# Image-Based Feature Representation for Insider Threat Classification
## 5 Discussion and Conclusion  
The results in the Section 4.4 show that the image-based representation can be effectively applied to the insider threat detection. The dataset has high class imbalance with a ratio of 1:340 for \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multirow{2}{*}{\begin{tabular}{c} **Sample** \\ **Ratio** \\ \end{tabular} } & \multicolumn{4}{c}{**Training \% (70)**} & \multicolumn{4}{c}{**Training \% (80)**} \\ \cline{3-10}  & & **A** & **P** & **F** & **R** & **A** & **P** & **F** & **R** \\ \hline \multirow{4}{*}{\begin{tabular}{c} **Mobile** \\ **Net** \\ **V2** \\ \end{tabular} } & 5 & 75.84 & 83.83 & 87.06 & 90.54 & 78.60 & 83.48 & 87.83 & 92.65 \\ \cline{2-10}  & 10 & 85.32 & 89.98 & 92.83 & 95.84 & 87.81 & 90.86 & 93.49 & 96.27 \\ \cline{2-10}  & 20 & 93.38 & 95.24 & 96.13 & 97.09 & 94.59 & 95.32 & 96.21 & 97.18 \\ \cline{2-10}  & 25 & 94.61 & 96.21 & 97.54 & 98.09 & **95.28** & **96.21** & **97.58** & **98.18** \\ \hline \multirow{4}{*}{\
\begin{tabular}{c} **VGG19** \\ \end{tabular} } & 5 & 90.16 & 94.07 & 94.10 & 94.13 & 90.94 & 94.80 & 94.55 & 94.31 \\ \cline{2-10}  & 10 & 91.21 & 96.90 & 95.08 & 93.34 & 92.24 & 96.37 & 95.65 & 94.93 \\ \cline{2-10}  & 20 & 95.67 & 96.60 & 97.75 & 98.93 & 95.17 & 97.56 & 96.46 & 96.36 \\ \cline{2-10}  & 25 & 94.16 & 96.16 & 98.78 & 98.03 & **96.34** & **96.80** & **97.12** & **98.59** \\ \hline \multirow{4}{*}{
\begin{tabular}{c} **ResNet50** \\ \end{tabular} } & 5 & 78.94 & 80.20 & 83.66 & 94.75 & 79.26 & 83.99 & 87.96 & 92.33 \\ \cline{2-10}  & 10 & 87.45 & 91.13 & 93.25 & 95.47 & 87.98 & 91.17 & 96.16 & 93.60 \\ \cline{1-1} \cline{2-10}  & 20 & 89.95 & 95.29 & 90.43 & 85.27 & 92.28 & 95.29 & 96.18 & 97.15 \\ \cline{1-1} \cline{2-10}  & 25 & 93.41 & 95.13 & 95.54 & 96.68 & **95.31** & **96.12** & **97.43** & **98.09** \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Performance evaluation on the benchmark dataset using grayscale images. \begin{table}
\begin{tabular}{c c} \hline \hline
**Method** & **Accuracy (\%)** \\ \hline Random Forest with Randomization [13] & 94.00 \\ Random Forest [13] & 90.00 \\ LSTM-RNN [14] & 93.85 \\ DBN-OCSVM [15] & 87.79 \\ Graph Convolutional Networks [42] & 94.50 \\ Proposed Method & 96.34 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Performance comparison with existing approaches using the CMU CERT dataset v4.2. non-malicious and malicious instances. Therefore, we applied random undersampling. In image-based representation, the optimal imbalance ratios are identified as those with high precision, recall, and f1-score. The imbalance ratios from 5 to 25 gave promising results. The precision, recall, and f1-score remain consistent for these ratios. Increasing the sampling ratio beyond 25 causes the precision and recall to drop. This can be handled effectively by using techniques, like random oversampling of malicious instances. Data augmentation approaches can be applied to images to handle the issue of class imbalance [49]. The proposed approach is motivated by the effectiveness of deep learning to learn from very complex mappings between input and output data. Deep learning has proven to be successful in numerous fields like speech recognition, image recognition, and Natural Language Processing. However, the huge number of hidden neurons and layers used in Deep Neural Networks end up in computationally-intensive vector and matrix operations involving millions of parameters that need high performance computing resources. Moreover, it is impractical to collect labeled data samples in many real-world domains to train a network from scratch. In such cases, a pre-trained deep learning model can be used by fine-tuning it for new labels. This motivated us to formulate insider threat detection as a transfer learning problem. We proposed grayscale images to represent the behavioral features of users which were extracted from resource log files.