# Image-Based Feature Representation for Insider Threat Classification
## 1 Introduction  
Insider threat is one of the most prevalent cybersecurity threats. It refers to potential attacks perpetrated by trusted employees associated with that organization. These employees may have access to sensitive information and resources, which makes it easier for them to orchestrate an attack. There can be many reasons for insider attacks like unintentional human error, conflict with co-workers or managers, and coercion by competing organizations. Insider threats are mainly targeted at violation and sabotage of computer systems and data exfiltration activities. Recent literature vividly prove the significance of this threat and its prevalence. However, there is still no concrete solution to efficiently characterize insider attacks and to facilitate an understanding of the problem and its various components. The Verizon 2019 Data Breach Investigations Report (DBIR) [1] revealed that there has been a considerable rise in insider incidents. In 2018, the percentage of internal actors involved in overall breaches was 28%, whereas it increased to 34% in 2019. A study on the cost of Cybercrime jointly performed by Accenture and the Ponemon Institute in 2019 [2] revealed that average cost of an insider attack increased by 15% from 2018 to 2019. The Cost of a Data Breach Study in 2019 [3] claimed that the lifecycle of a breach takes 206 days (over 6 months) to first identify it and another 73 days to contain it. Researchers use data analysis techniques to detect and mitigate security challenges. The use of statistical learning, machine learning, artificial intelligence, and natural language processing techniques has been broadened to solve cybersecurity use cases like detecting malwares and intrusions, phishing, denial of service (DoS) attacks, etc. Security analytics is an approach of data processing which combinesacquisition, aggregation and analysis techniques of data for security monitoring and threat detection. Security analytics solutions can be applied on large and diverse datasets using machine learning, deep learning, and artificial intelligence frameworks. Deep Convolutional Neural Networks (DCNNs), one of the most popular deep learning models, proved to be highly efficient in handling visual data, such as images and videos [4]. The challenge of insider actions is that they might only leave a small footprint in the digital audit data because attackers know precisely how and where sensitive data resides and are aware of the security solutions implemented in the organization. This is why certain insider incidents are not revealed for a prolonged period. Effective and efficient data analysis platforms for insider attacks remains an open challenge. Different insider threat patterns, such as unintentional human errors, misuse of privilege by unsuspecting and malicious users, and cyber espionage, aggravate the complexity of insider threat detection. Inexpensive data storage and increased computing power motivates data scientists to acquire and analyze huge volume of resource access log data. The data used in any learning algorithm for insider threat attack needs to be transformed into a structured format and used for discrepancy or user behavior analysis. In this paper, we propose an image-based feature representation method to depict the behavioral pattern of the employees in an organization. These images are used to detect the anomalous patterns using deep learning models, thereby detecting the insiders. Our contributions in the work are summarized as follows. First, we represent the resource access patterns of the employees, from a benchmark dataset, as 1D feature vectors and grayscale images. Second, anomaly detection is applied on the 1D feature vectors using deep neural networks and on the images, using deep convolutional neural network to detect unusual usage patterns and to identify the malicious insiders. Third, we compare the effectiveness of our approach with the state-of-the-art deep learning methods available in recent literature. The remainder of the paper is organized as follows.