Deep Learning for Insider Threat Detection: Review, Challenges and Opportunities

Abstract

Insider threats, as one type of the most challenging threats in cyberspace, usually cause significant loss to organizations. While the problem of insider threat detection has been studied for a long time in both security and data mining communities, the traditional machine learning based detection approaches, which heavily rely on feature engineering, are hard to accurately capture the behavior difference between insiders and normal users due to various challenges related to the characteristics of underlying data, such as high-dimensionality, complexity, heterogeneity, sparsity, lack of labeled insider threats, and the subtle and adaptive nature of insider threats. Advanced deep learning techniques provide a new paradigm to learn end-to-end models from complex data. In this brief survey, we first introduce one commonly-used dataset for insider threat detection and review the recent literature about deep learning for such research. The existing studies show that compared with traditional machine learning algorithms, deep learning models can improve the performance of insider threat detection. However, applying deep learning to further advance the insider threat detection task still faces several limitations, such as lack of labeled data, adaptive attacks. We then discuss such challenges and suggest future research directions that have the potential to address challenges and further boost the performance of deep learning for insider threat detection.

References in corpus (10)

• A Brief Survey of Deep Reinforcement Learning
• Deep Learning for Anomaly Detection: A Survey
• Gated Feedback Recurrent Neural Networks
• Deep Anomaly Detection with Outlier Exposure
• Learning to reinforcement learn
• Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams
• Machine Learning for Survival Analysis: A Survey
• Deep Learning for Patient-Specific Kidney Graft Survival Analysis
• Deep Learning for Sentiment Analysis : A Survey
• Bidirectional LSTM-CRF for Clinical Concept Extraction