# An Artificial Neural Network Autoencoder for Insider Cyber Security Threat Detection
## 1 Introduction
### Contribution of the Paper  
According to three previously presented major types of cyber security attacks, it can be generally stated that the complexity of insider cyberattacks represents a complex problem with no unique or off-the-shelf solution that can ensure full protection of the organization's internal network entities and systems. Although the SIEM approach significantly improves the detection of some types of cyberattacks, the main disadvantage of the SIEM approach is in the fact that it generally follows a set of predefined correlation rules, and finding correlation rules for every possible attack scenario is impossible [9]. In addition, present-day SIEM systems are not capable of detecting newly developed attack patterns, and therefore, they often end up generating large amounts of false alarms. The cyber security level of every organization is based on a variety of criteria such as investment in information security, the capability of disaster recovery, the amount of monitored security-related information, the implementation of security policies at different levels, etc. The motivation of the insider attackers is to gain access to the organization's network and to exfiltrate data by masking the zero-day attack. The organization must safeguard the data and ensure that the service is always available. Since the organization's data are involved in any process related to the improvement of an organization's cyber security, compromising an organization's cyber security can have a negative impact on the organization's financial stability and service availability. While observing the potential that UEBA has in terms of insider threat detection and the potential that SIEM data gathering offers, the main contribution of this paper is in developing and testing the solution based on integrating UEBA's capabilities with the SIEM approach. Thus, the key contributions of the paper are related to the following:  
* Developing a more effective and sophisticated insider cyber security threat detection based on a combination of the SIEM and UEBA solutions;
* The improvement of the detection of insider threats with unknown signatures that are mainly focused on situations that involve compromising user accounts. Therefore, in this paper, a security framework that comprises architecture based on user and entity behavior analysis (UEBA) in combination with SIEM is proposed. The proposed security framework is based on a developed unsupervised deep learning algorithm that is used for the detection of insider cyber security threats by analyzing the behavior of users, systems, and network entities of the organization. The decision to adopt an unsupervised deep learning approach stems from the understanding that data Instances cannot be predetermined as legitimate or anomalous based on predefined attributes, as in the case of supervised learning. Unlike supervised learning, which necessitates labeled data to classify instances as legitimate or anomalous, unsupervised learning operates without such predetermined labels, making it a suitable approach for performing security threat detection. The proposed approach requires data for training, which are collected from different sources that include the organization domain controller (DC), mouse, keyboard, file access, hypertext transfer protocol (HTTP) traffic, resource consumption metrics, and device metrics. After the training phase, the proposed model is capable of analyzing the activity of the user and the entities concurrently in real time and flagging the user behavior as legitimate or nonlegitimate. The rest of the paper is organized as follows: Section 2 discusses the previous research related to the detection of insider security threats and explains the motivation for the performed research. Section 3 presents the system-level architecture of the proposed solution and explains the work carried out regarding dataset preparation for modeling the proposed approach to insider threat detection.