# Image-Based Feature Representation for Insider Threat Classification
## 3 Proposed Method
### Transfer Learning  
Transfer learning [32] is a research direction in machine learning that focuses on retaining knowledge obtained during problem solving and re-applying it to another similar problem. Transfer learning models can be broadly categorized into four types: instance-based, parameter, feature-representation, and relational-knowledge transfer learning [32]. Amongst these categories, feature-representation transfer learning is most suitable because this approach aims to identify good feature representations that can be utilized across domains. In the proposed approach, pre-trained  
Figure 4: Sample grayscale images. Figure 5: The Convolutional Neural Network (CNN) architecture comprises of a stack of Convolutional layer, Nonlinear layer rectified linear activation unit (ReLU), Pooling layer, and a Loss function (like Softmax) on the last fully connected layer. CNNs are used to extract image features that are domain-independent features, thereby improving the transferability from source to target domain. A CNN pre-trained on ImageNet is used, where the top layers are replaced with the classification head. There is remarkable reduction in the training time; hence, pre-trained models are preferred where applicable. Transfer learning is mainly used to eliminate the overhead in training. The pre-trained models use two methods to build new models: feature extraction and fine-tuning. In fine-tuning, we can add more layers to accommodate the new classes. We use the fine-tuning method here. Fine-tuning is the approach followed on a pre-trained model to extend the model so that it suits the need of the new dataset. There is no need to train the model from scratch. This helps in reducing the training time. Here, a few other layers will be trained by updating the weights while training. The training process will tune the weights to match the features in our dataset. Usually the higher layers of the convolutional networks are more specialized. The lower layers learn generic and simple features that can be generalized to most of the images. Moving up the network, the features become more specific to the dataset on which the model is being trained. The main goal of fine-tuning is to use the specialized features with the desired dataset, rather than overwriting the generic learning. Fine-tuning can be applied to increase the performance. Transfer learning is commonly used with problems on predictive modeling where the input is in the form of images. Each model uses a different image size as input tensor. We scale the images to \(32\times 32\) and modified the pre-trained models to accept input images of these dimensions. If the input dimensions are too large, the network might fail to achieve reasonable accuracy as there are not enough layers in the network to learn the features. If the dimensions of the input image is too small, then the neural network naturally reduces volume of dimensions during the forward propagation and then effectively runs out of data. Our image dataset is dissimilar to the data that is used for pre-training of the original model. Therefore, we perform customization of the network and re-train the model. The proposed approach has two parts: the convolutional base and the classifier head. The convolutional base contains the pre-trained base model. In this stage, the pixels of the input image are converted into features. Then, these features are passed onto the classifier head. The convolutional base is responsible for getting the features from the input image. Once the features are extracted, it is passed to the fully connected layer, and the last layer with the classifier does the prediction in terms of the probability. The fully connected layers connect all the neurons with each other and combines all the features to get the best prediction. In the fully connected layer, every neuron in the previous layer connects to every neuron in the next layer.