# An Artificial Neural Network Autoencoder for Insider Cyber Security Threat Detection
## 2 Related Works  
As cybersecurity is an evolving area, many works in the literature have proposed solutions for insider threat detection. Most often, insider threats are difficult to recognize, and they remain unnoticed in a variety of ways, such as by compromising the systems and acting as if they were legitimate users, exfiltrating data remotely using a command-and-control server (C&C) by the attacker, etc. It is important to recognize that during their daily activity, every individual has a unique behavior for every action they take on a system. For example, a user's behavior within the system is affected by how they move the mouse, click or type keystrokes on the keyboard, navigate web pages, etc. An indication of anomaly behavior that gives more exposure to insider threats can be detected when the user behavior does not match the expected and usual behavior. Many antivirus software products like Kaspersky, McAfee, Avast, etc. maintain a large evolving database for historical storage of known security threat patterns. These organizations update the databases continuously as a new security attack pattern is found. However, the limitation of antivirus programs is that they cannot detect unknown threat patterns caused by the changed behavior of users. To overcome the existing limitation of such software, anomaly-based user behavior detection is proposed in different studies. UEBA solutions have been proposed in [10] for the Niara Security Analytics Platform in the form of a platform aimed at providing insider threat detection. This work proposes a solution for detecting security attacks by compromising an organization's network architecture. The platform takes into account a number of features, including the time stamp of the first and last access during a day, the duration between those accesses, and the number of bytes sent and received. Using Mahalanobis distance, the algorithm calculates the distance between an observed and the mean value of all observations, which is then projected onto the singular value decomposition (SVD) space. The algorithm automatically detects anomalies and reports them to the analyst. [PERSON] et al. in [11] demonstrated how graph-based anomaly detection (GBAD) approaches can be used to detect insider threats. The proposed method does not use the values of the data; instead, it uses relationships among the graph-based data, where relationships are projected with the help of edges between nodes of the graph. To analyze the graph's structure, the authors in the paper use a graph-based technology system called \"SUBDUE\". The results show that the GBAD anomaly detection using the GBAD minimum descriptive length and probabilistic and maximum partial substructure are prevailing, along with an ensemble-based approach to the detection of anomaly behavior. Another approach to security threat detection is proposed based on network logs collected from the network devices. [PERSON] et al., in [12], worked on detecting insider threats based on the data related to social and online activity. The data contain features such as email attachments, files, user access activity, etc. The authors tried two approaches, namely, unsupervised learning, where they implemented an isolated forest algorithm, and the supervised approach, based on a random forest algorithm. Both methods performed well in terms of detecting insider security threats. Some solutions related to security threat detection based on a binary classification have been proposed. The binary classification of security threat problems consists of two classes, positive and negative. If the binary classification is performed based on traditional machine learning algorithms, these algorithms attempt to classify the test cases as positive or negative, with high accuracy in cases where training data contain a ratio of positive to negative samples. If the dataset is imbalanced, then the model will be biased towards the class containing the higher number of samples.