# Insider Threat Detection Based on User Behavior Modeling and Anomaly Detection Algorithms
## 2 Dataset and User Activity Modeling
### User Activity Modeling Based on \(E\)-mail Network  
Because the sender/receiver information is also available from the e-mail log records, as shown in Table 6, we constructed the e-mail communication network on a weekly basis and extracted quantified features as the third source of user activity analysis for insider-threat detection. Based on the information available from Table 6, a directed e-mail communication network can be constructed, as shown in Figure 2. The imaginary company name for CERT data is \"dtaa\" and uses the email domain @dtaa.com. There are also 21 other domain names. In the CERT dataset, users used either the company account email domain \"@dtaa.com\" or another domain such as \"@gmail.com\". Users sent and received e-mails to/from users in the same department or different departments in the same company. They also sent and received emails to/from entities outside of the company. In this study, a user's email account is set as a node, and the edges between two e-mail accounts are weighted based on the number of incoming and outgoing e-mails.  
Once the weekly e-mail communication network was constructed, we computed a total of 28 network-specific quantified features for each user, as shown in the Appendix A, Table A3. These variables include the in- and out-degrees for personal or business e-mail account, the in- and out-degree similarity between two consecutive time-stamps for the same account in terms of  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**ID** & **Topic1** & **Topic2** & \(\dots\) & **Topic50** & **Target** \\ \hline (I102-B4 EB49 RW-7379 WSQW) & 0.008 & 0.012 & \(\dots\) & 0.154 & 1 \\ (L7E7-V4 UX89 RR-3036 ZDHU) & 0.021 & 0.008 & \(\dots\) & 0.125 & 1 \\ (S8C2-Q8 YX87 Df)-0516 SWZ) & 0.014 & 0.006 & \(\dots\) & 0.145 & 0 \\ (A1V9-O5 BL46 SW-1708 NAEC) & 0.352 & 0.014 & \(\dots\) & 0.086 & 0 \\ (N6R0-M2E182 DM-5583 LSUM) & 0.412 & 0.058 & \(\dots\) & 0.285 & 0 \\ (O2N1-C4 ZZ85 NQ-8332 GEGR) & 0.085 & 0.421 & \(\dots\) & 0.001 & 0 \\ \hline \hline \end{tabular}
\end{table}
Table 7: Quantified e-mail content examples with actual label (normal = 0 and abnormal = 1).  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Salesman** & \multicolumn{2}{c}{**IT Admin**} & \multicolumn{2}{c}{**Electrical Engineer**} \\ \hline Normal & Abnormal & Normal & Abnormal & Normal \\
644,252 & 40 & 170,765 & 15 & 694,050 & 13 \\ \hline \hline \end{tabular}
\end{table}
Table 8: Normal (0) and abnormal (1) e-mail count for the three roles.  
Figure 2: Example of email communication network.  
the Jaccard similarity [27], as computed by Equation (1), and the centrality measure in terms of the betweenness, as computed by Equation (2).  
\[\begin{split} Jaccard(Node_{t-1},\ Node_{t})=\frac{\left|Degree|Node_{t -1}|\cap Degree|Node_{t}|\right|}{\left|Degree|Node_{t-1}|\cup Degree|Node_{t}| \right|},\end{split} \tag{1}\]  
\[\begin{split} Betweenness(i)=\sum_{j<k}\frac{g_{jk}(N_{i})}{g_{jk}}, \end{split} \tag{2}\]  
where, \(g_{jk}\) is the number of the shortest paths between two nodes \(j\) and \(k\), and \(g_{jk}(N_{i})\) is the number of paths containing node \(i\) among the shortest paths between the two nodes \(j\) and \(k\). Betweenness centrality tends to be higher when one node in a network plays a bridging role for other nodes. Among the four well-known centrality measures, i.e., degree centrality, closeness centrality, betweenness centrality, and eigenvector centrality [28], we used the betweenness centrality to determine whether a specific e-mail account behaves as an information gateway in the overall e-mail communication network.  
Among the 4000 users in the CERT dataset, only four users, i.e., CDE1846, CMP2946, DNS1758, and HIS1706, sent or received unusual emails. The numbers of normal and abnormal e-mails for these users are shown in Table 9.