# Image-Based Feature Representation for Insider Threat Classification
## 2 Related Work  
Researchers have worked on a plethora of solutions for insider threat detection. [PERSON] et al. [5] proposed a novel categorization of the types of insider threat data available with references to existing works and frameworks available in the area of insider detection and analysis. [PERSON] and [PERSON] [6] classified insider threat detection approaches into nine classes based on the techniques and features utilized in the detection, namely anomaly-based, role-based access control, scenario-based using decoys and honeypots, risk analysis using psychological factors, risk analysis using workflow, improving defense of the network, improving defense by access control, and process control to dissuade insiders. Out of these classes, anomaly-based detection and user behavior analysis are popularly used. User profiling used in behavior analysis helps in bringing out the abnormal user behavior. It is well established as a primary approach in insider threat detection. [PERSON] et al. [7] present a review of solutions for insider threat detection with their advantages and shortcomings. According to the paper, the range of existing techniques are categorized into Intrusion-detection-based approaches, System-call-based approaches, Data-centric approaches, Honeypot approaches, Dynamical-system-theory-based approaches, Anti-indirect-exfiltration approaches, and Visualization approaches. One of the most popular approaches for insider threat problem is framing the problem as an anomaly detection problem [8]. [PERSON] et al. [9] contributed a well-studied overview of anomaly detection. In this paper, they state that anomaly detection methods for sequences with multivariate data is still in the budding stage. Machine learning methods can efficiently tackle the anomaly detection problem, and a lot of work has been accomplished in this direction. [PERSON] et al. [10] compared supervised classifier approach with an Isolation Forest-based unsupervised approach for detecting insider threat using network logs. This work aggregates details of those features that contribute most to the isolation of a data sample in the tree to clearly understand why a user was tagged as anomalous. Due to the scarcity of the real-world data, researchers use either data collected through their own data collection processes or synthetic data. The Carnegie Mellon University (CMU) Computer Emergency Response Team (CERT) generated a synthetic dataset mimicking an organization structure and the log files similar to the activities performed by the employees [11]. [PERSON] et al. [12] proposed a method that could unravel the non-linear relationships in log data. An ensemble of deep autoencoders is used to detect malicious insider activities by calculating a score from the error resulting from the original data and the reconstructed data. A model is built from each autoencoder for the input features extracted from each log file. Finally, all the models from the individual autoencoder are combined to build a single model that is used to vividly identify the user's behavior pattern. However, this process is not effective for a dataset from a different source. One of the limitations to this approach is that the feature extraction based on frequency does not always give the expected outcome. Further, the one-hour interval considered for user behavior study is not enough to identify the usage patterns. The experiments were performed using the Carnegie Mellon University (CMU) CERT Insider Threat dataset [11]. [PERSON] [13] tried different families of learning algorithms and concluded that random forest gives the best results with an accuracy of 94%. The experiments were performed using the CMU CERT Insider Threat dataset, and the risk factors were extracted from the data to create the feature vector. They incorporated the sentiment analysis factors from the email and the website content and file access details. [PERSON] et al. [14] used an approach using Long Short-Term Memory Recurrent Neural Network (LSTM-RNN) and Kernel PCA for the analysis of insiders.