Insider threat detection using principal component analysis and self-organising map

Moradpoor, Naghmeh; Brown, Martyn; Russell, Gordon

Abstract

An insider threat can take on many aspects. Some employees abuse their positions of trust by disrupting normal operations, while others export valuable or confidential data which can damage the employer's marketing position and reputation. In addition, some just lose their credentials which are then abused in their name. In this paper, we use Principal Component Analysis (PCA) in conjunction with Self-Organising Map (SOM) for insider threat detection within an organisation. The results show that using PCA before SOM increases the clustering accuracy. CCS CONCEPTS • Security and privacy → Intrusion/anomaly detection and malware mitigation → Intrusion detection systems

• Presentation Conference Type: Conference Paper (Published)
• Conference Name: Proceedings of the 10th International Conference on Security of Information and Networks - SIN '17
• Start Date: Oct 13, 2017
• End Date: Oct 15, 2017
• Acceptance Date: Aug 21, 2017
• Online Publication Date: Oct 13, 2017
• Publication Date: Oct 13, 2017
• Deposit Date: Sep 3, 2017
• Publicly Available Date: Dec 14, 2017
• Publisher: Association for Computing Machinery (ACM)
• Book Title: 10th International Conference on Security of Information and Networks (SIN 2017)
• ISBN: 9781450353038
• DOI: https://doi.org/10.1145/3136825.3136859
• Keywords: Insider Threat; Unsupervised Machine Learning; Self-Organising Map; Principal Component Analysis
• Public URL: http://researchrepository.napier.ac.uk/Output/982950