## 3 Descriptive and Literature Classification
### Insider Threat Detection
#### 3.2.1 Analyzed Behaviors
[59] introduced an anomaly detection system, PROactive Detection of Insider threats with Graph Analysis and Learning PRODIGAL, to support human analysts by combining multiple machine-learning-based anomaly detection techniques. [PERSON] et al. [60] discussed the password disclosure case and how the cryptography and, especially, the elliptic curve cryptography (ECC) worked, and because of its smaller keys, the ECC dominated the role of providing secure communication. Using ECC, it is appropriate to encrypt the users' passwords and share them when users need to communicate with Internet applications. Another widely analyzed feature in cyber activities is the network packet or network traffic using different methods, such as machine-learning techniques, to model the behavior of insiders [61; 62; 63; 64; 65; 66; 67]. Encryption and pattern-matching techniques [68; 69; 70; 71; 72] and network-attached systems, such as HoneyBot and deception (i.e., a decoy network interface controller) [73; 74; 75; 76] have also been used. Traffic monitoring tools [77; 78], a behavioral analysis based on a zero-knowledge anomaly called XABA (semi-comprehensive solution) [79], and novel algorithms are beneficial for detecting insider attacks on wireless sensor networks [80]. The industrial sector used ISA100.11a, a smart response mechanism based on wireless sensor networks [81]. Gossip protocols have been used to introduce the overlay architecture of networking designed to facilitate information sharing on mobile devices [82]. Dynamic access control [83] is a mechanism that is heavily dependent on malicious node assumption to design advanced collision attacks called random poisoning [84]. Other studies used a mathematical model [85], unknown input observers [86], Dynamic Host Configuration Protocol DHCP starvation attack and Transmission Control Protocol TCP [87; 88; 89], simple statistical measures [90], and Bayesian network model to predict insider threats [91]. Several articles focused on event log features, such as printer, system, and security logs. For example, [PERSON] and [PERSON] [92] calculated the probability of an intrusion behavior for a given event using the Bayesian theorem. [PERSON] et al., [PERSON] et al., and [PERSON] et al. [93; 94; 95] analyzed active directory services and audit logs using the Markov model, hierarchical task decomposition, and a rule learning algorithm, respectively. The works [96; 97; 98; 99; 100; 101; 102; 103; 104; 105; 106; 107; 108; 109] combined and analyzed multiple log features collected from multiple sources, such as email, HTTP, logon, files, and devices to detect insider threats using statistical methods and machine-learning techniques[PERSON]  
The features of the user database and file access patterns have been studied by [PERSON] et al. [110] using statistical methods, a community anomaly detection system applying a relational framework [111]. One-Class Support Vector Machine OCSVM to analyze features [112], rule mining [113], and cryptographic techniques and watermarking [114]. A probabilistic mechanism was used to re-encrypt files [115], the scoring function [116], the naive Bayes algorithm, and vector space model (VSM) [117]. Consensus clustering was employed to create multi-view anomaly detection methods [118], a random topic access model [119], community evolution discovery [120], orthogonal defense mechanism [121], incremental algorithms [122], and an unsupervised approach [123]. Algorithms and techniques on structured query language (SQL) queries [124; 125; 126; 127] were used, and a malicious information flow was detected through bridge data items [128]. This approach enables the identification of deviations by reconciling the process and data perspectives [129]. A user profiling approach was used to detect suspicious transactions using a two-stage database intrusion detection system [130]. Moreover, methods for bypassing data loss prevention systems were used over trusted applications [131], and a solution for fine-grained histogram-based profiles of database usage was created [132].