User behaviour based insider threat detection model using an LSTM integrated RF model.

Abstract

Insider threat is one of the most serious and frequent security risks facing various industries like governmental organizations, businesses, and institutions. Insider threat identification has a special combination of difficulties, including vastly unbalanced data, insufficient ground truth, and drifting and shifting behaviour. A user behaviour-based insider threat detection model utilizing a hybrid deep long short-term memory-random forest (LSTM-RF) model is developed to address these challenges. In this proposed insider threat detection model, the user log data is preprocessed to replace the missing value and to normalize the data to certain range. Then, these preprocessed data are provided as the input of the attribute selection process that mainly applies for selecting the essential attribute using Spearman's rank correlation coefficient. Then the deep hybrid LSTM-RF classifier to detect whether a system is affected by inside threat or not such as malware, authentication, phishing are fed to the selected features. Hybrid LSTM-RF method is implemented in python and achieved 96% accuracy, 90% precision, 90% specificity, 97% sensitivity, and 94% F1-score. During an attack, it can be easily detected inside the system attack.