{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/deep-learning-for-unsupervised-insider-threat","title":"Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams","arxiv_id":"1710.00811","date":"2017-10-02","proceeding":null,"authors":["Aaron Tuor","Samuel Kaplan","Brian Hutchinson","Nicole Nichols","Sean Robinson"],"abstract":"Analysis of an organization's computer network activity is a key component of\nearly detection and mitigation of insider threat, a growing concern for many\norganizations. Raw system logs are a prototypical example of streaming data\nthat can quickly scale beyond the cognitive power of a human analyst. As a\nprospective filter for the human analyst, we present an online unsupervised\ndeep learning approach to detect anomalous network activity from system logs in\nreal time. Our models decompose anomaly scores into the contributions of\nindividual user behavior features for increased interpretability to aid\nanalysts reviewing potential cases of insider threat. Using the CERT Insider\nThreat Dataset v6.2 and threat detection recall as our performance metric, our\nnovel deep and recurrent neural network models outperform Principal Component\nAnalysis, Support Vector Machine and Isolation Forest based anomaly detection\nbaselines. For our best model, the events labeled as insider threat activity in\nour dataset had an average anomaly score in the 95.53 percentile, demonstrating\nour approach's potential to greatly reduce analyst workloads.","url_abs":"http://arxiv.org/abs/1710.00811v2","url_pdf":"http://arxiv.org/pdf/1710.00811v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"deep-learning-for-unsupervised-insider-threat","repo_url":"https://github.com/pnnl/safekit","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"tf","reach":{"status":"unanswered"}}],"tasks":[{"task_slug":"anomaly-detection","task_name":"Anomaly Detection"}],"methods":[{"method_slug":"interpretability","method_name":"Interpretability"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1710.00811","mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}