Scenario Driven Insider Threat Detection Using Dual Modelling Architecture
摘要
The increasing of vulnerabilities within organization has results in designing of improved insider threat detection (ITD) approaches. In cybersecurity research, more ITD approaches are developed based on data driven, scenario and behavioral analysis. However, those existing ITD approaches have some complications are lack of real work datasets and inflexibility of emerging specific models are not compactible for addressing entire insider threat incidents. To overcome these challenges, the researchers have developed an approach called Dual Modelling architecture (DMA) to detect the anomalous insider threats. The DMA approach consist metaheuristic metaheuristic-tuned tree ensemble model that composed of Archimedes Optimization Algorithm (AOA) and Red Fox Optimization (RFO) to optimize hyperparameter in self-attention transformer-based neural network (SATNN) for effective sample selection and anomaly detection that learns the end-to-end sequential user event features by achieving high detection fidelity with tight cross-validation. The proposed approach was implemented in a simulated insider-activity scenario-driven synthetic dataset, PULSE (Profile-based User Logs for Synthetic Evaluation). The performance of the DMA approach was evaluated in terms of accuracy, precision, detection rate, and false alarm rate. Using a large suite of behavior and activity-based features, the DMA approach supports effective binary classification of insider and non-insider objects as well as multi-class discrimination between different types of insider threats. The proposed approach DMA exists binary and multiclass classification where the substantial false positive reductions are given by binary classification and exact fine-grained threat profiles are classified by multiclass evaluation. This shows the importance of DMA approach in combination of attention models with metaheuristics optimization. The experimental results ensure the efficiency of synthetic data generation and scalable ITD approach to decrease the subtle threats of an organizations.