# Insider Threat Detection Based on Deep Clustering of Multi-Source Behavioral Events
## 3 Proposed Method
### Deep Clustering Network
#### 3.2.2 Deep Clustering of User Multi-Source Behavior Sequences  
Given the initial values \(z_{\ell}\) of the user multi-source behavior sequence feature vectors and \(k\) initial cluster centers \(\left\{u_{j}\right\}_{j=1}^{k}\), we perform deep clustering of user multi-source behavior sequences. Firstly, we define the objective function for deep clustering, and then utilize the stochastic gradient descent (SGD) algorithm to iteratively refine the cluster centers and adjust the user behavior sequence feature representations. This process jointly optimizes the learning of user behavior sequence feature representations and the clustering task. Compared to traditional methods, it can learn user behavior sequence feature representations that are suitable for clustering without requiring additional supervision. It can simultaneously learn the optimal user behavior sequence feature representations and clustering results. The structure of deep clustering is illustrated in Figure 3.  
First, we define the objective function for deep clustering based on the clustering objectives of intra-cluster compactness and inter-cluster separation. The objective function for deep clustering is defined as follows:  
\[O=\sum_{q=1}^{n}\sum_{j=1}^{k}p_{ji}\|z_{l}^{q}-u_{j}\|^{2}-\sum_{q=1}^{n}\sum _{j=1}^{k}\sum_{\bar{r}=1}^{k}\left|\left|u_{j}-u_{\bar{r}}\right|\right|^{2} \tag{3}\]  
In the given context, \(n\) represents the number of user multi-source behavior sequences, \(k\) represents the number of cluster centers, \(z_{l}^{q}\) represents the feature vector of the user multi-source behavior sequence \(s_{q}\in S\), and \(\left\{u_{j}\right\}_{j=1}^{k}\) represents the cluster centers. \(p_{ji}\) represents the probability that the \(q\)-th multi-source behavior sequence belongs to cluster \(j\). The objective function for deep clustering consists of two terms. The first term calculates the distance between any multi-source behavior sequence and the cluster centers. Minimizing the first term helps to maintain intra-cluster compactness, ensuring that the sequences within each cluster are similar. The second term calculates the distance between cluster  
Figure 3: Deep clustering network for multi-source user behavior sequences. (The black symbols in the clustering represent different behavior patterns, and the red circles indicate the abnormal behaviors.) centers. Maximizing the second term helps to maintain inter-cluster separation, ensuring that different clusters are distinct. To evaluate the similarity between the feature vector \(z_{i}^{q}\) of a user multi-source behavior sequence and the cluster center \(u_{j}\), we can use Student's t-distribution as a kernel. The allocation probability \(p_{jq}\) of a multi-source behavior sequence to a cluster center is defined as:  
\[p_{jq}=\frac{\Big{(}1+||z_{l}^{q}-u_{j}||^{2}/\alpha\Big{)}^{-\frac{\alpha+1}{ 2}}}{\sum_{j^{\prime}}\Big{(}1+||z_{l}^{q}-u_{j^{\prime}}||^{2}/\alpha\Big{)}^ {-\frac{\alpha+1}{2}}} \tag{4}\]  
The parameter \(\alpha\) is set to a value of 1 in the experiments. According to the clustering objective function \(O\), we can update the cluster centers \(\left\{u_{j}\right\}_{j=1}^{k}\) and the feature vectors \(z_{l}^{q}\) of the multi-source behavior sequences using the SGD algorithm. On one hand, the gradient update for the feature vectors \(z_{l}^{q}\) of the multi-source behavior sequences in the objective function \(O\) is given by:  
\[\frac{\partial O}{\partial z_{l}^{q}}=\frac{\alpha+1}{\alpha}{\sum_{j}}\Bigg{(} 1+\frac{||z_{l}^{q}-u_{j}||^{2}}{\alpha}\Bigg{)}^{-1}\times||z_{l}^{q}-u_{j}|| ^{3}+2p_{jq}\Big{(}z_{l}^{q}-u_{j}\Big{)} \tag{5}\]  
In the given context, the allocation probability \(p_{jq}\) can be obtained by using Formula (4).