# An Artificial Neural Network Autoencoder for Insider Cyber Security Threat Detection
## 4 Performance Results of Threat Intrusion Monitoring  
### Visualization of Model Training Results  
A graph-based real-time monitoring system is developed that utilizes graph databases and graph processing frameworks for representing and analyzing the collected data in a graphical format. The collected data are presented to the security and incident response team through a developed graph processing framework (Figure 1). This approach leverages the power of graph structures to model relationships between data entities, enabling efficient and flexible monitoring capabilities. The graph-based real-time monitoring system involves graph data representation, real-time data ingestion, autoencoder architecture, training, and real-time anomaly detection.  
The system represents the monitored data in the form of a graph, where nodes represent entities, and edges represent relationships between them. Each node can contain attributes or properties that store relevant data. The system continuously ingests data from various sources, such as sensors, logs, events, or databases (Figure 3). As new data arrive, they are transformed into graph elements and added to the graph database.  
The proposed anomaly detection system reconstructs the input data by compressing data into a lower-dimensional representation in the encoder and then reconstructs it in the decoder (Figure 6). The encoder-decoder architecture is trained using unsupervised learning techniques, as described in Section 3.5, on a large amount of data obtained from the analyzed entities (Table 2) of the monitored systems (Figure 3). This process allows the autoencoder to learn the underlying patterns and relationships within the data. Once the autoencoder is trained, it reconstructs new data samples in real time.  
Anomalies from normal patterns can be detected by comparing the reconstructed data with the original input. Significant differences in data patterns indicate the presence of anomalies or anomaly behavior. When an anomaly is detected, the system generates alerts or notifications indicating anomaly conditions in the monitored system. The alerts can be based on predefined thresholds set via adaptive anomaly detection techniques. The autoencoder is tuned periodically to adapt to changing data patterns or to incorporate the new normal behavior of users as a benchmark for threat detection. This ensures that the monitoring system remains effective and responsive over time. A graph-based real-time monitoring system was developed using basic Python libraries and deployed in the cloud (Figure 1). Data are transferred continuously to have updated real-time data. The time units are adjusted according to the buffer size available for display.  
Examples of the monitoring of some feature parameters by the developed system are illustrated in Figure 10. The results have been presented for four different system features, which include the average system memory (presented as system_average_memory in Table 2) and CPU usage (presented as system_average_CPU in Table 2), the counter of key strokes (presented as keystroke_counter in Table 2), and the erased key pressure counter (presented as erase_keys_counter in Table 2) during the 26 days of analyses for a one hour period (20:30-21:30). By combining the graph-based representation of data with an autoencoder, the proposed anomaly detection monitoring concept provides a powerful and flexible solution for real-time monitoring and anomaly detection in complex systems.