Prediction and Detection of Insider Threat Detection using Emails: A Comparision

Recent breaches have proved that the insider threats are the most challenging type of threat and have shown the importance of research of insider threat in cybersecurity. As this problem is being researched by security communities using the traditional machine learning techniques. These techniques use feature engineering and some use anomaly-based detection which are based on high false positives. As these techniques are not able to identify the difference in the behavior of normal and malicious user because such characteristics like complexity, high dimensionality, lack of labelled threats, the nature (subtle and adaptive) of insiders, heterogeneity and the data related to personality and psychological traits is hard to collect as these do not capture motivations behind attacks. As compared to the traditional techniques, advanced machine learning techniques provide better detection for insiders, but the detection still has some limitations like lack of labelled data and adaptive attacks. In this paper, a new methodology is proposed for psychological sentiment analysis based on the email and the network browsing done by the insiders using LDA and SMO. After demonstration, the technique is then being compared with traditional methods and the malicious insiders with negative emotions are detected. This research is built to identify the emotions of the insiders based on the text and sentiment analysis of the emails and the webpages browsed.

I. Introduction

Insider threat is a breach in the security of target organisation. As per study, organisations have to tackle with the different types of threats which may cause in security breach. Insider threat is difficult to detect and to deal with as it is caused by insiders who are authorised persons of the organizations with all the access to the confidential information and resources. The insiders may be malicious, preparators, but the most commonly found insiders are malicious which attempts the threats intentionally [1] [2]. Many cybercrimes were found as caused by malicious insiders. Some of the techniques used for detection has analyzed user's behavior by considering audit data i.e. the data that is host based which actually record the activities of users done on computer, data based on network which is recorded by equipment connected to network and context data which records the information of the user's profile. According to recent research the insider threat detection can be categorized in 7 different classes that are classified based on strategies and features- (i) Role based access (ii) Anomaly based (iii) Scenario based (iv) psychological risk factors (v) honey pot (vi) network based (vii) graph based. However existing techniques endure good insider threat detection but the traditional machine learning methods are not able to use user behavior data in full for detection and only anomalous behavior[3] [4].