Published Paper Details:

Malicious insider threat attacks signify one of the most destructive threats to networked systems of establishments and companies. There is a unique set of challenges that come with insider threat detection in term of hugely unbalanced data, limited ground truth, as well as behavior drifts and shifts. In this research, we study and evaluate an insider threat detection workflow using supervised learning algorithms. To this end, we study on multiple levels of granularity under realistic condition for identifying not only malicious behaviors but also malicious insider. We evaluate several supervised learning algorithm LR, MN, RF and XG using this workflow. Detailed analyses of widespread insider threat scenarios with different performance measures are presented to facilitate the realistic estimate of system performance. Evaluation results show that the machine learning based detection system can learn from limited ground truth and detect new malicious insider in unseen data with a high accuracy.