# Insider Threat Detection Based on Deep Clustering of Multi-Source Behavioral Events
## 2 Related Work  
Insider threat detection has attracted significant attention. Most existing approaches achieve insider threat detection by analyzing users' behaviors via audit data, such as host-based data that record activities of users on their own computers, network-based data that are recorded by network equipment, and context data that record users' profile information. Host-based insider threat detection focuses on developing behavioral anomaly detection techniques with the objective of finding out anomalousness or abnormal changes at the host level activity. For example, user behaviors can be analyzed in terms of the historical occurrence frequency of each subsequence of Unix commands, and then the anomaly can be detected using one-class SVM [6; 12] and Naive Bayes classification [13]. In addition, keyboard and mouse-based detection methods create a user profile by extracting a number of features based on the frequency of clicks or movements [14; 15], and different key-up and key-down times [4; 16], with classifiers used to detect any inconsistent dynamic that indicates the existence of a malicious insider. File-based malicious insider detection methods [7; 17] extract multi-dimensional feature vectors from file access paths over a fixed period and input these features into a two-class or one-class classifier. Network-based insider threat detection methods model the user profile from the network activity for detecting anomalous application-level violations such as Email communication and web browsing usage. Email communication can be structured into a graph in which the nodes represent senders and recipients. Graph structure features are extracted and input into machine learning methods to detect insider threats [18; 19]. Some works build the user profile based on a user's web browsing behavior from the perspective of page access frequency and page view time, and abnormal behaviors can be detected by comparing the cosine similarity between current and historical browsing behaviors [20]. Host-based and network-based insider threat detection methods are limited in their ability to detect more complex insider attacks since they analyze only a single type of user behavior data. In recent studies, researchers prefer to combine host-based and network-based data from multi-source audit logs to provide stronger user behavior analysis capabilities and improve insider threat detection. PRODIGAL (PROactive Detection of Insider threats with Graph Analysis and Learning) [8; 9] extracts over 100-dimensional user behavior features from multiple audit logs, including email and proxy server logs. It then employs various machine learning algorithms such as KDE, GMM, kNN, and HMM to build multiple detectors, each using a different subset of features. The Beehive system [10] extracts 15-dimensional user behavioral features for each host daily by analyzing server proxy logs, DHCP, VPN, and LDAP logs in an enterprise network. Principal Component Analysis (PCA) is then used to reduce the dimensionality of the feature vectors. The reduced features are input into the k-means clustering algorithm to identify abnormal user behaviors. [PERSON] et al. [21] proposes ensemble-based clustering algorithms for detecting anomalies in multi-source user behavior. This method extracts over 100 dimensions of features from various user behavior logs, and inputs them into ensemble learning algorithms, such as Gaussian Mixture Models, for insider threat detection. However, the above-mentioned methods rely on artificial feature engineering, where domain experts manually extract statistical features from multi-source user behavior data based on their prior knowledge. To automatically learn user behavior features, some researchers have utilized embedding learning techniques to achieve low-dimensional vector representations of user behavior. [PERSON] et al. [22] introduce the log2 vec model, which constructs a graph based on multi-source user behavior.