Prediction and Detection of Insider Threat Detection using Emails: A Comparision
Anupam Mittal, Urvashi Garg
Abstract
Recent breaches have proved that the insider threats are the most challenging type of threat and have shown the importance of research of insider threat in cybersecurity. As this problem is being researched by security communities using the traditional machine learning techniques. These techniques use feature engineering and some use anomaly-based detection which are based on high false positives. As these techniques are not able to identify the difference in the behavior of normal and malicious user because such characteristics like complexity, high dimensionality, lack of labelled threats, the nature (subtle and adaptive) of insiders, heterogeneity and the data related to personality and psychological traits is hard to collect as these do not capture motivations behind attacks. As compared to the traditional techniques, advanced machine learning techniques provide better detection for insiders, but the detection still has some limitations like lack of labelled data and adaptive attacks. In this paper, a new methodology is proposed for psychological sentiment analysis based on the email and the network browsing done by the insiders using LDA and SMO. After demonstration, the technique is then being compared with traditional methods and the malicious insiders with negative emotions are detected. This research is built to identify the emotions of the insiders based on the text and sentiment analysis of the emails and the webpages browsed.