# Insider Threat Detection Based on Deep Clustering of Multi-Source Behavioral Events
## 2 Related Work
\begin{table}
\begin{tabular}{p{42.7 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Study** & **Type of Data** & **Source of Data** & **Features** & **ML/Statistical Model** & **Remarks** \\ \hline
[6,12,13] & Host-based audit data & UNIX commands execution audit data & \
\begin{tabular}{c} Occurrence frequency of each subsequence of the \\ Link commands \\ \end{tabular} &
\begin{tabular}{c} One-class SVM, \\ Naive Bayes \\ \end{tabular} & \\ \hline
[14, 15, 16, 17] & Host-based audit data & \begin{tabular}{c} Keyboard or mouse \\ dynamics audit data \\ \end{tabular} & \begin{tabular}{c} Frequency of clicks or \\ movements, different key-up \\ and key-down times \\ \end{tabular} & \
\begin{tabular}{c} One-class SVM, KNN, \\ neural networks \\ \end{tabular} &
\begin{tabular}{c} Host-based and network-based \\ insider threat detection \\ methods are limited in their \\ ability to detect more complex \\ \end{tabular} \\ \hline
[18, 19] & Host-based audit data & File access audit data & File path distance, file access frequency & TreeBagger &
\begin{tabular}{c} inside attack’s since they \\ typically analyze only a single \\ type of user behavior data to \\ model the user profile. \\ \end{tabular} \\ \hline
[20, 21] & Network-based audit data & Email audit data & Email graph structure & \
\begin{tabular}{c} Naive Bayes, Decision \\ Trees, Random Forests \\ and Bagging \\ \end{tabular} &
\begin{tabular}{c} type of user behavior data to \\ model the user profile. \\ \end{tabular} \\ \hline
[22] & Network-based audit data & Web browsing audit data & \
\begin{tabular}{c} Page access frequency, page \\ view time \\ \end{tabular} &
\begin{tabular}{c} Cosine Similarity \\ \end{tabular} & \\ \hline
[8, 9, 10, 23] & Multi-source audit data & Email logs, proxy server logs & File access times, web browsing times & \
\begin{tabular}{c} KDE, GMM, kNN, \\ and HMM \\ \end{tabular} &
\begin{tabular}{c} These methods rely on artificial \\ feature engineering, where \\ domain experts manually \\ extract statistical features from \\ multi-source user behavior \\ data based on their \\ prior knowledge. \\ \end{tabular} \\ \hline
[24] & Multi-source audit data & Email logs, proxy server logs & \begin{tabular}{c} Feature learning by \\ using graph embedding \\ learning techniques \\ \end{tabular} & \
\begin{tabular}{c} Graph embedding \\ learning, Kmeans \\ \end{tabular} &
\begin{tabular}{c} The feature extraction is \\ independent of the clustering \\ suboptimal user behavior \\ feature representations for the \\ clustering algorithm which \\ leads to reduced accuracy in \\ insider threat detection. \\ \end{tabular} \\ \hline
[25] & Multi-source audit data & Network-level event, process-level event & \
\begin{tabular}{c} Feature learning by \\ using embedding \\ learning techniques \\ \end{tabular} & Embedding learning &
\begin{tabular}{c} This method analyzes static \\ behavior and ignores the \\ temporal relationships among \\ user behaviors in the user \\ behavior sequences. \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Overview of existing methods for insider threat detection. Some researchers have proposed using deep neural networks for feature representation due to their powerful feature learning capability [24; 25; 26; 27]. In addition, these deep neural networks can simultaneously obtain both the feature representation and clustering results, enabling the optimization of feature representations in the clustering space. Compared to traditional step-by-step clustering algorithms, deep clustering provides an end-to-end solution for clustering tasks. Deep clustering algorithms have achieved good performance in the field of image analysis. However, existing deep clustering algorithms cannot be directly applied to user behavior analysis due to the differences between images and multi-source audit logs.