# An Artificial Neural Network Autoencoder for Insider Cyber Security Threat Detection
## 4 Performance Results of Threat Intrusion Monitoring
### Performance Results  
The model is deployed and tested on two operating scenarios. The first operating scenario is tested during working hours, i.e., 9:00 a.m. to 5:00 p.m. In this operating scenario, three users have different usage of network and system resources, generating data traffic on their devices in a way that simulates normal user activity. Out of the three users, one user is nonlegitimate. The nonlegitimate user deals with tasks that require significant internet usage. The consequence of this is presented as an example in Figure 11, in which it can be seen that the network usage is above the threshold (set to 400,000 kbit/s), which leads to the deviation in resource consumption and immediate alert of a security threat. The threshold value is not constant, and it is updated frequently according to the timings, user behavior, etc. Figure 10: Monitoring of feature parameters in the graph-based real-time monitoring system. The second operating scenario is performed for an already logged-in device. A Trojan security threat is set to automate the execution of scripts for accessing files using mouse and keyboard activities. The motive behind this security threat is to access the files that need to be opened by mouse clicks on the attacked files. Figure 12 shows the excessive mouse activity (related to the double-click above the threshold (set to 4) performed repeatedly to open the files), and the files were exfiltrated through the network. This also leads to the deviation in resource consumption and an immediate alert of security threats. These actions were taken during nonworking hours, and hence, the alerts were sent under the nonworking hours category (Figure 12). The results obtained for the analyzed metrics are shown in Figure 13. The dataset contains an imbalanced number of samples, equal to 99.9% of normal samples. Therefore, the model is successfully trained and validated for normal instances. According to the obtained results, the proposed model has high accuracy (\(\alpha\)) equal to 94.3%, high recall (TPR) equal to 90%, high precision (\(P\)) equal to 89.1%, and high TNR equal to 88%. A low FPR equal to 11.1% is a consequence of the low number of wrong decisions regarding a possible threat occurrence (Figure 13). The FPR represents how many legit instances the model predicts as an anomaly. In the case of the proposed model, the number is small, because the model is trained well, and it is able to reconstruct the normal data. However, as the number of anomalous samples increased in the dataset, the probability of an increasing FPR is high, and the recall (TPR) becomes lower, because the model works best for the single-characteristic type of data. Autoencoders learn all the characteristics of the available data (might contain both positive and negative instances) but work well only if there are more single-characteristic data. The obtained results are also compared with other well-known threat detection approaches, which are performed by employing an LSTM autoencoder, multiclass SVM, and MLP classifier. The results of the comparison are presented in Table 3, and they indicate that the proposed model based on the ANN autoencoder outperforms other models in terms of accuracy, while also preserving high recall and precision scores. This is a consequence of the autoencoder's increase in performance efficiency when compared with the other approaches, which is contributed to by an appropriate security feature selection, usage of unique data, etc. Figure 11: Security threat detection in the first scenario based on network traffic. It is worth further emphasizing that although there are large datasets that can be used to conduct cyber security intrusion detection research, the motive of this paper is to show how a large number of different locally collected features can point to a real cyber security  
Figure 12: Security threat detection in the second scenario based on mouse activity. Figure 13: Performance metrics for accuracy, recall (TPR), FPR, and TNR.