# An Artificial Neural Network Autoencoder for Insider Cyber Security Threat Detection
## 3 Proposed Architecture for User and Entity Behavior Analysis
### Model Training  
After the preprocessing phase is done, the next phase of the proposed solution is to build and train the model (Figure 2). To train the model, the unsupervised learning technique is applied in this paper. This technique does not need any labeled data, and instead, only the raw data are used as the input data. The technique used is based on trying to learn the patterns between the variables. As a variable, the data representing normal user behavior have been set as a benchmark variable, against which the security threat is tested. This means that the autoencoder, which consists of an encoder, decoder, and ANN, is used in this phase of the proposed model execution. The proposed architecture for insider threat detection is presented in Figure 6. Neural networks that are fully connected feed-forward networks are used in the analyses. The encoder and decoder consist of four fully connected dense layers, which are the input, hidden (encoding and latent representation), and output layers (Figure 6). The input layer contains different feature values (Table 1) collected from different feature domains in real time. The ANN layers of the proposed model are presented in Figure 6 and include the following:  
(Input layer (82, )) \(\rightarrow\) (Encoding layers (64, ) \(\rightarrow\) (32, ) \(\rightarrow\) (16, )) \(\rightarrow\) (Latent representation layer (8, )) \(\rightarrow\) (Decoding layers (16, ) \(\rightarrow\) (32, ) \(\rightarrow\) (64, )) \(\rightarrow\) (Output Layer (82, )). The activation function used in each layer is the rectified linear activation unit (ReLU) function represented as  
\[\text{f}(x)= \begin{cases}x&x>0\\ 0&x\leq 0\end{cases}  \tag{2}\]  
where \(x\) is the input to the ANN neuron. In the decoder, the last layer uses an activation function called the sigmoid (logistic) function which is represented as  
\[\mathrm{z}(x)=\frac{1}{1+e^{-x}}=\frac{e^{x}}{e^{x}+1}=1-\mathrm{z}(-x) \tag{3}\]  
The presented autoencoder performs a dimensionality reduction technique. This is because the autoencoder tries to learn in high-dimensional space. When the input data of any dimension are given to the encoder, it learns to map to the lower-dimensional space, and the decoder learns to map from the lower-dimensional space to the original input data. When the neurons pass the information from the encoder to the decoder, the information is preserved in a space called latent representation (Figure 6). A model can be tuned for better performance using hyperparameters, where every parameter is designed to serve as a threshold for specific conditions, data types, etc. The parameters used for tuning the proposed model are:  
* Loss function parameter: among different loss functions, the MSE loss function (defined in the next section) fits best for the problem tackled by the proposed algorithm, since the proposed approach deals with continuous values. * Activation function parameter: for all the layers except the last layer, the ReLu activation function defined in Equation (2) is used. For the last ANN layer, sigmoid function (3) is used, as the output values need to be in the range of [0,1]. * Optimizer parameter: the Adaptive Moment Estimation (ADAM) optimizer function is used to scale the magnitude of weight updates in order to minimize the network loss function. * The reason for choosing this specific optimizer is the fact that it is developed based on the drawbacks of other optimizers such as Adadelta (stochastic gradient-based optimization algorithm), root mean square propagation (RMSprop), etc. Figure 6: Proposed ANN architecture for the insider threat detection system. * Batch size parameter: this parameter also provides a major contribution to the model's performance and needs to be lower than the lowest analyzed dataset size. For this approach, 120 is taken as the batch size according to the training set, CPU/GPU capability, etc. * Shuffle parameter: is set to false, as analysis is performed with continuous time series data.