# Insider Threat Detection Based on Deep Clustering of Multi-Source Behavioral Events
## 4 Experiment  
### Datasets  
To validate the effectiveness of our method, we conducted experiments using the CMU-CERT insider threat dataset r4.2 [28]. This dataset consists of audit records of five types of behaviors of 1000 employees: host logins, file accesses, email communications, web browsing, and mobile device connections, spanning 17 months from January 2010 to May 2011 within an enterprise. By detecting anomalous user behaviors in this dataset, we evaluated the insider detection performance of the algorithm.  
The dataset includes three types of anomalous user behaviors involving 70 malicious insiders. The first type involves 30 insiders who typically do not work after office hours. However, one day they suddenly logged into the host after office hours and used a USB device to copy data, later uploading it to WikiLeaks. The second type includes 30 insiders who started browsing a large number of job search websites and, before leaving the company, increased their frequency of using USB devices to steal data. The third type includes 10 insiders who are system administrators. These individuals downloaded a keylogger and copied it to the host of a department leader using a USB device. The following day, they used the collected keylogs to log into the department leader's host and sent a large number of emails, causing panic within the company.  
To preprocess the different types of behavior records for users, each behavior record was transformed into an event, with the type of behavior becoming the type of the event. After preprocessing, we obtain a collection of events, each including the following five entities:  
* Time entities: extracted from the hour field of the time field in the user behavior records, and the values for time entities range from [0, 1, 2, \(\ldots\), 23], representing the 24-h clock.
* User entities: extracted from the user number field in the user behavior records, with the user number serving as the identifier for the user entity.  
Action entities: Extracted from the action field in the user behavior records, with specific actions serving as the identifier for the action entity. There are seven action entities: login (host), logout (host), connect (mobile device USB), disconnect (mobile device USB), browse (web), send (email), and access (file).
* Action magnitude: Derived by counting the number of repetitions for each action and discretizing the counts into different levels of action magnitude. The action magnitude entity reflects the current level of repetition for that action entity.  
Given a fixed length \(l\) of the multi-source user behavior sequence, the user behavior event collection was divided into multiple behavior event sequences, forming a multi-source user behavior sequence dataset. The first 70% of the multi-source behavior event sequences in the multi-source user behavior sequence dataset were used as the training dataset to train the encoding-decoding model and learn the feature representation of the event sequences, containing only normal samples. The remaining 30% of the multi-source behavior event sequences in the dataset were used as the detection dataset for detecting abnormal behavior event sequences.