# An Artificial Neural Network Autoencoder for Insider Cyber Security Threat Detection
## 3 Proposed Architecture for User and Entity Behavior Analysis
### Feature Description
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Feature Domain** & **Feature** & **Description** \\ \hline \multirow{6}{*}{Keyboard} & keystroke\_counter & Total number of key strokes generated by the user. \\  & erase\_keys\_counter & Number of times the user pressed “backspace” and “delete”. \\ \cline{2-3}  & erase\_keys\_percentage & Percentage of erased keys over total keys. \\ \cline{2-3}  & press\_press\_average\_interval & The average time between two successive key strokes in (ms). \\ \cline{2-3}  & press\_press\_stddev\_interval & Standard deviation in the time between two successive key strokes. \\ \cline{2-3}  & press\_release\_average\_interval & The average time between press and release of all the key strokes in (ms). \\ \cline{2-3}  & press\_release\_stddev\_interval & Standard deviation in the time between the press and release of all the key strokes in (ms). \\ \cline{2-3}  & keystrokes\_key\_Ki & Set of features that depict the number of key y-strokes per key. _Ki_ is the key in the set of keys and is meant to be recorded. \\ \cline{2-3}  & press\_release\_average\_Ki & Set of features that depict the average time between press and release of all the key strokes in keys set in (ms). \\ \hline \multirow{6}{*}{Application} & active\_apps\_average & The average number of active applications. \\ \cline{2-3}  & current\_app & Executable name of the application in the foreground. \\ \cline{2-3}  & penultimate\_app & Penultimate application’s executable name in foreground. \\ \cline{2-3}  & changes\_between\_apps & The number of changes between different foreground applications. \\ \cline{2-3}  & current\_app\_foreground\_time & Amount of time the current application has been in the foreground. \\ \cline{2-3}  & current\_app\_average\_processes & The average number of processes of the current application in the foreground. \\ \cline{2-3}  & current\_app\_stddev\_processes & The standard deviation in the number of processes of the current application in the foreground. \\ \hline \multirow{6}{*}{Resource Consumption (Device)} & current\_app\_average\_cpu & The average amount of CPU used by the current application (\%). \\ \cline{2-3}  & current\_app\_stddev\_cpu & The standard deviation in the CPU used by the current application (\%). \\ \cline{2-3}  & system\_average\_cpu & The average amount of the system’s total CPU capacity used (\%). \\ \cline{2-3}  & system\_stddev\_cpu & The standard deviation in the system’s total CPU capacity used (\%). \\ \cline{2-3}  & current\_app\_average\_mem & The average amount of memory used by the current application (\%). \\ \cline{2-3}  & current\_app\_stddev\_mem & The standard deviation in the memory used by the current application (\%). \\ \cline{2-3}  & system\_average\_mem & The average amount of total system memory capacity used (\%). \\ \cline{2-3}  & system\_stddev\_mem & The standard deviation in total system memory capacity used (\%). \\ \cline{2-3}  & received\_bytes & The number of bytes received through the network interfaces of the device. \\ \cline{2-3}  & sent\_bytes & The number of bytes sent using the network interfaces of the device. \\ \hline \multirow{6}{*}{HTTP and File} & URL & URLs visited by the user. These will be classified as 0—normal and 1—malicious. \\ \cline{2-3}  & File\_modifications & Any read and write operations performed by escalating privileges are classified as 1 and 0 if not. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: _Cont._attacker's threat pattern, thus increasing the possibility of detecting it. Hence, the risk of an attack can be reduced by performing detection in flexible time periods (windows). The session-based time window approach was proposed in [19], where all the events in a session were recorded and represented in a single feature vector for a given session. A user can log off and log on many times in a day, which creates many sessions in a day.