# Insider Threat Detection Based on User Behavior Modeling and Anomaly Detection Algorithms
## 3 Insider-Threat Detection  
Figure 3 shows the overall framework of the insider-threat detection method developed in this study. In the user behavior-modeling phase, each user's behaviors stored in the log system are converted to three types of datasets: daily activity summary, e-mail contents, and e-mail communication network. In the anomaly detection phase, one-class classification algorithms are trained based on the three datasets. Once a new record is available, it is input to one of these three models to predict potential malicious scores. Figure 3: Insider-threat detection framework. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multicolumn{2}{c}{**CDE1846**} & \multicolumn{2}{c}{**CMP2946**} & \multicolumn{2}{c}{**DNS1758**} & \multicolumn{2}{c}{**HIS1706**} \\ \hline Normal & Abnormal & Normal & Abnormal & Normal & Abnormal & Normal & Abnormal \\
456 & 9 & 474 & 7 & 498 & 3 & 493 & 3 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Normal (0) and abnormal (1) e-mails for each user. For the insider-threat detection domain, it is very common that a very large number of normal user activity cases is available, whereas there are only a handful or no abnormal cases available. In this case, conventional binary classification algorithms cannot be trained due to the lack of abnormal classes [19]. Alternatively, in practice, one-class classification algorithms can be used in such unbalanced data environments [29]. Unlike binary classification, one-class classification algorithms only use the normal class data to learn their common characteristics without relying on abnormal class data. Once the one-class classification model is trained, it predicts the likelihood of a newly given instance being a normal class instance. In this paper, we employed Gaussian density estimation (Gauss), Parzen window density estimation (Parzen), principal component analysis (PCA) and K-means clustering (KMC) as one-class classification algorithms for insider-threat detection, as shown in Figure 4.  
Gauss [30] assumes that the entire normal user behavior cases are drawn from a single multivariate Gaussian distribution (Figure 4a), as defined in Equation (3):  
\[\mathrm{p}(\mathrm{x})=\frac{1}{\left(2\pi\right)^{d/2}\left|\Sigma\right|} \exp\left[-\frac{1}{2}[\mathrm{x}-\mu]^{T}\Sigma^{-1}[\mathrm{x}-\mu]\right] \tag{3}\]  
Hence, training Gauss is equivalent to estimating the mean vector and covariance matrix that are most likely to generate the given dataset, as in Equations (4) and (5):  
\[\mu=\frac{1}{n}\sum_{\mathrm{x}\in\mathrm{X}_{normal}}\mathrm{x}_{i} \tag{4}\]  
\[\Sigma=\frac{1}{n-1}\sum_{\mathrm{x}\in\mathrm{X}_{normal}}(\mathrm{x}_{i}- \mu)^{T}\Sigma^{-1}(\mathrm{x}_{i}-\mu) \tag{5}\]  
Figure 4: Four anomaly detection algorithms used in this paper. (**a**) Gaussian density estimation, (**b**) Parzen window density estimation (reprinted from [PERSON] (2014)), (**c**) Principal component analysis (PCA), and (**d**) K-means clustering (KMC). where, \(x_{i}\) is an object of a normal training instance and \(X_{normal}\) is the entire learning dataset consisting of only normal instances. The anomaly score of a test observation can be determined by estimating the generation probability of the given observation with the estimated distribution parameters [31]. Parzen is one of the well-known, kernel-based, non-parametric density function estimation methods [32]. Parzen does not assume any type of prior distribution and estimates the probability density function based solely on the given observations using a kernel function K, as in Equation (6):  
\[f_{h}\left\{x\right\}=\frac{1}{n}\sum_{i=1}^{n}K\left(\frac{x-x_{i}}{h}\right) \tag{6}\]  
where, \(h\) is the bandwidth parameter of the kernel function that controls the smoothness of the estimated distribution. The kernel function (Uniform, Triangular, Gaussian, and Epanechnikov) is a non-negative function that is symmetric about the origin and has an integral value of 1 [33]. In this paper, we used the Gaussian kernel function.