **0.8333** \\
15\% & 0.5156 & 0.8622 & 0.5867 & 0.0000 & 0.0000 & 0.0000 & **0.8667** \\
20\% & 0.6667 & **0.9333** & 0.6867 & 0.0000 & 0.0000 & 0.0000 & 0.9044 \\
25\% & 0.7378 & 0.9356 & 0.8222 & 0.0000 & 0.0000 & 0.0000 & **0.9600** \\
30\% & 0.8667 & 0.9356 & 0.9067 & 0.0000 & 0.0000 & 0.0000 & **0.9867** \\ \hline \hline \end{tabular}
\end{table}
Table 14: True detection rate of each anomaly detection algorithm based on the e-mail contents dataset (IT Admin). Best performance is shown in bold and underlined (number of normal behaviors in the test set: 17,077, number of malicious behaviors in the test set: 15).  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Anomaly** & **Gauss** & **Parzen** & **PCA** & **KMC (K = 3)** & **KMC (K = 5)** & **KMC (K = 10)** & **Parzen + PCA** \\ \hline
1\% & 0.0000 & 0.0000 & 0.0000 & 0.0376 & 0.0436 & **0.0487** & 0.0000 \\
5\% & 0.0000 & **0.1949** & 0.0000 & 0.1154 & 0.1128 & 0.1359 & 0.0359 \\
10\% & 0.0000 & **0.2359** & 0.0000 & 0.1692 & 0.1487 & 0.1385 & 0.1436 \\
15\% & 0.0000 & **0.2769** & 0.0000 & 0.2154 & 0.2282 & 0.1974 & 0.24 but did not work well for \"Electrical Engineers\" and \"Salesman\". On the other hand, KMC produced the highest detection rate for \"Electrical Engineer\" but it failed to detect any of the actual malicious e-mails for \"IT Admin\".