LAC : LSTM AUTOENCODER with Community for Insider Threat Detection
  The employees of any organization, institute, or industry, spend a
significant amount of time on a computer network, where they develop their own
routine of activities in the form of network transactions over a time period.
Insider threat detection involves identifying deviations in the routines or
anomalies which may cause harm to the organization in the form of data leaks
and secrets sharing. If not automated, this process involves feature
engineering for modeling human behavior which is a tedious and time-consuming
task. Anomalies in human behavior are forwarded to a human analyst for final
threat classification. We developed an unsupervised deep neural network model
using LSTM AUTOENCODER which learns to mimic the behavior of individual
employees from their day-wise time-stamped sequence of activities. It predicts
the threat scenario via significant loss from anomalous routine. Employees in a
community tend to align their routine with each other rather than the employees
outside their communities, this motivates us to explore a variation of the
AUTOENCODER, LSTM AUTOENCODER- trained on the interleaved sequences of
activities in the Community (LAC). We evaluate the model on the CERT v6.2
dataset and perform analysis on the loss for normal and anomalous routine
across 4000 employees. The aim of our paper is to detect the anomalous
employees as well as to explore how the surrounding employees are affecting
that employees' routine over time.
