# An Artificial Neural Network Autoencoder for Insider Cyber Security Threat Detection
## 3 Proposed Architecture for User and Entity Behavior Analysis  
### Proposed System Architecture  
The architecture of the test system used for insider threat detection in this work is depicted in Figure 1. The architecture is based on the integration of the UEBA approach into an SIEM system. To make the analyses realistic, the environment that replicates a real  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Reference** & \begin{tabular}{c} **Behavior-** \\ **Based** \\ **(U/EBA)** \\ **Approach** \\ \end{tabular} & **Algorithm** & **Dataset** & \
\begin{tabular}{c} **Features** \\ **Considered** \\ \end{tabular} &
\begin{tabular}{c} **Device and** \\ **Entities** \\ **Behavioral** \\ **Analysis** \\ \end{tabular} \\ \hline
[23] & Yes & \begin{tabular}{c} Multiclass \\ SVM \\ \end{tabular} & \
\begin{tabular}{c} Custom- \\ made \\ dataset \\ \end{tabular} &
\begin{tabular}{c} Keystrokes and \\ tap dynamics \\ \end{tabular} & No \\ \hline
[22] & Yes & \begin{tabular}{c} Supervised \\ and unsupervised \\ used (one-class \\ SVM) \\ \end{tabular} & \
\begin{tabular}{c} 1998 Lincoln \\ Laboratory \\ intrusion \\ detection \\ dataset \\ \end{tabular} &
\begin{tabular}{c} Time, user ID, \\ machine IP, \\ argument, path \\ \end{tabular} & No \\ \hline
[19] & Yes & \
\begin{tabular}{c} LSTM \\ autoencoder \\ \end{tabular} & CERT dataset &
\begin{tabular}{c} Device, email, \\ HTTP, file, \\ log-on activity \\ \end{tabular} & Yes \\ \hline
[24] & Yes & \
\begin{tabular}{c} K-nearest \\ neighbors \\ and PCA \\ \end{tabular} & RUU dataset &
\begin{tabular}{c} Window touches, \\ new processes, \\ running \\ processes, and \\ applications on \\ the system \\ \end{tabular} & Yes \\ \hline
[21] & No & \begin{tabular}{c} Local outlier \\ factor \\ \end{tabular} & \begin{tabular}{c} Multiple \\ datasets \\ \end{tabular} & \begin{tabular}{c} Keyboard data, \\ emails, log access \\ \end{tabular} & No \\ \hline Proposed approach & Yes & \begin{tabular}{c} ANN-based \\ autoencoder \\ \end{tabular} & \
\begin{tabular}{c} Custom- \\ made \\ dataset \\ \end{tabular} &
\begin{tabular}{c} Keystroke, \\ consumption, \\ device usage \\ (central \\ processing unit \\ (CPU)), random \\ access memory \\ (RAM), network) \\ \end{tabular} & Yes \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison of related works.  
organization is simulated. The proposed architecture uses an autoencoder model to detect anomalies and reports them accordingly (Figure 1). The model is deployed in the cloud, and the data are transmitted using application program interface (API) calls. The developed model checks for any anomaly behavior and alerts the security team. An interface in the proposed framework is created for remote supervision and access to the monitoring results for authorized users.  
The main objectives of the proposed UEBA system architecture are to:  
* Perform a user and entity behavior analysis with the capability of detecting insider threats.
* Provide a solution for detecting and storing nonregular intervals of intrusion data in time.
* Provide a solution for collecting different system device metric information (such as the activity of the keyboard, mouse, processor, etc.), which will be used for detecting anomaly user behavior.
* Provide a solution that overcomes the general disadvantages of the UBA approach.  
All of the stated objectives have been built into the proposed UBA security threat detection solution.