Performance Evaluation Framework for Insider Threat Detection Using Machine Learning

Abstract

Nowadays, malicious behavior identification is considered a significant and challenging issue in cybersecurity. To mitigate this problem, an effective detection system can be a promising candidate to facilitate precise and rapid detection of a malicious insider. In this paper, a performance evaluation framework for insider threat detection using machine learning is proposed. This framework employs the effects of several machine learning models to assist in identifying insider threats. The proposed framework applied XGboost, SVM, RF, KNN, MLP, and LR to detect insider threats. The machine learning framework is evaluated across the CERT r5.2 dataset. After that, the results of these models are compared with evaluation metrics to determine which model is the most effective for insider detection at different granularity levels. Furthermore, we have empirically shown that XGBoost outperforms competitive algorithms and can achieve a range precision of 95.24%-97.85%, recall of 97.34%-99.30%, F1 score of 96.79%-98.81 %, and an AUC of 97.04%-98.63% for insider detection.