Insider Threat Detection Model Using Anomaly-Based Isolation Forest Algorithm
Insider attacks may inflict far greater damage to an organization than outsider threats since insiders are authorized users who are acquainted with the business’s system, making detection harder. Many techniques to detecting insider threats have been developed, but they are neither flexib...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2023-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/10290890/ |
| _version_ | 1827778773027651584 |
|---|---|
| author | Taher Al-Shehari Muna Al-Razgan Taha Alfakih Rakan A. Alsowail Saravanan Pandiaraj |
| author_facet | Taher Al-Shehari Muna Al-Razgan Taha Alfakih Rakan A. Alsowail Saravanan Pandiaraj |
| author_sort | Taher Al-Shehari |
| collection | DOAJ |
| description | Insider attacks may inflict far greater damage to an organization than outsider threats since insiders are authorized users who are acquainted with the business’s system, making detection harder. Many techniques to detecting insider threats have been developed, but they are neither flexible nor resilient owing to different obstacles (e.g., lack of real-world dataset and highly skewed class distribution of the available dataset), making insider threat detection an understudied research field. Previous techniques attempted to solve the dataset’s imbalance issue by increasing or lowering the observations of the dataset’s classes, however this might lead to underfitting and overfitting problems. We present an insider threat detection model that addresses the class imbalance problem at the algorithm level using anomaly-based techniques, as an enhancement over previous approaches. To limit the effect of skewed class distribution on insider threat detection, the Isolation Forest (IF) technique is used. The model is verified using the benchmarked CERT’s insider threat dataset, which is significantly unbalanced, with a small number of malicious cases vs a large number of non-malicious instances. Several contamination ratios of IF’s parameters are used to verify the model’s performance throughout a range of anomaly scores. The experimental findings reveal that the suggested model handles the dataset class imbalance problem with an accuracy score of 98%. The findings are compared to the baseline technique to demonstrate how the proposed model enhances detection performance and addresses the problem of data imbalance. The findings indicate the usefulness of the suggested approach for identifying insider threats when compared to previous studies. |
| first_indexed | 2024-03-11T14:38:35Z |
| format | Article |
| id | doaj.art-f8bfb587c5964fcf856b85baa7d0e471 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-03-11T14:38:35Z |
| publishDate | 2023-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-f8bfb587c5964fcf856b85baa7d0e4712023-10-30T23:01:02ZengIEEEIEEE Access2169-35362023-01-011111817011818510.1109/ACCESS.2023.332675010290890Insider Threat Detection Model Using Anomaly-Based Isolation Forest AlgorithmTaher Al-Shehari0https://orcid.org/0000-0002-9783-919XMuna Al-Razgan1https://orcid.org/0000-0002-9705-3867Taha Alfakih2https://orcid.org/0000-0003-0366-5932Rakan A. Alsowail3Saravanan Pandiaraj4Computer Skills, Department of Self-Development Skills, Common First Year Deanship, King Saud University, Riyadh, Saudi ArabiaDepartment of Software Engineering, College of Computer and Information Sciences, King Saud University, Riyadh, Saudi ArabiaDepartment of Information Systems, College of Computer and Information Sciences, King Saud University, Riyadh, Saudi ArabiaComputer Skills, Department of Self-Development Skills, Common First Year Deanship, King Saud University, Riyadh, Saudi ArabiaComputer Skills, Department of Self-Development Skills, Common First Year Deanship, King Saud University, Riyadh, Saudi ArabiaInsider attacks may inflict far greater damage to an organization than outsider threats since insiders are authorized users who are acquainted with the business’s system, making detection harder. Many techniques to detecting insider threats have been developed, but they are neither flexible nor resilient owing to different obstacles (e.g., lack of real-world dataset and highly skewed class distribution of the available dataset), making insider threat detection an understudied research field. Previous techniques attempted to solve the dataset’s imbalance issue by increasing or lowering the observations of the dataset’s classes, however this might lead to underfitting and overfitting problems. We present an insider threat detection model that addresses the class imbalance problem at the algorithm level using anomaly-based techniques, as an enhancement over previous approaches. To limit the effect of skewed class distribution on insider threat detection, the Isolation Forest (IF) technique is used. The model is verified using the benchmarked CERT’s insider threat dataset, which is significantly unbalanced, with a small number of malicious cases vs a large number of non-malicious instances. Several contamination ratios of IF’s parameters are used to verify the model’s performance throughout a range of anomaly scores. The experimental findings reveal that the suggested model handles the dataset class imbalance problem with an accuracy score of 98%. The findings are compared to the baseline technique to demonstrate how the proposed model enhances detection performance and addresses the problem of data imbalance. The findings indicate the usefulness of the suggested approach for identifying insider threats when compared to previous studies.https://ieeexplore.ieee.org/document/10290890/Anomaly detectiondataset imbalance issueinsider threat detectionisolation forestmachine learning |
| spellingShingle | Taher Al-Shehari Muna Al-Razgan Taha Alfakih Rakan A. Alsowail Saravanan Pandiaraj Insider Threat Detection Model Using Anomaly-Based Isolation Forest Algorithm IEEE Access Anomaly detection dataset imbalance issue insider threat detection isolation forest machine learning |
| title | Insider Threat Detection Model Using Anomaly-Based Isolation Forest Algorithm |
| title_full | Insider Threat Detection Model Using Anomaly-Based Isolation Forest Algorithm |
| title_fullStr | Insider Threat Detection Model Using Anomaly-Based Isolation Forest Algorithm |
| title_full_unstemmed | Insider Threat Detection Model Using Anomaly-Based Isolation Forest Algorithm |
| title_short | Insider Threat Detection Model Using Anomaly-Based Isolation Forest Algorithm |
| title_sort | insider threat detection model using anomaly based isolation forest algorithm |
| topic | Anomaly detection dataset imbalance issue insider threat detection isolation forest machine learning |
| url | https://ieeexplore.ieee.org/document/10290890/ |
| work_keys_str_mv | AT taheralshehari insiderthreatdetectionmodelusinganomalybasedisolationforestalgorithm AT munaalrazgan insiderthreatdetectionmodelusinganomalybasedisolationforestalgorithm AT tahaalfakih insiderthreatdetectionmodelusinganomalybasedisolationforestalgorithm AT rakanaalsowail insiderthreatdetectionmodelusinganomalybasedisolationforestalgorithm AT saravananpandiaraj insiderthreatdetectionmodelusinganomalybasedisolationforestalgorithm |