# Insider Threat Detection Based on Deep Clustering of Multi-Source Behavioral Events
## 4 Experiment
### Results for Insider Threat Detection  
Firstly, the proposed method was used to detect three types of abnormal behaviors in the dataset. We refer to these three types of abnormal behaviors as type 1, type 2, and type 3. Figure 4 shows the ROC curves and AUC values of the proposed method for detecting type 1, type 2, and type 3 abnormal behaviors. From the graph, it can be observed that the ROC curve of the proposed method for type 2 abnormal behavior is closest to the upper-left corner, indicating that the proposed method is most effective in detecting type 2 abnormal behavior. Furthermore, based on the AUC values for detecting all three types of abnormal behaviors, it can be seen that the proposed method achieves AUC values exceed 90% for all three types, indicating good detection results for all three types of abnormal behaviors. Figure 4: The ROC curves and corresponding AUC values for the detection of type 1, type 2, and type 3 abnormal behaviors. Next, the proposed method was compared with existing detection methods, including BAIT, Isolation Forest, Random Forest, and Deep Autoencoder. These methods fuse user statistical features at the behavioral level across multiple detection domains and extract multi-source behavioral features for inputting into supervised or unsupervised machine learning algorithms for anomaly detection. BAIT, Random Forest, and Deep Autoencoder are supervised anomaly detection algorithms, while Isolation Forest is an unsupervised anomaly detection algorithm. The proposed method fuses user behaviors in different detection domains based on the temporal nature of behavioral events and detects anomalies in the user's multi-source behavioral event sequences. The proposed method is an unsupervised anomaly detection method. Since Random Forest and Deep Autoencoder in the comparison methods use \(Recall\) for performance evaluation, this section also adopts \(Recall\) as the evaluation metric for all the compared methods in the experimental comparison. \(Recall\) represents the percentage of correctly predicted abnormal behavior samples in the user behavior samples. \[Recall=\frac{TP}{TP+FN}\]  
In the given context, \(TP\) represents the number of abnormal behavior samples correctly detected as abnormal, while \(FN\) represents the number of abnormal behavior samples incorrectly detected as normal. Table 2 presents the \(Recall\) rates of all comparison methods for detecting type 1, type 2, and type 3 abnormal behaviors. The bolded sections indicate the best detection results for each type of abnormal behavior. From the first three columns of Table 2, it can be observed that the proposed method outperforms other comparison methods in terms of \(Recall\) rates for type 1 and type 2 abnormal behaviors. However, the Deep Autoencoder achieves the highest Recall rate for type 3 abnormal behavior. The last column of Table 2 represents the average \(Recall\) rate of the detection methods for the three types of abnormal behaviors, reflecting the comprehensive detection capability of the methods for abnormal behaviors. According to the last column of Table 2, it can be observed that the \(Recall\) rate of Random Forest is higher than BAIT and Isolation Forest. There may be two reasons for this: (1) The Random Forest method extracts more effective user behavior features based on specific attack scenarios. (2) Random Forest utilizes both normal and abnormal behavior samples to train the classifier, resulting in a more accurate classification model. It is a supervised anomaly detection method, while Isolation Forest is an unsupervised anomaly detection method. In addition, Deep Autoencoder and Random Forest extract the same user behavior features, but Deep Autoencoder achieves a higher \(Recall\) rate than Random Forest. This may be because deep neural networks have better data learning capabilities. Furthermore, Deep Autoencoder and the proposed method achieve similar \(Recall\) rates.