Detecting an Insider Threat and Analysis of XGBoost using Hyperparameter tuning

Nowadays, organizations of all forms and sizes are facing many challenges with regards to protecting their data, systems and devices, and one of the alarming concernsis the Insider threat. Insiders try to misuse their privileges to compromise the privacy, integrity and accessibility of the data or the device. An Insider attack leads to immense loss to the company in terms of integrity, trust and revenue. There are many Machine Learning approaches to detect malicious insiders that provide solutions to these attacks. At the same time, they demonstrated short-comings with regards to performance and Accuracy. Therefore, in this paper, a novel machine learning model is proposed using XGBoost algorithm to address these problems. XGBoost is a decision-tree based ensemble machine learning algorithm that uses a gradient boosting framework that improves speed and performance. Hyper-parameter optimization using Grid Search was applied to enhance the performance of the model using the CERT 4.2 dataset to detect the insider. The model has generated the desired results with a high accuracy rate of 98.6%. A webform was also created using Flask Micro Web Framework that takes user attributes as an input and detects insider activity using the XGBoost model.