[Paper Review] Multi-class Classification Based Anomaly Detection of Insider Activities

R G Gayathri, Atul Sajjanhar+2 more|arXiv (Cornell University)|Feb 15, 2021

Network Security and Intrusion Detection15 references7 citations

TL;DR

This paper proposes a multi-class anomaly detection framework for insider threat detection by combining Conditional GAN (CGAN) with supervised deep learning to address data imbalance. By generating synthetic minority-class samples, the method improves classification performance on imbalanced insider activity data, demonstrating superior results over existing approaches on a benchmark dataset.

ABSTRACT

Insider threats are the cyber attacks from within the trusted entities of an organization. Lack of real-world data and issue of data imbalance leave insider threat analysis an understudied research area. To mitigate the effect of skewed class distribution and prove the potential of multinomial classification algorithms for insider threat detection, we propose an approach that combines generative model with supervised learning to perform multi-class classification using deep learning. The generative adversarial network (GAN) based insider detection model introduces Conditional Generative Adversarial Network (CGAN) to enrich minority class samples to provide data for multi-class anomaly detection. The comprehensive experiments performed on the benchmark dataset demonstrates the effectiveness of introducing GAN derived synthetic data and the capability of multi-class anomaly detection in insider activity analysis. Moreover, the method is compared with other existing methods against different parameters and performance metrics.

Motivation & Objective

• Address the challenge of data imbalance in insider threat detection due to scarcity of real-world labeled data.
• Explore the potential of multi-class classification over binary classification for detecting diverse insider attack patterns.
• Develop a deep learning framework that leverages generative modeling to augment minority insider threat classes.
• Evaluate the effectiveness of synthetic data from CGAN in improving anomaly detection performance.
• Compare the proposed method against existing state-of-the-art approaches using multiple metrics and parameters.

Proposed method

• Employ a Conditional Generative Adversarial Network (CGAN) to generate synthetic samples for underrepresented insider threat classes.
• Use the generated synthetic data to train a deep neural network for multi-class classification of insider activities.
• Condition the generator on class labels to ensure synthetic samples align with specific insider threat types.
• Train the discriminator to distinguish between real and synthetic insider activity samples, improving data quality and distribution.
• Apply supervised learning on the augmented dataset to classify insider activities into multiple threat categories.
• Optimize the model using standard deep learning loss functions and evaluation metrics on a benchmark dataset.

Experimental results

Research questions

• RQ1 Can CGAN-generated synthetic data effectively mitigate class imbalance in insider threat detection?
• RQ2 How does multi-class classification compare to binary classification in detecting diverse insider threats?
• RQ3 To what extent does the integration of generative modeling improve detection performance on imbalanced insider activity data?
• RQ4 How does the proposed method perform relative to existing state-of-the-art approaches across different evaluation metrics?
• RQ5 What is the impact of varying hyperparameters on the model's classification accuracy and anomaly detection capability?

Key findings

• The proposed method significantly improves detection performance on minority insider threat classes by leveraging synthetic data from CGAN.
• Multi-class classification outperforms binary classification in capturing diverse insider threat patterns.
• The integration of CGAN-generated data leads to higher F1-scores and AUC values compared to baseline models.
• The model demonstrates robustness across different performance metrics, including precision, recall, and F1-score.
• Comprehensive experiments confirm the effectiveness of the approach on a benchmark insider threat dataset.
• The method shows consistent improvement over existing techniques under varying parameter settings.