Transfer Learning-Based Robust Insider Threat Detection

A malicious insider’s threats who has access to the organization’s systems and is familiar with security policies are difficult to detect and can cause significant financial damage. A reconstruction-based anomaly detection method leveraging deep learning is one method for detecting insider threats. The method is employed to solve a data imbalance problem caused by the scarcity of abnormal data in real environments. The method trains a deep learning model to reconstruct normal data received from all users. After training, the model reconstructs normal data more accurately than abnormal data, and the reconstruction-based anomaly detection method can detect anomalies based on the reconstruction difference between normal and abnormal data. However, existing reconstruction-based anomaly detection methods train on all users’ normal data using the same network parameters. Consequently, if a behavior is normal for one user but abnormal for another, the reconstruction model learns this behavior as normal because the reconstruction model trains only on normal behaviors. Since normal behaviors differ for each user depending on their position, role, and other factors within the organization, it is necessary to develop methods for detecting abnormal behaviors specific to each user. To address this problem, we propose a transfer learning-based insider threat detection method. The proposed method consists of 1) a pre-trained encoder that outputs latent representations of normal data for all users and 2) user-specific decoders assigned to each user, which are trained on the corresponding user’s normal data to reconstruct their normal data. We evaluate the proposed method’s detection rate (DR) and area under the curve (AUC) on the CERT dataset and compare it with a deep learning model trained on normal data from all users. The experimental results show that the proposed method achieves higher DR and AUC than the deep learning model. These results indicate that the proposed method enhances insider threat detection performance by enabling the detection of user-specific abnormal behaviors.