# Image-Based Feature Representation for Insider Threat Classification
## 3 Proposed Method
### Classification  
Section 3.2 explained the construction of images which represents the resource usage behavior. In this section, we address the classification of 1D feature vectors and synthesized images as malicious or non-malicious. Deep learning models are applied to perform anomaly detection. Any deviation from the normal user behavior is considered as an anomaly. It is considered as a binary classification and hence the instances are labelled as malicious and non-malicious. Two sets of experiments are performed. First, a deep neural network (DNN) is used for the classification of the feature vectors. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Log file** & **Features** & **Description** \\ \hline \multirow{6}{*}{Login} & L1 & Difference between office start time and first login time \\ \cline{2-3}  & L2 & Difference between last login time and office end time \\ \cline{2-3}  & L3 & Average difference in time between office start time and number of \\  & L4 & Average difference in time between office end time and number of \\  & L9 & logins after office hours \\ \cline{2-3}  & L5 & Total number of logins \\ \cline{2-3}  & L6 & Number of logins outside office hours \\ \cline{2-3}  & L7 & Number of systems accessed \\ \cline{2-3}  & L8 & Number of systems used outside office hours \\ \cline{2-3}  & L9 & Average session length outside office hours \\ \hline \multirow{6}{*}{Email} & E1 & Count of emails sent outside the domain of organization \\ \cline{2-3}  & E2 & Count of emails sent within the domain from supervisor’s account \\ \cline{2-3}  & E3 & No. of attachments \\ \cline{2-3}  & E4 & Average email size \\ \cline{2-3}  & E5 & Number of recipients \\ \hline \multirow{2}{*}{Device} & D1 & Count of thumb drive usage outside office \\ \cline{2-3}  & D2 & Count of external device usage \\ \hline File & F1 & Number of.exe files downloaded \\ \hline Http & H1 & Count of usage of wikileaks.org \\ \hline \hline \end{tabular}
\begin{tabular}{l|c|c|c|c|c|} \hline
**Extracted** & \multirow{2}{*}{L1...L9} & E1...E5 & H1 & D1...D2 & F1 \\ \cline{2-3}
**Features** & & & & \\ \hline
**Normalized** & 0.5, 0.25, 0.394736842, 0, 0.137931034, 0.398118336, \\
**Feature** & 0.389830508, 0, 0, 0.5, 0.4, 0.059496405, 0.807304366, \\
**Values** & 0.831472448, 0.407746032, 0.80, 0.25, 0 \\ \hline
**Normalisation** & \multirow{2}{*}{154, 74, 121, 3, 38, 123, 118, 0, 1, 154, 74, 16, 247, 255, 123, 246, 78, 0} \\
**0-255** & & & \\ \hline
**Grayscale** & \multirow{2}{*}{} & \multirow{2}{*}{} \\
**image** & & & \\ \end{tabular}
\end{table} 
Table 1: Feature set used in the proposed approach. Figure 3: Image representation of the numerical features extracted from log files. Second, we use the Deep Convolutional Neural Network (DCNN) for the classification of the image data. DCNNs take the unprocessed data as input and transforms the data by processing it through a series of basic computational units to get the representations that have useful values for classification in the higher layers. Figure 4 shows sample images generated using the features given in Table 1.  
Deep Convolutional Neural Networks (DCNN) are comprised of neurons with weights and biases that are learnable. DCNN is a sequence of layers, and each layer of a network transforms one volume of activation to another applying a differentiable function. Figure 5 shows the input propagation through various layers of DCNN and how it finally gives a score for each class. The grayscale images are passed to the DCNN to compute the probability of a user being an insider or not. The network does the prediction by computing the probability for each class label. The error in the prediction is calculated using the loss function. Deep Convolutional Neural Network [36] models are popularly used in image classification and recognition. In order to train and test the images, each input image is passed through a series of convolution layers with filters, pooling, and fully connected layers. Training a deep learning model from scratch requires a very large dataset to avoid overfitting.