# Insider Threat Detection Based on User Behavior Modeling and Anomaly Detection Algorithms
## 5 Conclusions  
In this paper, we proposed an insider-threat detection framework based on user behavior modeling and anomaly detection algorithms. During the user behavior modeling, individual users' heterogeneous behaviors are transformed into a structured dataset where each row is associated with an instance (user-day, e-mail content, user-week) and each column is associated with input variables for anomaly detection models. Based on the CERT dataset, we constructed three datasets, i.e., daily activity summary dataset based on user activity logs, an e-mail content dataset based on topic modeling, and an e-mail communication network dataset based on the user's account and sending/receiving information. Based on these three datasets, we constructed insider-threat detection models by employing machine learning-based anomaly detection algorithms to simulate real-word organizations in which only a few insiders' behaviors are actually potentially malicious. Experimental results show that the proposed framework can work reasonably well to detect insiders' malicious behaviors. Based on the daily activity summary dataset, the anomaly detection model yielded at most 53.67% of the detection rate by only monitoring the top 1% of suspicious instances. When the monitoring coverage was extended to the top 30% of anomaly scores, more than 90% of actual abnormal behaviors were detected for two roles among the three evaluated. Based on the e-mail content datasets, at most 37.56% of malicious e-mails were detected with the 1% cut-off value while the detection rate increased to 65.64% (98.67% at most) when the top 30% of suspicious e-mails were monitored. Based on the e-mail communication network dataset, all the malicious instances were correctly identified for three out of four tested users. Although the proposed framework was empirically verified, there are some limitations in the current research, which led us to future research directions. First, we constructed three structured datasets to train the anomaly detection algorithms. Because the instances of these three datasets are different from each other (a user's daily activity, an e-mail's topic distribution, a user's weekly e-mail communication), anomaly detection models are independently trained based on each dataset. If these different anomaly detection results are properly integrated, it may be possible to achieve a better insider-threat detection performance. Second, we built the insider-threat detection model based on specific time unit, e.g., a day. In order words, this approach can detect malicious behaviors based on the batch process, but cannot detect them in a real-time. Hence, it could be worth developing a sequence-based insider-threat detection model that can process online stream data. Third, the proposed \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Anomaly** & **Gauss** & **Parzen** & **PCA** & **KMC (K = 3)** & **KMC (K = 5)** & **KMC (K = 10)** & **Parzen + PCA** \\ \hline
1\% & 0.0000 & 0.0000 & 0.0000 & **0.3333** & **0.3333** & **0.3333** & 0.0000 \\
5\% & 0.3333 & 0.0000 & 0.0000 & **0.6667** & **0.6667** & 0.3333 & 0.0000 \\
10\% & 0.3333 & 0.0000 & 0.3333 & **1.0000** & **1.0000** & 0.3333 & 0.0000 \\
15\% & 0.6667 & 0.3333 & 0.6667 & **1.0000** & **1.0000** & 0.3333 & 0.0000 \\
20\% & 0.6667 & 0.3333 & 0.6667 & **1.0000** & **1.0000** & 0.3333 & 0.3333 \\
25\% & 0.6667 & 0.3333 & 0.6667 & **1.0000** & **1.0000** & 0.3333 & 0.3333 \\
30\% & 0.6667 & 0.3333 & 0.6667 & **1.0000** & **1.0000** & 0.6667 & 0.3333 \\ \hline \hline \end{tabular}
\end{table} 
Table 19: True detection rate of each anomaly detection algorithm based on the e-mail communication network dataset (HIS1706). Best performance is shown in bold and underlined (number of normal behaviors in the test set: 493, number of malicious behaviors in the test set: 3). model is purely data-driven. However, in the security domain, combining the knowledge of experts and a pure data-driven machine learning model can enhance the insider-threat detection performance.