# Insider Threat Detection Using Machine Learning Approach
## 5 Conclusions  
This study utilised machine learning techniques to detect malicious activity. A system pipeline that is able to accurately detect malicious users as well as being resilient to different organisational structures and updates to the log file structure was proposed. We used automated deep feature engineering to improve the detection of malicious insider users. DFS results in a vast number of meaningful features that hasten the feature engineering phase and help non-expert domains achieve results with good descriptive features. We examined the influence of the SMOTE oversampling technique to reduce the impact of data with an uneven class distribution because CERT is an extremely unbalanced dataset. The results showed that SMOTE helps increase recall over precision. To increase system performance, we used PCA to minimise the number of features and reduce redundancy. To classify behaviours as malicious or normal, we tested several ML algorithms, either through anomaly detection methods or classification ones. The results of the experiments indicate that the SVM classification method outperforms the other models. The algorithm was trained and tested using a dataset of 1000 created feature vectors based on user action sequences, including both malicious and regular activity. We conclude that with the methodology used, the malicious users of the information system were effectively detected. The forecasting of the results was successful, with a percentage that reached 100%. However, the study is not without some drawbacks. Although the system is designed to be resilient in the face of log file structural changes, it still requires a retraining phase; to build a different set of features that correspond to the new structure. The time required should be taken into consideration by the security officer. In addition, enrolling new users and learning their specific behavioural patterns necessitates collecting some usage pattern data first, i.e., the system is unable to detect malicious users who happen to be newcomers to the organisation. Finally, the system will require periodic retraining in order to keep the user baselines up to date. Future work may consider different scenarios from the CERT insider threat dataset. In addition, organisations should be targeted, and a data-sharing agreement should be sought to attain access to real-world insider threat data and assess the methodologies described in this study. Future work should also consider using DFS in other problem domains. Conceptualisation, N.A. ; methodology, N.A. and B.B.S. ; software, B.B.S. ; validation, N.A. and B.B.S. ; formal analysis, N.A. and B.B.S. ; resources, B.B.S. ; data curation, B.B.S. ; writing--original draft preparation, N.A. and B.B.S. ; writing--review and editing, N.A. and B.B.S. ; visualisation, B.B.S. ; supervision, N.A. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Not applicable. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Model** & **Accuracy** & **F1 – Score** & **Recall** & **Precision** \\ \hline CNN [29] & 100\% & n/a & n/a & n/a \\ Bio-Inspired models [57] & n/a & 100\% & n/a & 70\% \\ Autoencoder [58] & 92\% & 96\% & 96\% & 94\% \\ DBN-OCSVM [39] & 87.79\% & n/a & n/a & n/a \\ DNN [16] & 96\% & 95\% & n/a & n/a \\ Generative adversarial network [17] & n/a & n/a & 76\% & n/a \\ Light Gradient Boosting [40] & 99.47\% & 92.26\% & n/a & 0.83\% \\ CNN [29] & 99\% & 99.3\% & 99.32\% & 99.29\% \\ Random forest [59] & 98\% & n/a & n/a & 99.32\% \\ Our method & 100\% & 100\% & 100\% & 100\% \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Comparison with different classification methods.