Applying One-Class Algorithms for Data Stream-Based Insider Threat Detection
An insider threat is anyone who has legitimate access to a particular organization’s network and uses that access to harm that organization. Insider threats may act with or without intent, but when they have an intention, they usually also have some specific motivation. This motivation ca...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2023-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/10177772/ |
| _version_ | 1797772609748729856 |
|---|---|
| author | Rafael Bruno Peccatiello Joao Jose Costa Gondim Luis Paulo Faina Garcia |
| author_facet | Rafael Bruno Peccatiello Joao Jose Costa Gondim Luis Paulo Faina Garcia |
| author_sort | Rafael Bruno Peccatiello |
| collection | DOAJ |
| description | An insider threat is anyone who has legitimate access to a particular organization’s network and uses that access to harm that organization. Insider threats may act with or without intent, but when they have an intention, they usually also have some specific motivation. This motivation can vary, including but not limited to personal discontent, financial issues, and coercion. It is hard to face insider threats with traditional security solutions because those solutions are limited to the signature detection paradigm. To overcome this restriction, researchers have proposed using Machine Learning which can address Insider Threat issues more comprehensively. Some of them have used batch learning, and others have used stream learning. Batch approaches are simpler to implement, but the problem is how to apply them in the real world. That is because real insider threat scenarios have complex characteristics to address by batch learning. Although more complex, stream approaches are more comprehensive and feasible to implement. Some studies have also used unsupervised and supervised Machine Learning techniques, but obtaining labeled samples makes it hard to implement fully supervised solutions. This study proposes a framework that combines different data science techniques to address insider threat detection. Among them are using semi-supervised and supervised machine learning, data stream analysis, and periodic retraining procedures. The algorithms used in the implementation were Isolation Forest, Elliptic Envelop, and Local Outlier Factor. This study evaluated the results according to the values obtained by the precision, recall, and F1-Score metrics. The best results were obtained by the ISOF algorithm, with 0.78 for the positive class (malign) recall and 0.80 for the negative class (benign) recall. |
| first_indexed | 2024-03-12T21:54:24Z |
| format | Article |
| id | doaj.art-b25d52c12ddc4bcc8a92a44151d798e1 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-03-12T21:54:24Z |
| publishDate | 2023-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-b25d52c12ddc4bcc8a92a44151d798e12023-07-25T23:00:21ZengIEEEIEEE Access2169-35362023-01-0111705607057310.1109/ACCESS.2023.329382510177772Applying One-Class Algorithms for Data Stream-Based Insider Threat DetectionRafael Bruno Peccatiello0https://orcid.org/0009-0001-9075-7028Joao Jose Costa Gondim1https://orcid.org/0000-0002-5873-7502Luis Paulo Faina Garcia2https://orcid.org/0000-0003-0679-9143Department of Computer Science, University of Brasília, Brasília, BrazilDepartment of Computer Science, University of Brasília, Brasília, BrazilDepartment of Computer Science, University of Brasília, Brasília, BrazilAn insider threat is anyone who has legitimate access to a particular organization’s network and uses that access to harm that organization. Insider threats may act with or without intent, but when they have an intention, they usually also have some specific motivation. This motivation can vary, including but not limited to personal discontent, financial issues, and coercion. It is hard to face insider threats with traditional security solutions because those solutions are limited to the signature detection paradigm. To overcome this restriction, researchers have proposed using Machine Learning which can address Insider Threat issues more comprehensively. Some of them have used batch learning, and others have used stream learning. Batch approaches are simpler to implement, but the problem is how to apply them in the real world. That is because real insider threat scenarios have complex characteristics to address by batch learning. Although more complex, stream approaches are more comprehensive and feasible to implement. Some studies have also used unsupervised and supervised Machine Learning techniques, but obtaining labeled samples makes it hard to implement fully supervised solutions. This study proposes a framework that combines different data science techniques to address insider threat detection. Among them are using semi-supervised and supervised machine learning, data stream analysis, and periodic retraining procedures. The algorithms used in the implementation were Isolation Forest, Elliptic Envelop, and Local Outlier Factor. This study evaluated the results according to the values obtained by the precision, recall, and F1-Score metrics. The best results were obtained by the ISOF algorithm, with 0.78 for the positive class (malign) recall and 0.80 for the negative class (benign) recall.https://ieeexplore.ieee.org/document/10177772/Insider threat detectiondata streammachine learningone-class classification |
| spellingShingle | Rafael Bruno Peccatiello Joao Jose Costa Gondim Luis Paulo Faina Garcia Applying One-Class Algorithms for Data Stream-Based Insider Threat Detection IEEE Access Insider threat detection data stream machine learning one-class classification |
| title | Applying One-Class Algorithms for Data Stream-Based Insider Threat Detection |
| title_full | Applying One-Class Algorithms for Data Stream-Based Insider Threat Detection |
| title_fullStr | Applying One-Class Algorithms for Data Stream-Based Insider Threat Detection |
| title_full_unstemmed | Applying One-Class Algorithms for Data Stream-Based Insider Threat Detection |
| title_short | Applying One-Class Algorithms for Data Stream-Based Insider Threat Detection |
| title_sort | applying one class algorithms for data stream based insider threat detection |
| topic | Insider threat detection data stream machine learning one-class classification |
| url | https://ieeexplore.ieee.org/document/10177772/ |
| work_keys_str_mv | AT rafaelbrunopeccatiello applyingoneclassalgorithmsfordatastreambasedinsiderthreatdetection AT joaojosecostagondim applyingoneclassalgorithmsfordatastreambasedinsiderthreatdetection AT luispaulofainagarcia applyingoneclassalgorithmsfordatastreambasedinsiderthreatdetection |