A Lower-Cost Insider Threat Detection Framework Based on User Cluster and Behavior Feature Analysis

Insider threat are actions by insiders that violate an organization's security policies, and have become a serious challenge to organizational security in digital and cloud-based environments nowadays. As a result, insider threat detection has become one of the key strategies to secure organizational information assets. However, existing methods are costly to maintain a model for each user, and in order to maintain a high detection accuracy, these methods are overly sensitive to user behavior, which leads to a high false positive and negatively affects the detection of user behavior. In this paper, we propose a lower-cost insider threat detection framework (LITD) based on user cluster and user behavior analysis. LITD clusters user classes according to user behavioral features, and trains deep learning models for each user class instead of a single user, thereby reducing the detection cost. In addition, we design a log content detection model to detect threatening information in specific log content. A risk detection and assessment model is built to use a risk list for final determination, and it significantly reduces the false positive while ensuring detection accuracy based on the combined assessment of multiple risks. A series of experiments are conducted using the publicly available CERT dataset, the results show that LITD outperforms state-of-the-art methods in the four metrics of Accuracy, Precision, Recall, and False Positive Rate (FPR), with the FPR metric being considerably lower.