# Insider Threat Detection Based on Deep Clustering of Multi-Source Behavioral Events
## 1 Introduction  
Insiders are current or former employees, contractors, or business partners of an organization who have authorized access to the organization's network, system, or data [1]. In unwanted situations, these insiders lose loyalty to their employers either out of anger or out of greed for personal benefit. This provokes them to behave maliciously and intentionally harm the organization's resources and damage its reputation. In recent years, several incidents of insider threats have made their way to the public media, one of which was the high-profile insider case involving [PERSON], and another was the data leakage cases by [PERSON] and [PERSON]. In the insider threat cybersecurity report released in 2023, 74% of the respondents believed that insider attacks have become more frequent in the past 12 months [2]. Unlike external attacks, attacks from insiders are hard to detect because malicious insiders have legitimate access to information on various facilities and are also well informed about the organization and its critical facilities. Meanwhile, it becomes easy for a malicious insider to carry out malicious actions and hide their hacking trail. Insider threat detection has attracted significant attention over the last decade. Early approaches achieve insider threat detection by analyzing users' behaviors via a single type of audit data, such as system call audit data [3], keyboard and mouse dynamics audit data [4, 5], UNIX command execution audit data [6], and file access audit data [7]. However,these methods are limited in their ability to detect more complex insider attacks owing to their reliance on a single type of user behavior data. Recent research methods have focused on analyzing user behaviors from multiple types of audit data. Insider threat detection based on multi-source audit logs can combine behavioral analysis ability from multiple data sources, which enhances the capability to detect various types of attacks. To analyze user behaviors across different data sources, it is common to extract the statistical features of user behavior from several data sources and input these features into supervised or unsupervised machine learning algorithms for insider threat detection [8; 9; 10]. Compared to supervised machine learning, unsupervised machine learning is more practical due to the lack of labeled malicious samples in the real network environment. However, user behavior feature extraction using the most appropriate unsupervised machine learning model for insider threat detection remains a challenge, especially when using the clustering unsupervised machine learning method. On the one hand, traditional artificial feature engineering requires manual work for feature extraction, which makes it difficult to capture user behavior features efficiently because of the complex and nonlinear nature of user behaviors in cyberspace. On the other hand, feature extraction is independent of clustering-based unsupervised machine learning. It results in suboptimal user behavior feature representations for the clustering algorithm, which leads to the reduced accuracy of insider threat detection. Given the powerful learning ability of deep neural networks, we utilize deep neural networks to automatically learn feature representations of multi-source user behavior sequences, which are then input into a deep clustering network for insider threat detection. In order to achieve this goal, there are two main challenges: (1) every user behavior event contains multiple entities, and it is necessary to learn the features of such behavior event sequences, which can represent the temporal relationships between events and between entities of events; (2) it is necessary to simultaneously perform the feature mapping of behavior event sequences and the assignment of features to cluster centers based on the deep clustering network. To overcome the abovementioned two challenges, this paper proposes an insider threat detection method based on the deep clustering of multi-source behavioral events.