论文标题
LAC：LSTM自动编码器与社区进行内幕威胁检测
LAC : LSTM AUTOENCODER with Community for Insider Threat Detection
论文作者
论文摘要
任何组织，研究所或行业的员工都在计算机网络上花费大量时间，在那里他们以一段时间内以网络交易的形式开发自己的日常活动。内部威胁检测涉及确定常规或异常情况的偏差，这些偏差可能会以数据泄漏和秘密共享的形式对组织造成损害。如果不是自动化的话，此过程涉及用于建模人类行为的功能工程，这是一项乏味且耗时的任务。人类行为中的异常情况被转发给人类分析师以进行最终威胁分类。我们使用LSTM自动编码器开发了一种无监督的深度神经网络模型，该模型学会了模仿单个员工的行为，从他们的日常时间戳记的活动序列中。它可以通过异常常规造成的重大损失来预测威胁情况。社区中的员工倾向于彼此保持一致，而不是社区以外的员工，这激发了我们探索自动编码器的变体LSTM自动编码器，受过培训的社区活动序列（LAC）。我们在CERT V6.2数据集上评估了该模型，并对4000名员工的正常和异常例行程序进行分析。我们论文的目的是检测异常员工，并探讨周围员工如何影响员工的日常工作。
The employees of any organization, institute, or industry, spend a significant amount of time on a computer network, where they develop their own routine of activities in the form of network transactions over a time period. Insider threat detection involves identifying deviations in the routines or anomalies which may cause harm to the organization in the form of data leaks and secrets sharing. If not automated, this process involves feature engineering for modeling human behavior which is a tedious and time-consuming task. Anomalies in human behavior are forwarded to a human analyst for final threat classification. We developed an unsupervised deep neural network model using LSTM AUTOENCODER which learns to mimic the behavior of individual employees from their day-wise time-stamped sequence of activities. It predicts the threat scenario via significant loss from anomalous routine. Employees in a community tend to align their routine with each other rather than the employees outside their communities, this motivates us to explore a variation of the AUTOENCODER, LSTM AUTOENCODER- trained on the interleaved sequences of activities in the Community (LAC). We evaluate the model on the CERT v6.2 dataset and perform analysis on the loss for normal and anomalous routine across 4000 employees. The aim of our paper is to detect the anomalous employees as well as to explore how the surrounding employees are affecting that employees' routine over time.
