# Insider Threat Detection Using Machine Learning Approach
## 3 Materials and Methods
### Feature Extraction
#### 3.3.1 Deep Feature Synthesis  
Machine learning algorithms rely heavily on their input features. A suitable choice of features is an essential process in any machine learning algorithm; however, it must involve human intuition in many cases. At the same time, recent developments in deep learning algorithms can omit the choice of a suitable feature because the feature is learned through the network architecture. However, feature selection remains a human-intuition-driven and time-consuming phase in other machine learning algorithms. Previous researchers have not considered automated feature engineering in their work before. This study used an automated feature engineering tool to improve the effectiveness of insider threat detection approaches. The DFS tool takes into account many of the manually selected features from prior research, as well as many more additional features. DFS was proposed by [PERSON] and [PERSON] [53]. It automatically creates features for relational datasets based on connections in the data to a base field, generating predictive models from raw data. Mathematical functions were then sequentially applied along that path to constructing the final features, as illustrated in Figure 2. It implements a generalisable machine-learning pipeline tuned using a novel Gaussian Copula process-based approach [53]. \begin{table}
\begin{tabular}{l l} \hline \hline
**Feature Name** & **Feature Description** \\ \hline Weekday\_Logon\_After & Employees log on outside of working hours on weekdays \\ Weekday\_Logon\_Normal & Employees log on during working hours on weekdays \\ Weekend\_Logon & Employees log on during weekends \\ url\_Count & The number of URLs visited by an employee in a day \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Extra features added to enhance the feature extraction process. The algorithm forms some specialised features from the given data by intuiting what could predict the outcome. The algorithm catches features that are generally aided by human interpretation, although it is automatic. It performs feature engineering for various tables and transactional data found in databases and log files [53]. This approach helps data scientists save time by deriving new features that are specific to the dataset and applying the same mathematical equations. The features created by DFS are easier to understand since they are based on primitive combinations that can be easily described in natural language; this helps the data scientist understand the features generated by DFS. The inputs of this algorithm are entity sets with several data types, such as numeric, categorical, and timestamps, a set of relationships, and several mathematical functions. The mathematical functions are applied at two different levels: the entity level and the relational level. DFS generates three sorts of features: Entity features (efeat), Direct Features (defeat), and Relational features (refeat), as illustrated in Figure 3[53]. Entity features (efeat) are calculated by considering only one entity, such as translating an existing feature into another value type, converting a categorical string data type to a pre-decided unique numeric value, or rounding a numerical value. An example of such a computation is a cumulative distribution function (cdf)-based feature. To generate this feature, the DFS forms a density function over \(x_{:,j}\), and then evaluates the cumulative density value for \(x_{(i,j)}\) (or percentile), thus forming a new feature [53]. When there is a forward relationship between one instance of entity \(E_{I}\), instance m, and one instance of entity \(E_{k}\), instance \(i\), \(i\) has an explicit dependency on instance \(m\). In Figure 4, an e-commerce example, the Logon entity has a forward relationship with the Psychometric; each logon is related to only one user in the Psychometric table. Direct features (dfeat) are applied over the forward relationships. In these, features in related entity \(i\in E_{k}\) are directly transferred as features for the \(m\in E_{I}\)[53].