# Image-Based Feature Representation for Insider Threat Classification
## 3 Proposed Method  
In Section 2, the existing deep learning based insider threat detection methods are discussed. We use the resource access patterns of the employees in an organization to identify the major behavioral indicators and use them as features to perform anomaly detection. Usage patterns of employees are represented as 1D feature vectors. These feature vectors are used to create grayscale images. Anomaly detection is performed separately on the 1D feature vectors and on the grayscale images. We described image classification approaches which are state-of-the-art for malware detection [25; 26; 27; 28]. This motivated us to adopt image classification for insider threat detection. It is a novel contribution of this paper. The construction of user-behavior feature vectors, and their transformation into images are underlying steps in the proposed method. It is significantly different from image-based malware detection, in which the binaries are transformed into images with minimal preprocessing. Another novel contribution of the proposed method is the use of transfer learning (TL) for insider threat detection. We used popular TL frameworks to ease the process of designing the DCNN and finding suitable weights. Below, we elaborate the contributions of the paper. We used the 1D feature vectors to represent the behavior of employees on a daily basis. These feature vectors are used for behavioral analysis. Further, we performed transformation of feature vectors to images which is a significant step in the process of user-behavior representation. It bridges the gap between insider threat analysis and computer vision. Currently, no computer vision techniques are designed for the task of insider threat detection. Hence, to apply image-based analysis, modification to the existing methods or redefinition of the original problem is required. In this paper, we formulate the insider threat analysis problem as a computer vision problem, by creating images from user-behavior feature vectors. The usage logs of an organization contain all the information required to articulate user-behavior. Feature vectors that represent user-behavior are constructed by extracting relevant attributes from the usage logs. The feature vectors constructed from the usage logs are transformed into images. Once the images are created, deep neural network approach for image classification is applied to perform anomaly detection. Any deviation of the behavior from the model is treated as an anomaly. Transfer Learning (TL) is used in the proposed method to reduce the model complexity. TL is also referred to as inductive learning or domain adaptation. TL has been widely used in image recognition to transfer an already learned model into new tasks and domains. TL allows classifiers to retain their performance on incoming data with new distributions and/or classes by learning a new feature space [32]. TL was introduced to use knowledge from the source domain with sufficient labeled data to help build accurate models in a related but different domain, with small labeled data. This is well-suited for cybersecurity applications because of the limited number of malicious instances, as described in Section 4.2. This capacity of TL has been adopted in cybersecurity systems [33; 34; 35]. [PERSON] et al. [34] proposed a feature-based TL approach that improved the classifier performance on NSL-KDD dataset of TCP traffic, illustrating the merit of TL for the cyber security domain. Specifically, we applied feature-based transfer learning, as explained in Section 3.4. In the TL scheme, we borrow knowledge from computer vision and apply to the target domain of insider threat detection. As a result, training time of deep neural networks is reduced, while achieving high classification performance. Figure 1 shows the proposed process flow. First, we extract features from resource usage log files. Second, we present an image-based feature representation approach to map the user behavior. Third, we use deep learning based anomaly detection to detect malicious insiders.