Insider Threat Detection Using An Unsupervised Learning Method: COPOD
Xiaoshuang Sun, Yu Wang, Zengkai Shi
Abstract
In recent years, insider threat incidents and losses of companies or organizations are on the rise, and internal network security is facing great challenges. Traditional intrusion detection methods cannot identify malicious behaviors of insiders. As an effective method, insider threat detection technology has been widely concerned and studied. In this paper, we use the tree structure method to analyze user behavior, form feature sequences, and combine the Copula Based Outlier Detection (COPOD) method to detect the difference between feature sequences and identify abnormal users. We experimented on the insider threat dataset CERT-IT and compared it with common methods such as Isolation Forest.
Topics & Concepts
Insider threatInsiderComputer scienceIntrusion detection systemAnomaly detectionComputer securityFeature (linguistics)Network securityFeature extractionArtificial intelligenceData miningMachine learningPolitical scienceLinguisticsLawPhilosophyNetwork Security and Intrusion DetectionAnomaly Detection Techniques and ApplicationsAdvanced Malware Detection Techniques