사용자 행위 모델과 이상치 탐지 알고리즘을 활용한 내부자 이상행위 탐지

In this paper, we propose insider threat detection methods based on user behavior modeling and novelty detection algorithms. Although traditional insider treat detection methods focus on the rule-based approaches built by domain knowledge of experts, it turns out that they are neither flexible nor robust. Recently, machine learning-based approaches have been highlighted as an alternative to rule-based approaches because data driven detection system can be more applicable to actual systems. To do so, we first design the user behavior model that transforms log records of user activities, inappropriate for machine learning algorithms, into numerical vectors to encode user behaviors to instances. Then we apply variable selection methods and novelty detection algorithms to efficiently detect the rare insider treats or malicious (suspicious) activities. Experimental results support that the proposed framework can work well for severally imbalanced data sets in which there are only a few insider threats although no domain experts’ knowledge is provided.