A Study on Historical Behaviour Enabled Insider Threat Prediction

Insider threats have been the major challenges in cybersecurity in recent years since they come from authorized individuals and usually cause significant losses once succeeded. Researchers have been trying to solve this problem by discovering the malicious activities that have already happened, which offers not much help for the prevention of those threats. In this paper, we propose a novel problem setting that focuses on predicting whether an individual would be a malicious insider in a future day based on their daily behavioral records of the previous several days, which could assist cybersecurity specialists in better allocating managerial resources. We investigate seven traditional machine learning methods and two deep learning methods, evaluating their performance on the CERT-r4.2 dataset for this specific task. Results show that the random forest algorithm tops the ranking list with f1 = 0.8447 in the best case, and deep learning models are not necessarily better than machine learning models for this specific problem setting. Further study shows that the historical records from the previous four days around can offer the most predicting power compared with other length settings. We publish our codes on GitHub: https://github.com/mybingxf/insider-threat-prediction.